Privacy policy

Data controller: Crest Self Storage Limited, Unit 10 Springkerse Trade Park, Craigleith Road, Stirling FK7 7GN
Company number: SC586795 (registered in Scotland)
ICO registration: ZA434176
Document reference: CSS-DP-PN-01 | Version 1.2
Effective date: 16 October 2026 | Next review annually
Contact: info@crestselfstorage.co.uk | 01786 234111

1. About this notice

This Privacy Notice explains how Crest Self Storage ("we", "us", "our") collects, uses, shares and protects personal data, and the rights you have in relation to your data. We are the data controller for the personal data described in this notice. We process personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

It applies to our storage customers and anyone who asks us for a quote, the alternate contact people our customers name on their storage agreement, visitors to our facility and to our websites (crestselfstorage.co.uk and our online quote and booking site at book.crestselfstorage.co.uk), suppliers and contractors, and job applicants and employees.

2. The personal data we collect

Depending on your relationship with us, we may collect and process the following.

  • Contact and identity details: Name, home or business address, email address, telephone number, and a copy of the photo ID we check when you sign your storage agreement.
  • Alternate contact person: The name and contact details of the person you name on your storage agreement, so that we can contact them about your account if we cannot reach you. They do not get access to your unit. Please let them know you have given us their details.
  • Storage agreement and account details: Your unit number, start and end dates, fees and payments, the replacement value you declare for your goods, your insurance choice, any vehicle details you give us, and our correspondence with you.
  • Payment information: The details needed to take payment, including bank details where you pay by Direct Debit or standing order. Card details are handled by our payment provider and are not stored by us.
  • Credit and reference checks: The results of the checks we carry out when you sign up, including whether you are listed on the Storer Check database.
  • Site access and security data: Your access code, records of when your code is used and your unit alarm is set or unset, and CCTV images of the facility.
  • Insurance claims: If you take StoreProtect cover and make a claim, details of the loss or damage and the evidence supporting the claim.
  • Website, chat and technical data: Information collected through our websites, crestselfstorage.co.uk and book.crestselfstorage.co.uk, including cookies, pages viewed, quote, booking and emergency contact form submissions, and the content of any chat you start with us.
  • Supplier and contractor details: Business contact details and the information needed to manage our relationship.
  • Recruitment and employment data: Where you apply to work with us or are employed by us.

3. How we collect your data

We collect personal data directly from you, for example when you ask for a quote or book through our websites, by phone, email or chat, when you visit us, sign your storage agreement, use the facility or contact us. We collect some data automatically, through our CCTV and access control systems at the facility and when you use our websites. We also receive data from third parties, such as the Storer Check database when we carry out checks, review platforms, and people you have authorised to deal with us on your behalf.

4. Why we use your data and our lawful basis

  • Giving quotes, setting up and managing your storage agreement, and giving you access to your unit: Contract
  • Checking your identity when you sign up, and the identity of anyone asking for access: Legitimate interests; Legal obligation
  • Credit and reference checks, including Storer Check: Legitimate interests
  • Keeping the facility, the units and stored goods secure, including CCTV, access records and unit alarms: Legitimate interests
  • Taking payment and keeping financial and tax records: Contract; Legal obligation
  • Recovering unpaid fees and, where your agreement allows, selling or disposing of goods and recording unpaid debts on Storer Check: Contract; Legitimate interests
  • Contacting your alternate contact person if we cannot reach you: Legitimate interests
  • Arranging StoreProtect cover and handling insurance claims: Contract; Legitimate interests
  • Customer service, emergencies, and handling enquiries or complaints, including by chat: Contract; Legitimate interests
  • Selling packing materials and padlocks from our Box Shop: Contract
  • Understanding how our websites are used, so that we can improve it: Consent (cookies); Legitimate interests
  • Advertising our services online, including to people who have visited our websites: Consent
  • Sending marketing about our services and offers: Consent; Legitimate interests (existing customers)
  • Managing supplier and contractor relationships: Contract; Legitimate interests
  • Recruitment and employment administration: Contract; Legal obligation; Legitimate interests
  • Meeting legal, regulatory and health and safety obligations, and responding to the police, fire service, Trading Standards, HM Revenue and Customs or other authorities: Legal obligation; Legitimate interests

Where we rely on legitimate interests, we have weighed our interests against your rights. You can ask us for details of that assessment. If you do not give us the information we need to check your identity and carry out credit and reference checks, we will not be able to offer you a storage agreement. We do not make decisions about you based solely on automated processing.

5. Chat on our website, including automated replies

Our website offers a chat window, provided by Shopify. Messages sent through it may be answered by an automated assistant (an AI agent) rather than a member of our team, and the assistant may pass the conversation to a person. Please do not send sensitive personal information through chat.

When you use chat we collect the messages you send, any name and email address you give us so that we can reply, and basic technical information about your visit. Shopify processes this information on our behalf, and the assistant uses the content of your messages and information about our services to produce its replies. Automated replies are not always accurate, and anything important will be confirmed by a member of our team.

Chat conversations are held by Shopify as part of the chat service and are not deleted automatically. We keep them for as long as we use that service, and we will erase personal details from them on request where the platform allows. We do not use chat content to make any decision about you that has a legal or similarly significant effect.

6. CCTV and access records

Our facility is covered by CCTV, inside and out, and every unit is individually alarmed. Our access control system records when each access code is used. We use these to protect people, property and stored goods, to prevent and investigate crime, and to deal with incidents and disputes. CCTV footage and access records are viewed only by authorised staff, and we share them only with the police, insurers or others where that is needed to deal with an incident or required by law. Signs at the facility tell you that CCTV is in use.

7. Who we share your data with

We do not sell your personal data. We share it only where necessary, with the following.

  • Shopify: Runs our website and Box Shop checkout, and provides the chat service described in section 5.
  • Vercel: Hosts our online quote and booking site at book.crestselfstorage.co.uk, which we built and run ourselves.
  • Space Manager, provided by RADical Systems (UK) Ltd: Our storage management system, which holds your storage agreement, account, payment and access records.
  • Stripe: Processes card payments made to us. We do not store your card details.
  • Storer Check: A credit and reference database used by self storage operators. We check it when you sign up and may record unpaid debts on it. Details are at storercheck.uk.
  • Pound Gates & Company Ltd (our insurance broker), Glemham Underwriting Limited and Aviva Insurance Limited (our insurers): Where you take StoreProtect cover, to include your goods under our policy and to handle any claim.
  • Mailchimp: Sends our marketing emails, where you have asked to receive them.
  • Google: Google Workspace, where the quote and booking requests you make through book.crestselfstorage.co.uk are stored. Also website analytics and online advertising.
  • Microsoft: Microsoft Clarity, which records how visitors move around our website.
  • Meta (Facebook and Instagram): Online advertising.
  • Spotify: Online advertising, including measuring responses to our adverts.
  • Our marketing agencies: Access to our quote and booking records, to check that our website tracking and advertising measurement are working.
  • Debt recovery agents, solicitors, sheriff officers and auctioneers: Where needed to recover unpaid fees or to sell goods under your storage agreement.

We also share data with professional advisers such as accountants and legal advisers, and with regulators, government bodies or law enforcement where we are legally required to do so.

8. Cookies and website tracking

This section covers both of our websites: crestselfstorage.co.uk and our online quote and booking site at book.crestselfstorage.co.uk. Our websites use cookies and similar technologies. Some are needed to make the site work, for example to keep items in your Box Shop basket. Others, which we use only with your consent, help us understand how the site is used and let us advertise to you elsewhere. These include:

  • Google Analytics and Google Ads
  • Microsoft Clarity, which records how visitors move around the site, including clicks, scrolling and mouse movement
  • Meta advertising tools for Facebook and Instagram
  • The Spotify advertising pixel
  • Mailchimp, which may show a sign-up form and recognise subscribers who visit the site

You can change your choices at any time through the cookie settings on our websites or through your browser.

9. Sending data outside the UK

Some of the providers listed in section 7, including Shopify, Vercel, Stripe, Mailchimp, Google, Microsoft, Meta and Spotify, are based outside the UK or store data outside it. Where personal data is transferred outside the UK we rely on UK adequacy regulations or on the International Data Transfer Agreement or Addendum, so that your data keeps an equivalent level of protection.

10. How long we keep your data

We keep personal data only for as long as we need it.

  • Storage agreement and account records, including ID copies, payment records and access records linked to your account, are kept for six years after your agreement ends plus the current financial year, to meet accounting and tax requirements and to deal with any claims.
  • Quote and booking records, including requests made through book.crestselfstorage.co.uk, are kept for two years and then deleted. If you go on to sign a storage agreement, your details are also held as storage agreement records, as above.
  • CCTV footage is overwritten automatically after 30 days, unless we need to keep a recording to deal with an incident, a claim or a request from the police.
  • Insurance claim records are kept for six years after the claim is closed.
  • Chat conversations are held by Shopify and are kept for as long as we use the chat service.
  • Marketing contact details are kept until you ask us to stop.

If goods left in a unit contain personal data, for example paperwork, and we have to dispose of them under a storage agreement, we destroy that material securely. When data is no longer needed it is securely deleted or destroyed.

11. How we protect your data

We use appropriate technical and organisational measures to keep personal data secure, including access controls, up-to-date software, secure storage, and back-up arrangements. Access is limited to those who need it. If a personal data breach occurs we follow our breach procedure, including notifying the Information Commissioner's Office and affected individuals where required.

12. Your rights

Under UK data protection law you have the right to be informed about how your data is used, to access your data, to have inaccurate data corrected, to have your data erased in certain circumstances, to restrict or object to processing, to data portability, and rights relating to automated decision-making. You can object at any time to processing based on our legitimate interests, including the checks described in section 4. Where we rely on your consent, you can withdraw it at any time. To exercise any of these rights, contact us using the details in section 13. We will respond within one month.

13. How to contact us and how to complain

We are not required to appoint a Data Protection Officer. Questions about this notice, and requests to exercise your rights, should go to our data protection contact:

Crest Self Storage Limited

Address: Unit 10 Springkerse Trade Park, Craigleith Road, Stirling FK7 7GN

Phone: 01786 234111

Email: info@crestselfstorage.co.uk

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, ico.org.uk, helpline 0303 123 1113. We would appreciate the chance to put things right first.

14. Changes to this notice

We review this notice at least once a year. This version is dated 16 October 2026.