Privacy Policy - Kidbrooke Storage

This Privacy Policy explains how Kidbrooke Storage collects, uses, shares, stores, and protects personal data relating to its customers and prospective customers. It applies to all Kidbrooke Storage customers in the area, including individuals who enquire about storage services, reserve units, sign agreements, receive customer support, or otherwise interact with our services. We are committed to handling personal data in accordance with the UK GDPR and the Data Protection Act 2018, and to ensuring that personal information is processed fairly, lawfully, and transparently.

This policy is intended to help you understand what information we collect, why we collect it, how long we keep it, who may process it on our behalf, and what rights you have in relation to your personal data.

1. Personal Data We Collect

We collect only the information necessary to provide storage services, manage our business operations, and meet our legal obligations. The types of personal data we may collect include:

Identity details: full name, title, date of birth, and, where needed, identification document details.
Contact details: address, email address, telephone number, and correspondence preferences.
Account and service details: storage unit information, booking records, rental dates, access permissions, payment status, and customer service notes.
Payment information: payment method details, transaction records, billing history, and refund records. In most cases, payment card details are processed by secure third-party payment providers rather than stored by us.
Security and access records: entry logs, CCTV images where applicable, incident reports, and records relating to site access or security events.
Communication data: messages, enquiries, complaints, requests, and records of any communications with our team.
Technical data: basic device and usage information if collected through digital systems used to manage services, such as IP address or log data.

We generally collect data directly from you when you make an enquiry, sign up for services, make payments, communicate with us, or use our facilities. In some cases, we may also receive information from third parties such as referees, authorised representatives, payment providers, fraud prevention services, or legal and regulatory bodies.

2. How We Use Personal Data

Kidbrooke Storage uses personal data for the following purposes:

to assess and manage enquiries, reservations, and customer accounts;
to provide storage services and manage the rental relationship;
to process payments, invoices, and refunds;
to verify identity and protect against fraud, misuse, or unauthorised access;
to maintain the safety and security of our sites, staff, customers, and property;
to deal with queries, complaints, disputes, and customer support requests;
to comply with legal, tax, accounting, and regulatory obligations;
to enforce agreements, recover debts, and manage insurance or claims matters;
to improve our services, systems, and customer experience;
to maintain business records and evidence of transactions and communications.

We only process personal data where we have a valid lawful basis to do so. We do not use personal data for purposes incompatible with those explained in this policy unless required or permitted by law.

3. Lawful Basis for Processing

Under data protection law, we must have a lawful basis for each type of processing. Depending on the context, Kidbrooke Storage may rely on one or more of the following lawful bases:

Contract

We process personal data when it is necessary to enter into or perform a contract with you. This includes setting up an account, managing storage services, billing, and providing access to rented units.

Legal obligation

We process certain personal data to comply with legal and regulatory requirements, such as tax rules, accounting obligations, safeguarding requirements, fraud prevention, and lawful requests from authorities.

Legitimate interests

We may process data where it is necessary for our legitimate business interests, provided those interests are not overridden by your rights and freedoms. Examples include improving operations, maintaining security, preventing fraud, resolving disputes, and managing our business efficiently. Where appropriate, we carry out a balancing assessment to make sure this use is fair and proportionate.

Consent

In limited cases, we may rely on your consent, for example where you have agreed to receive specific types of optional communications. If we rely on consent, you may withdraw it at any time. Withdrawal will not affect processing carried out before consent was withdrawn.

Vital interests and public task

These lawful bases are unlikely to apply in normal storage operations, but where relevant in exceptional circumstances we may process data to protect someone’s vital interests or where required for a public task performed by a competent authority.

4. Sharing and Processors

We may share personal data with trusted third parties where necessary for service delivery, legal compliance, or business operations. These third parties may act as processors acting on our instructions, or as independent controllers in their own right. We take steps to ensure that any sharing is appropriate, secure, and limited to what is necessary.

Processors may include:

payment service providers that handle billing and transaction processing;
IT and cloud service providers supporting data storage, email, and system administration;
accounting, audit, and tax service providers;
security providers, CCTV maintenance providers, and access control system operators;
customer relationship management and booking system providers;
professional advisers such as lawyers, insurers, and consultants;
debt recovery or dispute resolution services where lawfully required;
delivery or collection partners where services involve access arrangements;
regulatory bodies, law enforcement, courts, or public authorities where disclosure is required by law.

We require processors to protect personal data with appropriate technical and organisational measures, to use the data only for specified purposes, and to keep it confidential. Where personal data is transferred outside the UK, we ensure suitable safeguards are in place in accordance with applicable law.

5. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, accounting, and reporting requirements. Retention periods vary depending on the type of record and the reason for processing.

Customer account and contract records: kept for the duration of the relationship and for a reasonable period afterward to deal with queries, claims, or legal matters.
Financial and tax records: generally retained for the period required by law for accounting and tax purposes.
Security and access records: kept only as long as needed for safety, incident management, and operational security.
Communication records: retained for as long as necessary to respond to requests, manage complaints, or demonstrate what was agreed.

When data is no longer required, we will securely delete, anonymise, or archive it in accordance with our retention procedures. We apply retention limits to reduce unnecessary storage of personal information.

6. Data Security

We take appropriate measures to protect personal data against loss, misuse, unauthorised access, alteration, or disclosure. These measures may include access controls, password protection, staff confidentiality obligations, secure storage, monitoring, and regular review of our systems and procedures. While no system can be guaranteed completely secure, we work to reduce risks and respond promptly to incidents where they occur.

7. Your Rights

Under data protection law, you have a number of rights regarding your personal data. These rights may be subject to conditions and exceptions depending on the circumstances.

Right of access: you can request a copy of the personal data we hold about you.
Right to rectification: you can ask us to correct inaccurate or incomplete information.
Right to erasure: you can ask us to delete personal data in certain situations.
Right to restriction: you can ask us to restrict how we use your data in some circumstances.
Right to data portability: you may request that certain data be provided to you or another organisation in a structured, commonly used format.
Right to object: you can object to processing based on legitimate interests, including certain forms of direct marketing where applicable.
Right to withdraw consent: where we rely on consent, you can withdraw it at any time.
Right to complain: you may raise concerns with the relevant supervisory authority if you believe your data has not been handled lawfully.

We may need to verify your identity before responding to a request. We aim to respond within the timescales required by law and to provide clear information about any action we take.

8. Automated Decision-Making

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on customers, unless this is lawful, necessary, and subject to appropriate safeguards. If this position changes, we will update this policy accordingly.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, operational practice, or our services. Any revised version will apply from the date it is published or otherwise communicated. We encourage customers to review this policy periodically to stay informed about how we handle personal data.

10. Scope of This Policy

This Privacy Policy applies to all Kidbrooke Storage customers in the area and to individuals who interact with our services in connection with storage enquiries, bookings, rentals, payments, and support. By using our services, you acknowledge that your personal data may be processed as described in this policy, in accordance with applicable data protection law.

Last updated: 2026