Privacy policy

Introduction

Ecclesiastical Planning Services Limited (‘EPSL, ‘we’, ‘us’ or ‘our’) is committed to the privacy and confidentiality of information that you provide to us. This privacy notice describes our current policies and practices with regard to personal information collected and used by us.

Please take your time to read this notice carefully. When using our websites namely www.funeralplans.co.uk, the Funeral Director Portal and Buy Online, this notice should be read alongside the website terms and conditions for Funeral Plans.

Your privacy is important to us. EPSL (as the data controller) will always act responsibly with your data. We are committed to the privacy and confidentiality of information provided by you to us. This Privacy Policy describes our current policies and practices with regard to personal data collected by us from you directly and/or through our websites, and/or from a third party.

Our processing of your personal information

Depending on our relationship with you (for example if you are a planholder, individual named on a plan, nominated representative, attorney, funeral director, or third party) we will collect different types of personal information about you and use it for different purposes.

From time to time, we may ask you to provide, or we may receive, your sensitive personal information otherwise known in data protection laws as special categories of personal information’. We may collect special category personal information depending on the circumstances of your interaction with us.

Where you provide personal information to us about other individuals (for example a covered individual or a nominated representative), we will also be data controller of and responsible for their personal information and it is important that you refer them to this notice so they understand how EPSL will process their data.

Where personal data is disclosed to us by third parties, it is the obligation of the disclosing party to ensure such personal data is disclosed with requisite authority and permissions, and we will process such personal data in accordance with this Privacy Policy.

We have structured this notice so that you only have to visit the section below that is relevant to you and that reflects your relationship with us.

If you apply for a pre-paid funeral plan with us, or someone applies for a plan which covers you or lists you as a nominated representative on the plan, this section will be applicable to you and will provide key information about how we use your personal information.

What personal information will we collect?

Title, full name, address, email address, telephone numbers, date of birth.
Gender (covered individuals only).
Financial information such as your bank details, and where you are the planholder, information obtained from checking sanctions lists.

What sensitive personal information will we collect?

Health information may be disclosed to us throughout the lifetime of the plan as it relates to the ongoing service provided by EPSL.
We may also collect information as part of the application process, or throughout the lifetime of your plan which reveals your race or ethnicity, religious or philosophical beliefs, political opinions, trade union membership or data concerning your sexual orientation. For example, where you disclose that you would like your funeral service to be held in a specific religious venue, this may disclose your religious beliefs.

How will we collect your personal information?

Directly from you or via our funeral director partners – when you apply for the plan, or when you contact us during the lifetime of the plan.
Where you are the covered individual, from the planholder or via our funeral director partners at the application stage or during the lifetime of the plan.
Third parties who provide sanctions check services.
Third parties who provide existence and mortality screening, and tracing services.
From information you have submitted, or has been submitted on your behalf, through our websites.
From you directly on our recorded phonelines.

What will we use your personal information for?

We use your information in a number of different ways, depending on your particular circumstances. For every use, we must be able to demonstrate that there is a legal basis to do so. When using your personal information, we will rely on the legal bases set out below.

Contractual necessity – in order to perform our contractual obligations, EPSL must gather the information required to assess the application, set up and administer the plan.
Legitimate business interests – to run an efficient business, to improve the business
Legal obligation – to ensure our legal and regulatory obligations are met.

When we use your sensitive personal information (such as information about your health or religion), we need to have an additional legal basis. When using your sensitive personal information, we will rely on the legal bases set out below.

There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals.

The table below sets out the legal grounds on which we will use your personal information:

What is the purpose for using your personal information?	Legal grounds for using your personal information	Legal grounds for using your sensitive personal information
To administer the plan	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To communicate with you generally and handle any queries about the pre-paid funeral plan	It is necessary for administering the pre-paid funeral plan contract We have a business need to communicate with our customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes, such as systems development, migration of systems and live testing, diagnosing any problems with our servers and website	We have a business need to run an efficient business	N/A
To use customer testimonials in marketing our services	We have a legitimate business interest to market our services We have a legal obligation to store the data to meet FCA Financial Promotion requirements	N/A
To handle claims	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To comply with our legal and regulatory obligations	We have a business need to prevent financial crime We have a legal obligation to prevent financial crime We have a regulatory requirement to consider and, where applicable, accommodate the needs of vulnerable customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To handle complaints	It is necessary for administering the pre-paid funeral plan contract We have a business need to communicate with our customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes such as maintaining management and financial information, internal audits, and carrying out statistical and strategic analysis, and customer surveys	We have a business need to run an efficient business, maintain appropriate financial records and improve our business and the services we offer	N/A
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers)	We have a business need to develop and improve the services we offer	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals

Who will we share your information with?

Insurers providing the whole of life insurance policy and, if applicable, the premium protection insurance in the plan.
Third parties who provide sanctions check services.
Third parties who provide existence and mortality screening, and tracing services.
Other companies in the Benefact Group.
The Financial Conduct Authority.
Service providers we have contracted with including our subcontractors and agents, auditors, our solicitors, actuaries, IT providers and database providers, business suppliers.
Customer research agencies and customer segmentation companies.
Any third parties in the event of a sale, merger, reorganisation, transfer or dissolution of our business.

What personal information will we collect?

Title, full name, address, email address, telephone numbers.
Relationship to the planholder.

What sensitive personal information will we collect?

Health information may be disclosed to us throughout the lifetime of the plan as it relates to the ongoing service provided by EPSL to you in your capacity as the nominated representative.

How will we collect your personal information?

From the planholder or via our funeral director partners at the application stage or during the lifetime of the plan.
From you directly.
From third parties who provide existence and mortality screening, and tracing services.

What will we use your personal information for?

Contractual necessity – in order to perform our contractual obligations, EPSL must gather the information required to assess the application, set up and administer the plan.
Legitimate business interests – to run an efficient business, improve the business.
Legal obligation – to ensure our legal and regulatory obligations are met.

There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals.

The table below sets out the legal grounds on which we will use your personal information:

What is the purpose for using your personal information?	Legal grounds for using your personal information	Legal grounds for using your sensitive personal information
To administer the plan	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To communicate with you generally and handle any queries about the pre-paid funeral plan	It is necessary for administering the pre-paid funeral plan contract We have a business need to communicate with our customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes, such as systems development, migration of systems and live testing, diagnosing any problems with our servers and website	We have a business need to run an efficient business	N/A
To handle claims (where you are not the covered individual or planholder)	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To comply with our legal and regulatory obligations	We have a regulatory obligation to communicate with you in certain circumstances We have a regulatory requirement to consider and, where applicable, accommodate the needs of vulnerable customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To handle complaints	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
We have a business need to communicate with you	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes such as maintaining management information, internal audits, and carrying out statistical and strategic analysis	We have a business need to run an efficient business, and improve our business and the services we offer	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers)	It is necessary for administering the pre-paid funeral plan contract We have a business need to develop and improve the services we offer	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals

Who will we share your information with?

Third parties who provide existence and mortality screening, and tracing services.
Other companies in the Benefact Group.
The Financial Conduct Authority.
Service providers we have contracted with including our subcontractors and agents, auditors, our solicitors, actuaries, IT providers and database providers, business suppliers.
Any third parties in the event of a sale, merger, reorganisation, transfer or dissolution of our business.

What personal information will we collect?

Title, full name, address, email address, telephone numbers.
Relationship to the planholder.

What sensitive personal information will we collect?

Health information may be disclosed to us throughout the lifetime of the plan as it relates to the ongoing service provided by EPSL to you in your capacity as attorney or other third party on the plan.

How will we collect your personal information?

From the planholder or via our funeral director partners at the application stage or during the lifetime of the plan.
From you directly.
From third parties who provide existence and mortality screening, and tracing services.

What will we use your personal information for?

Contractual necessity – in order to perform our contractual obligations, EPSL must gather the information required to assess the application, set up and administer the plan.
Legitimate business interests – to run an efficient business, improve the business.
Legal obligation – to ensure our legal and regulatory obligations are met.

There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals.

The table below sets out the legal grounds on which we will use your personal information:

What is the purpose for using your personal information?	Legal grounds for using your personal information	Legal grounds for using your sensitive personal information
To administer the plan	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To communicate with you generally and handle any queries about the pre-paid funeral plan	It is necessary for administering the pre-paid funeral plan contract We have a business need to communicate with our customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes, such as systems development, migration of systems and live testing, diagnosing any problems with our servers and website	We have a business need to run an efficient business	N/A
To handle claims (where you are not the covered individual or planholder)	It is necessary for administering the pre-paid funeral plan contract	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To comply with our legal and regulatory obligations	We have a business need to communicate with you We have a regulatory requirement to consider and, where applicable, accommodate the needs of vulnerable customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
To handle complaints	It is necessary for administering the pre-paid funeral plan contract We have a business need to communicate with you	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes such as maintaining management information, internal audits, and carrying out statistical and strategic analysis	We have a business need to run an efficient business, and improve our business and the services we offer	N/A
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers)	We have a business need to develop and improve the services we offer	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals

Who will we share your information with?

Third parties who provide existence and mortality screening, and tracing services.
Other companies in the Benefact Group.
The Financial Conduct Authority.
Service providers we have contracted with including our subcontractors and agents, auditors, our solicitors, actuaries, IT providers and database providers, business suppliers.
Any third parties in the event of a sale, merger, reorganisation, transfer or dissolution of our business.

What personal information will we collect?

Title, full name, address, email address, telephone numbers.
Relationship to the planholder.

What sensitive personal information will we collect?

Health information may be disclosed to us by you directly as part of the complaints handling process

How will we collect your personal information?

From you directly.

What will we use your personal information for?

Contractual necessity – in order to perform our contractual obligations, EPSL must gather the information required to assess the application, set up and administer the plan.
Legitimate business interests – to run an efficient business, improve the business.
Legal obligation – to ensure our legal and regulatory obligations are met.

There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals.

The table below sets out the legal grounds on which we will use your personal information:

What is the purpose for using your personal information?	Legal grounds for using your personal information	Legal grounds for using your sensitive personal information
To communicate with you in your capacity as complainant	There is a business need to communicate with you in order to investigate and resolve your complaint	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes, such as systems development, migration of systems and live testing, diagnosing any problems with our servers and website	We have a business need to run an efficient business	N/A
To comply with our legal and regulatory obligations	We have a regulatory need to communicate with you within a prescribed timeframe We have a regulatory requirement to consider and, where applicable, accommodate the needs of vulnerable customers	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals
For business purposes such as maintaining management information, internal audits, and carrying out statistical and strategic analysis	We have a business need to run an efficient business, and improve our business and the services we offer	N/A
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers)	We have a business need to develop and improve the services we offer	There is a substantial public interest such as the safeguarding of the economic wellbeing of certain individuals

Who will we share your information with?

Other companies in the Benefact Group.
The Financial Conduct Authority.
Service providers we have contracted with including our subcontractors and agents, auditors, our solicitors, actuaries, IT providers and database providers, business suppliers.
Any third parties in the event of a sale, merger, reorganisation, transfer or dissolution of our business.

What personal information will we collect?

Title, full name, address, email address, residential address, IP address (web users).
Information obtained through our use of cookies (find out more about this in our Cookie policy Ecclesiastical Planning Services cookie policy.

Section 9 below will apply

Section 1 will apply

If you are an Approved Person or Authorised Seller of a funeral director firm, Section 9 below will apply.

What personal information will we collect?

Employment status and related information such as job title and email address.

What sensitive personal information will we collect?

We will not collect any sensitive personal information about you.

How will we collect your personal information?

Directly from you and your employer.
From other companies in the Benefact Group.

What will we use your personal information for?

Legitimate business interests – to run an efficient business, improve the business.
Legal obligation - to ensure our legal and regulatory obligations are met.

What is the purpose for using your personal information?	Legal grounds for using your personal information	Legal grounds for using your sensitive personal information
To communicate with you generally and, where we are dealing with you in relation to a funeral plan contract, to receive instructions from you in relation to that plan	We have a business need to communicate with our customers, prospective customers, suppliers and partners It is necessary to enter into or perform your services contract It is necessary for the performance of our contract with the planholder	N/A
For business purposes such as systems development, migration of systems and live testing, and diagnosing any problems with our servers and website	We have a business need to run an efficient business	N/A
For business purposes such as maintaining management information, maintaining financial records, internal audits, and carrying out statistical and strategic analysis	We have a business need to run an efficient business, maintain financial records and improve our business and the services we offer	N/A
For business purposes such as maintaining management information, internal audits, and carrying out statistical and strategic analysis	We have a business need to run an efficient business, and improve our business and the services we offer	N/A
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers)	We have a business need to develop and improve the services we offer	N/A

Who will we share your information with?

Other companies in the Benefact Group
Service providers we have contracted with including our subcontractors and agents, auditors, our solicitors, actuaries, IT providers and database providers, business suppliers.
Any third parties in the event of a sale, merger, reorganisation, transfer or dissolution of our business.

What personal information will we collect?

Title, full name, address, email address, telephone numbers date of birth, nationality, national insurance number.
Previous names and addresses.
Financial information such as your credit history.
Business and employment details and history.

What sensitive personal information will we collect?

We may collect information as part of the application process, o throughout the lifetime of your relationship with us which reveals your criminal offence history and civil proceedings history.

How will we collect your personal information?

Directly from you.
From third parties such as credit reference agencies and the Disclosure and Barring service.

What will we use your personal information for?

Contractual necessity – in order to perform our contractual obligations, EPSL must gather the information required to assess your application and apply to the FCA.
Legitimate business interests – to run an efficient business, improve the business.

Legal obligation – to ensure our legal and regulatory obligations are met when we use your sensitive personal information (such as information about your health, religion or criminal offences), we need to have an additional legal basis. When using your sensitive personal information, we will rely on the legal basis set out below.

UK Data Protection Act Schedule 1, Part 1 Paragraph 1 – processing criminal offence data for employment, social security, and social protection purpose.

What is the purpose for using your personal information?	Legal grounds for using your personal information	Legal grounds for using your sensitive personal information
To review your application to become an Approved Person or Authorised Seller, and to communicate with you during this process	It is necessary for entering into our contract with you	We have a regulatory obligation to conduct due diligence on the vendors and partners that we do business with
To communicate with you generally in your capacity as an Approved Person or Authorised Seller	It is necessary for the performance of the contract We have a business need to communicate with our business partners
For business purposes such as systems development, migration of systems and live testing, and diagnosing any problems with our servers and website	We have a business need to run an efficient business	N/A
To handle claims (where you are not the covered individual)	It is necessary for administering the pre-paid funeral plan contract	N/A
To comply with our legal and regulatory obligations	We have a legal obligation to prevent financial crime and fraud We have a regulatory requirement to consider and, where applicable, accommodate the needs of vulnerable customers	We have a regulatory obligation to conduct due diligence on the vendors and partners that we do business with
To handle complaints	It is necessary for administering the pre-paid funeral plan contract	N/A
For business purposes such as maintaining management and financial information, internal audits, carrying out statistical and strategic analysis, and mystery shopping	We have a business need to run an efficient business, maintain appropriate records and improve our business and the services we offer	N/A
To provide improved quality, training and security (for example, through recorded or monitored phone calls to our contact numbers)	We have a business need to develop and improve the services we offer	We have a regulatory obligation to conduct due diligence on the vendors and partners that we do business with

Who will we share your information with?

Other companies in Benefact Group
The Financial Conduct Authority
Service providers we have contracted with including our subcontractors and agents, auditors, our solicitors, actuaries, IT providers and database providers, business suppliers.
Any third parties in the event of a sale, merger, reorganisation, transfer or dissolution of our business.

10. Automated decision making, profiling and Artificial Intelligence

We do not make automated decisions on, or use profiling tools to analyse, your personal information. Therefore, your right to object to automated decision making does not apply.

11. How long do we keep your information for?

We will only keep your personal information for as long as reasonably necessary to fulfil the purposes set out in Sections 1 to 7 above and to comply with our legal and regulatory obligations.

If you would like further information on how long we keep your personal information for, please contact us using the details set out in Section 15.

12. What is our approach to sending personal information overseas?

We may transfer your personal data to countries outside the United Kingdom in order to provide our services. The laws in these countries may not offer the same level of protection for personal data as in the United Kingdom.

If we transfer personal data to countries outside of the United Kingdom, we will do so in a lawful way and may rely on:

An adequacy decision from the Secretary of State, which says that the recipient country provides an adequate level of protection of personal data;
Appropriate safeguards to protect the personal data (for example, the approved standard contractual clauses or international data transfer agreement);
A lawful exception to the rules relating to overseas data transfers (for example, the transfer is necessary to perform a contract with you, which is in your interests).

To obtain a copy of these safeguards or if you have any questions about how your personal data is used, please contact us here.

13. How do we protect your information?

We implement and maintain appropriate technical and organisational measures to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. These include but are not limited to the following key activities:

We adopt a framework of information security controls operating at different levels within the company to restrict access and safeguard systems, in accordance with a ‘defence in depth’ methodology (which is the coordinated use of multiple security controls to protect the integrity of the information and assets in the company’s IT network);
We have an established, documented information security and data protection policy framework which is regularly reviewed to consider changes in technology, regulations and threats;
Where applicable, we maintain encryption technologies to encrypt data stored on portable computers and portable media, and ensure security when data is transferred;
We maintain awareness and education on information security and data protection in all areas of our business;
We conduct risk based due diligence on our suppliers; and
We operate a programme of testing the effectiveness of our information security measures.

14. Your rights

You have several data protection rights which entitle you to request information about your personal information, to dictate what we do with it or to stop us using it in certain ways.

If you wish to exercise the rights set out below, please contact us at any time using the details set out below. There will not normally be a charge for this.

We respect your rights in relation to personal information we hold about you, but not all data subject rights are an automatic right and can be subject to exceptions. We will always inform you why we cannot comply with your request.

In some circumstances, complying with your request may result in your plan being cancelled.

The right to access your personal information

You can request a copy of the personal information we hold about you and certain details of how we use it.

Your personal information will normally be provided to you in writing unless you request otherwise or where you have made a request by electronic means such as email, we will provide such information in electronic form where possible.

The right to withdraw your consent

Where we rely on consent as the legal ground to use your personal information or sensitive personal information, you are entitled to withdraw that original consent.

The right to rectification

Where necessary, we make reasonable efforts to keep your personal information up to date, complete and accurate. We encourage you to ensure that your personal information is accurate so please let us know regularly if you believe that the information we hold about you may be inaccurate or not complete. We will correct and amend any such personal information and notify any third party recipients of necessary changes.

The right to restriction of processing

Subject to the circumstances in which you exercise this right, you can request that we stop using your personal information, such as where you believe that we no longer need to use your personal information.

The right to data portability

Subject to the circumstances in which you exercise this right, you can request that we port across personal information you have provided to us to a third party in a commonly used and machine-readable format.

The right to erasure

You can request that we delete your personal information. For example, where we no longer need your personal information for the original purpose we collected it for or where you have exercised your right to withdraw consent.

Whilst we will assess every request, this request is subject to legal and regulatory requirements that we are required to comply with.

The right to object to direct marketing

You can request that we stop sending you marketing messages at any time by clicking on the "unsubscribe" button in any such emails that we send to you, or by contacting us using the details set out in section 10.

Please note that even if you exercise this right because you do not want to receive marketing messages, we may still send you service-related communications where necessary.

The right to object to processing

Where our processing is based on the legal ground of us having a legitimate business need to process your personal information, you can object to such processing. If you raise an objection, we will consider your request and balance this against any other compelling legitimate grounds in favour of the processing, and inform you of our decision.

Rights relating to automated decision-making

We do not make automated decisions therefore this right does not apply.

Right to make a complaint about your processing

Where you believe that we have breached data protection laws when using your personal information, you have a right to complain. We will address your complaint in accordance with the Data Protection Act and the Digital Use & Access Act.

If we are not able to resolve your complaint, you have the right to then escalate this to the Information Commissioner's Office (ICO) via their resource page here.

15. Contact us

If you would like further information about the ways we use your personal information, further clarity on how we use your personal information or anything referred to in this notice, please contact our Data Protection Officer via this email link or by writing to the Data Protection Officer, Ecclesiastical Planning Services Limited, Benefact House, 2000 Pioneer Avenue, Gloucester Business Park, Brockworth, Gloucester, GL3 4AW, United Kingdom.

16. Updates to this notice

We are continually improving our methods of communication and alongside with changes in the law and the changing nature of technology, our data practices and how we use your data will change from time to time. If and when our data practices change significantly and you are a customer of EPSL, we will notify you and signpost you to the most up-to-date notice.

This notice was last updated on 25th June 2026.