Privacy

Privacy notice

Last updated 9 November 2026

Funeral Cost Index is operated by Indexeli Intelligence Limited, the data controller for the personal data described below. This notice explains what we collect, why, how long we keep it, who we share it with, and your rights under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018.

Who we are

Indexeli Intelligence Limited (“we”, “us”) operates Funeral Cost Index. We are registered in the United Kingdom. For any privacy question, contact markets@indexeli.com.

What personal data we collect

We collect the minimum we need to run the service. Specifically:

Enquiry submissions. If you use the funeral-director enquiry shortlist, we collect your name, email address, an optional phone number, the postcode you searched, the funeral directors you selected, and any optional message you write. We deliberately do not ask for the name of the person who died, where they died, the relationship, the planned service type, or the timing.
Waitlist sign-ups. If you join the monthly price report, we collect your name and email address.
Corrections / contact emails. If you email us a correction, complaint, or other request, we keep that email and our response.
Intelligence access requests. If you ask for access to the intelligence portal, we collect your name, work email address, company, and any role and notes you add.
Intelligence subscriber accounts. For subscribers we hold your email address, name, company and role, your plan and when access ends, and when you last signed in. You sign in with an emailed link rather than a password. We keep a record of each link (with the IP address that asked for it) and each signed-in session, storing only a hash of the link and session codes, and a log of the reports you export.
Technical data. Our host, Vercel, receives the standard data sent with every web request: IP address, browser user-agent, referrer, the page requested and the time. We use it for security and abuse prevention. Enquiry submissions store the browser user-agent and referrer with the record.
Visit and click logs, analytics. See analytics and logs below and the cookie notice.

Analytics and logs

Request log. We keep our own copy of the host’s request log in our database to count visits and see which pages are used. For each request it records the time, the page address (including any search terms in it), the response code, whether the request looks like a browser or a known bot, the referring website’s domain (not the full address), the country worked out from the IP address, and a session code. The session code is a keyed hash of the IP address and browser user-agent under a key that changes every day, so requests can be grouped within a day but not linked across days. The IP address is not stored, and the user-agent is stored only for bots and other automated traffic.

Reading-time signal. While a page is open in a visible tab, it sends a small signal to our own server when it loads, after 5 and 10 seconds, then every 30 seconds, and once when you leave. This tells us how long pages are read. Each signal records only the time, the page address and the same daily session code. It sets no cookie and stores nothing on your device, and it runs whatever you choose in the cookie banner.

Outbound click log. Links to a funeral director’s website, price list or contact details pass through our server so we can count them. For each click we record the funeral director, the link type and destination, the page you clicked from, the referrer, your browser user-agent, the time, and a shortened hash of your IP address and user-agent used to spot repeat clicks. Your IP address is not stored.

Cloudflare Web Analytics. Pages load a script from Cloudflare that reports page views and page-load speed: the page address, referrer, browser and device type, and the country, which Cloudflare works out from your IP address. Cloudflare states that it sets no cookies and uses no other browser storage for this, and does not use it to follow you across sites. Because it stores nothing on your device it loads for every visitor, not only those who accept analytics. We see aggregate figures only.

Clicky. Loads only if you accept analytics in the cookie banner. The cookie notice says what it collects.

We rely on legitimate interests for these: knowing which pages and data are used, spotting broken pages, and keeping the service secure. We do not use them for advertising or to build profiles, and we delete our logs after 90 days.

Why we collect it (lawful basis)

Performance of a service you asked for (UK GDPR Article 6(1)(b)). When you submit an enquiry shortlist, we forward your details to the funeral directors you selected because that is the service you asked us to perform.
Consent (Article 6(1)(a)). The enquiry form requires you to actively tick a consent box before we forward your details. You may withdraw consent at any time by emailing markets@indexeli.com. Withdrawal does not unsend an enquiry that has already been delivered, but we will stop holding your record on request.
Steps towards a contract, and the contract itself (Article 6(1)(b)). For intelligence access requests and subscriber accounts: we use your details to reply to your request, set up and run your access, and send you sign-in links.
Legitimate interests (Article 6(1)(f)). For keeping a delivery audit log, preventing abuse and fraud, securing the service, improving coverage, and measuring how the site is used through the analytics and logs described above. We have balanced these interests against your privacy and consider the impact low: we do not profile, do not sell data, and do not use enquiry data for marketing.

How enquiry data is shared

When you submit the shortlist, we send your name, email, optional phone, optional message, and the postcode area to each funeral director you selected, where a public email address is available. For selected funeral directors with no public email address, we do not share your details with anyone — we instead send you a summary email containing the funeral director’s phone number or website so you can contact them yourself.

We do not share enquiry data with anyone other than the funeral directors you selected and our infrastructure providers listed below. We do not sell personal data, ever.

Provider data we publish

Funeral Cost Index publishes information about funeral directors as a public-interest pricing dataset. This is taken from publicly available sources: each provider’s own website, their CMA Standardised Price List (legally required to be publicly published), Companies House, and similar public registers. The information is treated as business-contact data, not personal data. If you are a sole-trader funeral director who believes a record about you should be removed or corrected, contact markets@indexeli.com and we will review.

Who processes the data for us

We use a small set of infrastructure processors:

Vercel - hosting and request logs.
Neon - managed PostgreSQL database (EU region), which also holds our request and click logs.
Amazon Web Services (SES) - outbound email delivery.
Cloudflare - Web Analytics, which sets no cookies (see above).
Clicky - site analytics, only where you consent (see cookie notice).

Some of these processors operate outside the UK. Where personal data is transferred outside the UK we rely on the UK’s adequacy regulations or on the International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses, as appropriate.

How long we keep it

Enquiry submissions: up to 24 months from submission, then deleted or anonymised. We may keep the delivery audit (which provider received which enquiry, with names and email addresses redacted) for longer to support anti-fraud and dispute resolution.
Waitlist: until you unsubscribe or ask us to delete your record.
Corrections / support emails: up to 24 months from the last reply.
Intelligence access requests: up to 24 months from the request, unless it becomes a subscriber account.
Intelligence subscriber accounts: while you have access and up to 24 months after it ends. Sign-in links expire after 15 minutes and sessions after 30 days.
Request log, reading-time signals, outbound click log and rate-limit records: 90 days, then deleted.
Vercel’s own request logs: kept by Vercel for the period its service allows.
Cloudflare Web Analytics: aggregate figures, held by Cloudflare under its own terms.

Your rights

Under UK GDPR you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data erased (subject to legal obligations to retain);
restrict or object to processing based on legitimate interests;
port your data to another controller in a structured format;
withdraw consent where consent is the lawful basis;
not be subject to automated decision-making — we do not perform any.

To exercise any of these rights, email markets@indexeli.com. We respond within one calendar month. We may need to verify your identity before acting on a request.

If you are not satisfied with our response you can complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Security

We use TLS for all traffic, store data with managed infrastructure providers in access-controlled accounts, rate-limit the enquiry endpoint, and hash IP addresses used for rate-limiting. Access to the enquiry database is restricted to people who need it to operate the service.

Children

Funeral Cost Index is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has submitted personal data, contact us and we will delete it.

Changes to this notice

When we change this notice, we update the date at the top of the page. Material changes will be highlighted on the homepage for at least 14 days.

Cookie notice — analytics, essential cookies, opt-out.
Terms of use — how the site and dataset may be used.
About the dataset — sources, methodology, and citation.