Privacy Policy

Privacy Policy last updated: 23 Sept 2026

C.P.J. Field & Co. Limited – PRIVACY NOTICE

C.P.J. Field & Co. Limited – Privacy Notice

Last updated: 23 September 2026

1. Introduction

C.P.J. Field & Co. Limited (“C.P.J. Field”, “we”, “us” or “our”) respects your privacy and is committed to protecting your personal information.

This privacy notice explains how we collect, use, disclose and protect personal information when you use our website, contact us, request information from us or use our funeral, planning-ahead and related services. It also explains your privacy rights and how to exercise them.

UK data protection law applies to information about living individuals. It does not apply to information solely about a deceased person. However, information concerning a deceased person may also contain or reveal personal information about living relatives, representatives or other individuals, and that information is protected by data protection law.

For the purposes of this notice:

“C.P.J. Field” means C.P.J. Field & Co. Limited, registered in England and Wales under company number 2998017, whose registered office is Rampion House, Marchants Way, Burgess Hill, West Sussex RH15 8QY, including the funeral homes through which it trades.

“Data Protection Legislation” means applicable UK data protection and privacy legislation, including the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), and those laws as amended, including by the Data (Use and Access) Act 2025.

“Special Category Data” means personal information receiving additional protection under data protection law, including information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification, health information and information concerning a person’s sex life or sexual orientation.

“Specific Notice” means an additional privacy or fair-processing notice we provide for a particular service or activity.

2. Important information and who we are

Purpose of this privacy notice

This notice explains how C.P.J. Field processes personal information through our website and in connection with the services and information we provide.

We may provide a more specific privacy notice when we collect information for a particular purpose. Any such notice should be read together with this privacy notice.

Our website is not designed primarily for children. We do not knowingly collect personal information about children through the website except where it is necessary and appropriate in connection with our services and we have an appropriate lawful basis for doing so.

Controller

C.P.J. Field & Co. Limited is the controller responsible for the personal information covered by this privacy notice.

Data Protection Officer

We have appointed a Data Protection Officer (“DPO”) to oversee data protection matters.

Our contact details are:

C.P.J. Field & Co. Limited
Rampion House
Marchants Way
Burgess Hill
West Sussex RH15 8QY

Data Protection Officer: Andy Smith
Email: [email protected]
Telephone: 01444 230430

Please contact our DPO if you have questions about this privacy notice, wish to exercise a data protection right or wish to make a data protection complaint.

Changes to your information and this notice

We keep this privacy notice under review and may update it from time to time. The date at the top of the notice shows when it was most recently updated.

Please tell us if information we hold about you changes so that we can keep our records accurate where appropriate.

Third-party websites

Our website may contain links to websites, plug-ins or services operated by other organisations. Those organisations may collect information about you independently of C.P.J. Field.

We are not responsible for their privacy practices and encourage you to read their privacy information when using their services.

3. Personal information we collect

Depending on your relationship with us, we may process the following categories of information:

Identity Data, such as your name, previous name, title, date of birth, gender and other identifiers.

Contact Data, such as your postal address, billing or delivery address, email address and telephone number.

Financial Data, such as bank account or payment information where necessary to make or receive payments.

Transaction Data, including details of payments and products or services requested or supplied.

Service and Arrangement Data, including information you provide when discussing or arranging a funeral, memorial, planning-ahead service or other service with us, and information necessary to administer those arrangements.

Profile Data, such as account details, preferences, interests, feedback, survey responses and information about products or services in which you have expressed an interest.

Technical Data, such as IP address, device information, browser type and version, operating system and other technical information associated with your use of our website and online services.

Usage Data, including information about how you interact with our website and online services.

Marketing and Communications Data, including your marketing preferences, communication preferences and records of relevant communications.

We may also create aggregated or anonymised information for statistical, research, management or reporting purposes. Where information has been genuinely anonymised so that no individual is identifiable, it is no longer personal information for the purposes of UK data protection law.

Special Category Data

Because of the nature of funeral and planning-ahead services, you may sometimes provide us with Special Category Data, for example information concerning religious or philosophical beliefs or, in some circumstances, health.

We will only process Special Category Data where we have both:

an appropriate lawful basis under UK GDPR; and
an appropriate condition permitting the processing of Special Category Data.

Where you ask us to retain your completed Funeral Wishes form, it may contain information revealing religious or philosophical beliefs or other Special Category Data. Where appropriate, we will rely on your explicit consent to process that Special Category Data.

You may withdraw that consent before the form is used, subject to any information we are required to retain for another lawful reason.

We do not process information about criminal convictions or offences unless there is a lawful and necessary reason for doing so.

If you do not provide information

Sometimes we need particular information to comply with law, respond to something you have asked us to do, or perform a contract with you.

If you do not provide information we reasonably require, we may be unable to provide the relevant service. We will explain this where it applies.

4. How we collect personal information

We collect information in several ways.

Information you give us

You may provide information when you:

enquire about or arrange our services;
create an online account;
telephone, email, write to or visit us;
request a guide or Funeral Wishes form;
ask us to retain a completed Funeral Wishes form;
ask a funeral home to contact you;
make a payment;
subscribe to communications;
provide feedback or complete a survey; or
otherwise correspond with us.

Information provided by other people or organisations

Because of the nature of our services, information about you may sometimes be provided by another person, such as a relative, representative, executor or another person involved in funeral arrangements.

Where relevant to the services we provide, we may also obtain information from professional advisers, service providers, public authorities or other organisations involved in arrangements or administration.

Where we obtain personal information from another source, we will provide the information required by data protection law unless an applicable exception applies.

Information collected through our website

When you use our website, we may collect Technical Data and Usage Data using cookies, pixels, tags, scripts, local storage and similar storage or access technologies.

How and when those technologies are used is explained in our Cookie Policy and through our cookie preference controls.

We may also receive technical, analytics or advertising information from providers such as Google and Meta, depending on the choices you make and the technologies in use.

5. How we use personal information and our lawful bases

We will only process personal information where we have a lawful basis for doing so.

The bases most relevant to our activities are:

Contract – where processing is necessary to enter into or perform a contract with you, including taking steps at your request before entering into a contract.

Legal obligation – where processing is necessary for us to comply with a legal requirement.

Legitimate interests – where processing is necessary for a legitimate business or third-party interest and that interest is not overridden by your interests, rights or freedoms.

Consent – where you have given us a valid choice and agreed to particular processing. You may withdraw consent at any time.

In limited circumstances, another lawful basis may apply where permitted by law.

The contract basis applies only where the relevant contract is with you, or where you have requested steps before entering into that contract.

If another person gives us your information in connection with a contract to which you are not a party, we will rely on another appropriate lawful basis for processing your information.

6. Purposes for which we use personal information

The table below sets out the main ways in which we use personal information, the categories of information involved and the lawful basis or bases on which we rely.

More than one lawful basis may apply to an activity depending on the circumstances. You can contact our DPO if you would like further information about the basis applicable to particular processing.

Purpose/Activity	Type of data	Lawful basis for processing including basis of Legitimate Interest
To register you as a new customer	(a) Identity Data (b) Contact Data	Contract – necessary to enter into or perform a contract with you, including taking steps at your request before entering into a contract.
To arrange and provide funeral, memorial, planning-ahead and related services	(a) Identity Data (b) Contact Data (c) Transaction Data (d) Service and Arrangement Data (e) Profile Data, where relevant	Contract – where necessary to enter into or perform a contract with you. Legitimate interests – where we need to process information about another living person who is not party to the contract in order to arrange or administer the requested service. Legal obligation – where processing is required by law.
To manage payments, fees and charges	(a) Identity Data (b) Contact Data (c) Financial Data (d) Transaction Data	Contract – where necessary to administer payments under a contract with you. Legal obligation – where necessary to satisfy accounting, tax or other statutory requirements.
To collect or recover money owed to us	(a) Identity Data (b) Contact Data (c) Financial Data (d) Transaction Data	Legitimate interests – recovering money properly due to us and managing our business finances.
To manage our relationship with you, including notifying you about changes to our terms, services or privacy information and managing your preferences	(a) Identity Data (b) Contact Data (c) Profile Data (d) Marketing and Communications Data	Contract – where the communication is necessary to administer our contract with you. Legal obligation – where we are required to provide information by law. Legitimate interests – keeping our records accurate and managing our customer relationships.
To ask you for feedback, invite you to take part in a survey or leave a review	(a) Identity Data (b) Contact Data (c) Profile Data (d) Marketing and Communications Data	Legitimate interests – understanding customers’ experiences, improving our services and maintaining appropriate standards.
To administer and protect our business and website, including troubleshooting, security, fraud prevention, testing, system maintenance and business continuity	(a) Identity Data (b) Contact Data (c) Technical Data (d) Usage Data, where relevant	Legitimate interests – operating our business, maintaining IT and information security, preventing fraud and supporting business continuity. Legal obligation – where particular security or record-keeping measures are required by law.
To send you information you have requested, such as a guide or Funeral Wishes form	(a) Identity Data (b) Contact Data	Legitimate interests – responding to your request for information. Contract / steps before entering into a contract – where your request is a step you have asked us to take before entering into a contract. Requesting information does not by itself constitute consent to marketing.
To hold a completed Funeral Wishes form on file at your request	(a) Identity Data (b) Contact Data (c) Service and Arrangement Data (d) information contained in the form, which may include Special Category Data	Consent – for holding the form at your request. Explicit consent – where required for Special Category Data, such as information revealing religious or philosophical beliefs.
To arrange for a funeral home to contact you at your request	(a) Identity Data (b) Contact Data (c) Profile Data (d) Service and Arrangement Data, where relevant	Contract / steps before entering into a contract – where necessary to take steps at your request before entering into a contract. Legitimate interests – responding appropriately to enquiries where the contractual basis does not apply.
To send you direct marketing that you have chosen to receive	(a) Identity Data (b) Contact Data (c) Marketing and Communications Data	Consent – where you have opted in to receive marketing.
To send marketing about our own similar products or services where the electronic-marketing rules permit this without separate consent	(a) Identity Data (b) Contact Data (c) Transaction Data (d) Marketing and Communications Data	Legitimate interests – promoting our own relevant products and services where the requirements of the PECR “soft opt-in” are satisfied. You can object or opt out at any time.
To understand which products, services or information may be relevant to you and make appropriate recommendations	(a) Identity Data (b) Contact Data (c) Transaction Data (d) Profile Data (e) Usage Data (f) Marketing and Communications Data	Legitimate interests – understanding customer needs and developing our services, where this can lawfully be done without consent and our interests are not overridden by your rights. Consent – where the activity involves marketing or tracking for which consent is legally required.
To deliver personalised online advertising and measure the effectiveness of advertising, including through providers such as Google or Meta	(a) Technical Data (b) Usage Data (c) Profile Data (d) Marketing and Communications Data (e) online identifiers and advertising information	Consent – where PECR requires consent to store information on, or access information from, your device. Where resulting information is personal data, consent will ordinarily also be the UK GDPR lawful basis for the associated processing.
To analyse how our website is used and improve our website, services and user experience	(a) Technical Data (b) Usage Data	Consent – where the relevant storage or access technology requires consent under PECR. Legitimate interests – where a statutory exception permits the technology to be used without consent and legitimate interests is appropriate, namely understanding and improving the performance of our website and services.
To maintain records and comply with legal, regulatory, accounting and tax requirements	(a) Identity Data (b) Contact Data (c) Financial Data (d) Transaction Data (e) Service and Arrangement Data	Legal obligation – complying with applicable legal and regulatory requirements. Legitimate interests – maintaining appropriate business and evidential records where this is not specifically required by law.
To establish, exercise or defend legal claims and deal with disputes or complaints	Any relevant categories of personal information	Legitimate interests – protecting our business and legal rights and resolving disputes. Legal obligation – where processing or disclosure is required by law.
To respond to data-protection rights requests and complaints	(a) Identity Data (b) Contact Data (c) information relevant to the request or complaint	Legal obligation – complying with our obligations under data protection law. Legitimate interests – appropriately documenting and administering requests and complaints where relevant.
To consider or carry out a sale, acquisition, restructuring or other corporate transaction affecting our business	Relevant categories of personal information where necessary	Legitimate interests – managing, developing and restructuring our business, subject to appropriate safeguards and confidentiality obligations. Legal obligation – where applicable.

Information about another person supplied in connection with a service

Where someone arranging a service gives us information about another living person, we do not rely on the arranger’s contract as the contractual lawful basis for processing the other person’s information.

Depending on the circumstances, we may process that information because it is necessary for our legitimate interests in providing and administering the requested service, because we have a legal obligation, or on another applicable lawful basis.

Funeral Wishes held on file

Where you specifically ask us to hold a completed Funeral Wishes form for future use, we will process the information for that purpose with your consent and, where required, your explicit consent for any Special Category Data.

You may withdraw your consent and ask us to update or remove the form at any time before it is used, subject to information we are legally entitled or required to retain.

Marketing

We may send direct marketing where:

you have consented to receive it; or
applicable law permits us to market our own similar products or services without separate consent and all requirements of that exception are satisfied.

Where we rely on the electronic-mail “soft opt-in”, our UK GDPR basis will generally be legitimate interests. We will assess whether our interests are outweighed by your rights and reasonable expectations.

Because people who use our services may be bereaved or otherwise in a vulnerable situation, we take particular care when deciding whether marketing is appropriate and proportionate.

You may object to direct marketing at any time.

Online advertising and measurement

We may use advertising and measurement technologies supplied by providers such as Google and Meta.

Where PECR requires your consent before information is stored on or accessed from your device, we will seek that consent.

Where the resulting information is personal information, consent will ordinarily also be our UK GDPR lawful basis for the associated processing.

We will not switch to legitimate interests merely because consent has not been obtained or has been withdrawn.

Website analytics

We use analytics to understand and improve the performance of our website and services.

Where the relevant storage or access technology requires consent under PECR, we will obtain consent before using it.

Where a statutory PECR exception applies to a particular analytics technology, we may use that technology without consent only where all the conditions of the exception are satisfied.

Where personal information is processed in those circumstances, we will identify an appropriate UK GDPR lawful basis, which may include legitimate interests.

Our Cookie Policy provides further information about the technologies we use and the controls available to you.

7. Change of purpose

We will normally use personal information only for the purpose for which it was collected.

If we need to use information for another purpose, we will consider whether that purpose is compatible with the original purpose and whether the processing remains fair and lawful.

Where required, we will provide additional privacy information before using personal information for a new purpose.

Nothing in this notice prevents us from processing information where the law requires or expressly permits us to do so.

8. Marketing preferences

You can ask us to stop using your information for direct marketing at any time, including by:

using the unsubscribe or opt-out mechanism in a marketing communication;
changing available marketing preferences in your account, where applicable; or
contacting us.

If you opt out, we may retain limited information on a suppression list so that we can respect your preference and avoid contacting you again for marketing.

An objection to marketing does not require us to delete information that we need to retain for a different lawful purpose, such as providing a service, maintaining financial records or dealing with legal claims.

Requesting information from us, including a guide or Funeral Wishes form, does not by itself mean that you have agreed to receive marketing.

Where we make a more limited promise when collecting your details — for example, that your email address will only be used to send you a requested guide — we will respect that promise unless you subsequently make another choice.

We will obtain appropriate consent before sharing your personal information with another organisation for that organisation’s own direct marketing where consent is required.

9. Cookies and similar technologies

Our website uses cookies and other storage and access technologies.

These technologies may include cookies, pixels, tags, scripts, local storage and similar technologies that store information on or access information from a device.

Some technologies are necessary for the website or a service you have requested to operate. Others may be used for analytics, functionality, personalisation, advertising or measurement.

Where consent is legally required, those technologies will not be used until you have made an appropriate choice.

Where we rely on a statutory exception to the consent requirement, we will comply with the conditions applicable to that exception, including providing appropriate information and a simple means of objecting where required.

You can manage applicable choices using our cookie controls.

Further details about the technologies in use, their purposes, providers and duration are available in our Cookie Policy.

10. Sharing personal information

We may disclose personal information where it is necessary and lawful to do so.

Recipients may include:

other teams and funeral homes within C.P.J. Field where necessary to provide or administer services;
funeral, cremation, burial, transport, catering, flower, memorial, obituary and other service providers involved in arrangements;
payment, banking and financial-service providers;
IT, hosting, software, communications and cybersecurity providers;
Microsoft in connection with services such as Microsoft 365 and Outlook;
Google in connection with analytics, advertising or other services where those services are in use;
Meta Platforms Ireland Limited in connection with Facebook and Instagram advertising, measurement and related services, including technologies such as Meta’s Conversions API where used;
marketing and professional advisers, including agencies engaged by us;
accountants, solicitors, insurers, auditors and other professional advisers;
HMRC, regulators, law-enforcement bodies, courts and other public authorities where disclosure is required or permitted by law; and
a prospective purchaser, seller, investor or other party involved in a corporate transaction affecting all or part of our business.

The legal role of a third party depends on the service and circumstances.

Some suppliers process personal information solely on our behalf as processors and are contractually required to follow our documented instructions.

Other organisations may act as separate controllers because they determine their own purposes and means of processing.

In some circumstances, we and another organisation may act as joint controllers.

We assess these roles and put appropriate contractual and transparency arrangements in place as required by data protection law.

We do not sell personal information to third parties.

11. International transfers

Some organisations that provide services to us, or members of their corporate groups, may process personal information outside the United Kingdom.

Where our disclosure constitutes a restricted transfer under UK data protection law, we will only make the transfer where a lawful transfer mechanism applies.

Depending on the circumstances, this may include:

UK adequacy regulations applying to the relevant country or recipient;
an appropriate safeguard such as the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or binding corporate rules, together with any required data protection test or transfer risk assessment; or
an applicable statutory exception where its requirements are satisfied.

You can contact our DPO for further information about safeguards relevant to transfers of your personal information.

12. Data security

We use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal information is restricted to employees, contractors and other recipients who need it for their duties or services and who are subject to appropriate confidentiality and security obligations.

We have procedures for identifying, assessing and responding to suspected personal-data breaches.

Where required by law, we will notify the Information Commissioner and affected individuals.

13. Data retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including satisfying legal, regulatory, accounting, reporting and claims-management requirements.

The appropriate period depends on factors including:

the nature, volume and sensitivity of the information;
why we need it;
whether the purpose can be achieved using less information or anonymised information;
legal and regulatory requirements;
applicable limitation periods; and
the risks associated with continued retention.

Our principal retention criteria include the following.

Funeral and customer records: retained for the period necessary to provide and administer the service and afterwards for the period reasonably required for legal, regulatory, accounting and record-keeping purposes.

Financial and transaction records: retained for the periods required by applicable accounting, tax and legal requirements.

Burial and long-term historical records: certain records connected with burials may be retained for up to 99 years where their long-term retention is justified by the need to provide burial or historical information to families in the future. We do not automatically apply this period to all personal information about living individuals connected with a burial.

Guides and information requests: where an email address or other information is collected only to provide material you requested, we retain it only for as long as necessary to fulfil that request and maintain any records reasonably required afterwards.

Funeral Wishes: where you ask us to hold a completed Funeral Wishes form, we retain it while your request remains in effect, until it is used, or until you ask us to remove it, subject to any overriding legal requirement.

Marketing records: marketing information is retained only while there is an appropriate basis for its use. Where you opt out, we may keep the minimum information necessary on a suppression list to ensure your preference continues to be respected.

Website and analytics information: retained according to the applicable technology, purpose and settings described in our Cookie Policy.

Where personal information is irreversibly anonymised, we may retain and use the resulting anonymous information without a specific retention period.

14. Your rights

Depending on the circumstances, you may have the right to:

Request access to personal information we hold about you and obtain information about how it is being used.

Request correction of information that is inaccurate or completion of information that is incomplete.

Request erasure of personal information in circumstances where the law gives you a right to have it deleted.

Object to processing based on legitimate interests in circumstances where your particular situation gives you a right to object.

You have an absolute right to object to the use of your personal information for direct marketing.

Request restriction of processing in circumstances provided for by law.

Request data portability for certain personal information that you provided to us where processing is automated and based on consent or contract.

Withdraw consent at any time where we rely on consent. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Exercising your rights

You can exercise your rights by contacting our DPO.

You will not normally have to pay a fee. We may charge a reasonable fee or, where permitted by law, refuse to act on a request that is manifestly unfounded or excessive.

We may ask for information reasonably necessary to confirm your identity or, where someone acts for you, their authority to do so. We will not request more identification information than is proportionate.

For subject access requests, we must make a reasonable and proportionate search for your personal information.

Where reasonably required to respond effectively to a subject access request, we may ask you to clarify the information you are seeking. Where the law permits, the response period may pause while we await that clarification.

We respond to rights requests without undue delay and normally within one month.

The law permits an extension in certain circumstances, for example where a request is complex or you have made a number of requests. If an extension applies, we will tell you within the initial response period.

15. Data protection complaints

If you believe that C.P.J. Field has not handled your personal information in accordance with data protection law, you have the right to make a data protection complaint directly to us.

You can make a complaint by contacting:

Data Protection Officer
C.P.J. Field & Co. Limited
Rampion House
Marchants Way
Burgess Hill
West Sussex RH15 8QY

Email: [email protected]
Telephone: 01444 230430

You may make a complaint by email, post or telephone.

Please describe what has happened, what aspect of our handling of your personal information concerns you and, where relevant, what you would like us to do. You may provide supporting information where you consider it useful.

If you are making a complaint on behalf of somebody else, we may ask you to provide evidence that you are authorised to act for them.

We will:

acknowledge a data protection complaint within 30 days of receiving it;
take appropriate steps to investigate it without undue delay;
keep you appropriately informed about the progress of our investigation; and
tell you the outcome of the complaint without undue delay when our investigation is complete.

We may need to request further information where it is reasonably required to investigate the complaint.

You also have the right to complain to the Information Commissioner’s Office (“ICO”), the UK regulator for data protection.

Information about making a complaint to the ICO is available at ico.org.uk.

You do not have to complain to us before contacting the ICO, although raising the matter with us first may allow us to resolve your concern directly.

16. Automated decision-making

We do not currently use personal information to make decisions about individuals based solely on automated processing where the decision produces legal or similarly significant effects.

If this changes, we will provide appropriate information about the processing and put in place any safeguards and rights required by data protection law.

17. Contact us

For questions about this privacy notice, the use of your personal information, your data protection rights or a data protection complaint, please contact: