Privacy Policy - Locksbottom Storage

This Privacy Policy explains how Locksbottom Storage collects, uses, stores, shares, and protects personal data relating to our customers, prospective customers, visitors, and other individuals whose data we process in the course of providing storage services. It applies to all Locksbottom Storage customers in the area and to anyone who interacts with us in connection with our services. We are committed to handling personal data in a lawful, fair, transparent, and secure manner in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Locksbottom Storage provides self-storage and related storage services. For the purposes of data protection law, we act as the data controller for personal data we collect and use about our customers and other individuals, unless we specifically process data on behalf of another organisation under a separate arrangement.

2. Personal data we collect

We only collect personal data that is necessary for the operation of our services, the management of our business, and the fulfilment of our legal obligations. The categories of data we may collect include:

Identity data such as your name, date of birth, and identification details where required for security or verification.
Contact data such as address, email address, and phone number.
Account and contract data such as storage unit information, agreement details, payment status, and service preferences.
Payment data such as billing records, transaction references, and payment method details processed through secure payment providers.
Usage data such as access logs, unit entry records, and facility usage information.
Security data such as CCTV footage, incident reports, and access-control records where applicable.
Correspondence data such as communications with us by phone, email, or other channels.
Technical data where you use our online systems, including device information, IP address, and browser-related information.

We generally do not seek to collect special category data. If such information is provided to us accidentally, we will only process it where there is a lawful basis and where it is necessary to do so.

3. How we collect personal data

We may collect your data directly from you when you enquire about, register for, or use our services. We may also collect data from third parties where necessary and lawful, for example from payment service providers, identity verification services, insurers, or professional advisers. In some cases, data may be collected automatically through access systems or security systems used at our storage facilities.

4. How we use personal data

We use personal data only for specific, legitimate purposes. These may include:

providing storage services and administering customer accounts;
verifying identity and preventing fraud;
processing payments, refunds, and billing matters;
managing access to storage units and keeping our premises secure;
responding to enquiries, complaints, and requests;
maintaining business records and meeting accounting obligations;
complying with legal and regulatory requirements;
protecting our rights, property, staff, customers, and visitors;
improving our services, systems, and customer experience.

We will not use your personal data in a way that is incompatible with the purposes described in this Policy unless we have a lawful basis to do so.

5. Lawful basis for processing

Under data protection law, we must have a lawful basis to process personal data. Depending on the context, we rely on one or more of the following:

Contract

We process personal data where it is necessary to enter into or perform our contract with you, including setting up your account, providing storage services, taking payments, and managing your use of the facility.

Legal obligation

We process personal data where required to comply with legal obligations, such as tax, accounting, fraud prevention, health and safety, or other regulatory requirements.

Legitimate interests

We may process personal data where it is necessary for our legitimate business interests and those interests are not overridden by your rights and freedoms. This can include securing our sites, preventing misuse, managing risks, improving operations, and defending legal claims.

Consent

Where required, we may rely on your consent, for example for certain optional communications or specific types of processing. If we rely on consent, you may withdraw it at any time.

Vital interests

In rare cases, we may process personal data to protect someone’s vital interests, for example in an emergency.

6. Sharing and processors

We may share personal data with trusted third parties where necessary for the operation of our business or where required by law. Such parties act either as independent controllers or as processors processing data on our behalf. Where we use processors, we require them to protect personal data and to process it only in accordance with our instructions.

Examples of processors and service providers may include:

IT and software providers that host or support our systems;
payment processing providers;
security and access-control service providers;
accounting, audit, and administrative support services;
professional advisers such as lawyers, insurers, and consultants;
contractors who maintain facilities or equipment.

We may also disclose personal data to public authorities, regulators, courts, or law enforcement bodies where required or permitted by law. If we share data with any third party, we take steps to ensure that appropriate safeguards are in place.

7. International transfers

If any of our service providers store or process data outside the UK, we will ensure appropriate safeguards are used. These may include adequacy regulations, standard contractual clauses, or equivalent legal protections. We will only transfer personal data where the transfer is lawful and where adequate protection is maintained.

8. Data retention

We keep personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations. The retention period depends on the type of data and the reason we hold it.

Customer contract and account records are generally retained for the duration of the relationship and for a reasonable period afterward.
Financial and tax records are retained for the periods required by law and accounting practice.
Security records such as access logs or CCTV footage are retained only for as long as necessary for safety, security, or incident investigation purposes.
Correspondence and complaint records are retained for as long as needed to resolve matters and demonstrate compliance.

When personal data is no longer required, we will securely delete, anonymise, or otherwise dispose of it in accordance with our data retention procedures.

9. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. These measures may include access restrictions, secure systems, staff training, physical security controls, and contractual safeguards with processors. While no system is completely secure, we work to maintain an appropriate level of protection based on the nature of the data and the risks involved.

10. Your rights

Subject to certain legal conditions and exemptions, you have rights in relation to your personal data. These rights include:

Right of access - to request confirmation of whether we process your personal data and to receive a copy.
Right to rectification - to ask us to correct inaccurate or incomplete data.
Right to erasure - to request deletion of your data in certain circumstances.
Right to restriction - to ask us to limit how we use your data in certain situations.
Right to object - to object to processing based on legitimate interests or direct marketing.
Right to data portability - to request that certain data be provided to you or another controller in a structured format, where applicable.
Right to withdraw consent - where processing is based on consent, you may withdraw it at any time.

If you wish to exercise any of these rights, we will respond in line with applicable legal requirements and within the statutory time limits.

11. Automated decision-making

We do not normally use automated decision-making that produces legal or similarly significant effects. If this changes, we will provide information about the logic involved, the significance, and your available rights.

12. Children’s data

Our services are intended for adults. We do not knowingly collect personal data from children unless it is necessary in connection with a lawful service arrangement or emergency situation. If we become aware that we have collected a child’s data without appropriate basis, we will take steps to delete it where required.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, legal requirements, or data protection practices. Any updated version will apply from the date it is published or otherwise communicated. We encourage customers to review this Policy periodically to stay informed about how we protect personal data.

14. Complaints

If you have concerns about how we handle personal data, you may raise them with us so that we can address the issue. You also have the right to lodge a complaint with the relevant data protection supervisory authority if you believe your rights have been infringed.

Summary of our commitment: Locksbottom Storage processes personal data lawfully, keeps it secure, retains it only as long as needed, uses trusted processors under contract, and respects your data protection rights.