1 Who is responsible for your information

​

Grace Expressed, operated by Donna Boby and referred to as Grace Expressed in this policy, is the controller of the personal information described here. This means Grace Expressed decides why and how that information is used. The words I, me and my refer to the celebrant acting for Grace Expressed.

Data protection contact: Donna Boby, Grace Expressed. You can make a privacy enquiry through the current contact details published at www.graceexpressed.com, or by replying to the business email from which Grace Expressed contacted you.

This policy applies when you enquire about, book or take part in a ceremony or support service; communicate with Grace Expressed; visit the website; provide a testimonial or media; make a complaint; or use the Grace Expressed shop where it is available.

​

2 Personal information collected

​

The information collected depends on the service and may include

•  identity and contact details, such as your name, preferred form of address, email address, telephone number and postal address

•  booking and event details, including dates, venues, accessibility needs, chosen suppliers, authorised contacts and practical arrangements

•  relationship, family and ceremony information, including personal histories, memories, tributes, vows, readings, beliefs, wishes, drafts and contributions from other people

•  payment and transaction information, such as invoices, payment status, refunds and shop orders; card details are normally handled by the payment provider rather than stored by Grace Expressed

•  communications and service records, including enquiries, meeting notes, approvals, correspondence, complaints and feedback

•  photographs, audio, video, testimonials or recordings where these are supplied, commissioned or created with appropriate notice

•  website and device information, such as IP address, browser, pages visited, cookie choices and security logs

•  safeguarding, incident or legal information where necessary and lawful, with additional care for children and adults at risk

Ceremony conversations may reveal information that data protection law treats as especially sensitive, including health, disability, race or ethnicity, religion or belief, political opinions, trade-union membership, sex life or sexual orientation. Section 6 explains how this special category data is handled.

Data protection law does not generally apply to information about a person who has died. It may still protect information within a funeral tribute or family account if that information identifies a living person, and Grace Expressed will in any event treat it with care under the Confidentiality Policy.

​

3 Where information comes from

​

Information may be received

•  directly from you, including through forms, meetings, calls, email, messages, questionnaires and material you provide

•  from a joint client, family member, executor, representative or guest who contributes to a ceremony

•  from a funeral director, wedding planner, venue, supplier, officiant, referral partner or other professional involved in the service

•  from the website, cookie controls, security systems, payment provider or shop fulfilment and delivery providers

•  from publicly available sources only where relevant, reasonable and consistent with what you would expect

If you provide information about another person, please share only what is relevant and, where appropriate, tell them that Grace Expressed will use it for the ceremony or service. Grace Expressed will provide privacy information directly where the law requires this and it is reasonable to do so.

​

4 Why information is used and the lawful basis

​

Personal information is used only for a clear purpose and on a lawful basis. More than one basis may apply to the same record, depending on the circumstances. Consent is not relied on for core processing needed to perform a contract simply because a person has agreed to the service.

​

5 Legitimate interests and your expectations

​

Where Grace Expressed relies on legitimate interests, the interest, necessity and effect on the people concerned are considered and recorded where appropriate. The basis is used only where the interests or fundamental rights of the person do not override the business need. Examples include coordinating with ceremony professionals, maintaining secure systems, improving services and protecting legal rights.

A person may object to processing based on legitimate interests. Grace Expressed will stop unless there is a compelling lawful reason to continue or the information is needed for legal claims. Direct marketing will stop when a person objects.

​

6 Special category and highly sensitive information

​

Special category information is used only when it is relevant and both a general lawful basis and an additional legal condition apply. Depending on the circumstances, the additional condition may be explicit consent, information deliberately made public by the person, vital interests where consent cannot be given, legal claims, or a substantial public-interest condition permitted by law, including appropriate safeguarding action.

Sensitive details are minimised, access is restricted, and an anonymised description may be used where the identity is not necessary. If no suitable condition applies, Grace Expressed will not use the information and may ask for a less detailed version.

​

7 Children and adults at risk

​

Grace Expressed services and any shop are intended for adults arranging or participating in ceremonies. Information about a child will normally be obtained from a parent, guardian or authorised adult and used only as needed for the service. The child's age, understanding, wishes and best interests will be considered where relevant.

Information about a child or an adult at risk may be shared without consent where a proportionate and lawful disclosure is necessary to address a safeguarding concern. The Grace Expressed Safeguarding Policy applies in those circumstances.

​

8 Who information may be shared with

​

Only the information reasonably needed for the task is shared. Recipients may include

•  a joint client, agreed family contact or representative, in line with the communication and approval arrangements agreed for the service

•  funeral directors, wedding planners, venues, musicians, printers, florists, photographers, videographers, streaming or audiovisual providers and other agreed ceremony suppliers

•  a carefully selected replacement celebrant or assistant if illness, emergency or another contingency affects delivery

•  providers of email, website, forms, booking, customer management, document production, cloud storage, online meetings, transcription, accounting, payment, analytics and security services

•  shop payment, print-on-demand, fulfilment, postal and courier providers where an order requires them

•  accountants, insurers, professional advisers, mediators, dispute-resolution bodies and legal representatives

•  police, courts, regulators, safeguarding bodies, emergency services or another authority where disclosure is lawful and necessary

Grace Expressed does not sell personal information. A funeral director, planner, venue or other professional may be a separate controller for the information it holds, and its own privacy notice may also apply.

​

9 International transfers

​

Some technology, payment, fulfilment or communication providers may process information outside the United Kingdom. Before using such a provider for personal information, Grace Expressed will check that the destination is covered by UK adequacy regulations or put an appropriate safeguard in place, such as the UK International Data Transfer Agreement or the UK Addendum, together with any required risk assessment and additional protections.

You may ask for more information about the safeguard relevant to your data. Certain disclosures requested by you, such as sending an approved script to an overseas venue or family member, may also involve an international transfer.

​

10 How long information is kept

​

Grace Expressed keeps personal information only for as long as it is needed for the stated purpose, legal or tax requirements, insurance, safeguarding, dispute handling or the establishment, exercise or defence of legal claims. The Data Retention Policy contains the operational schedule. Unless a different period is justified, the usual guide is

•  unbooked enquiries: up to 12 months after the last meaningful contact

•  temporary working notes, recordings, transcripts and duplicate drafts: normally deleted within 12 months after the ceremony or the work ending, and sooner where practical

•  booking records, contracts, approved final scripts, permissions and core correspondence: up to six years after completion or cancellation

•  invoices, payment records and shop transaction records: for the period required by tax, accounting and consumer law, normally six years after the relevant financial or tax year

•  complaints, incidents and legal claims: normally up to six years after closure, or longer while a claim, insurer requirement, safeguarding need or legal duty remains active

•  publicity consent and published material: while the material is used, with evidence of the consent normally retained for up to six years after withdrawal or last use

•  marketing records: until consent is withdrawn or an objection is made; a minimal suppression record may then be kept so that the preference continues to be respected

•  website security, analytics and cookie information: according to the cookie notice, provider settings and genuine operational need

Safeguarding records are retained according to the nature of the concern, applicable law and professional guidance, with access restricted. Data in secure backups is removed through the normal backup cycle and is not used for another purpose. Information may be securely anonymised instead of deleted where it is no longer possible to identify anyone.

​

11 Security and personal data breaches

​

Grace Expressed uses proportionate technical and organisational measures, including password protection, access controls, multi-factor authentication where available, secure disposal, software updates and careful selection of service providers. Paper records and printed scripts are kept securely and confidentially destroyed when no longer required.

If information is lost, misdirected, accessed without authority or otherwise compromised, Grace Expressed will contain and assess the incident, record the response and reduce further risk. The Information Commissioner's Office and affected people will be notified where data protection law requires this.

​

12 Your data protection rights

​

Depending on the circumstances and the lawful basis, you may have the right to

•  be informed about how your personal information is used and request access to it

•  ask for inaccurate information to be corrected or incomplete information completed

•  ask for information to be erased, or for its use to be restricted, where the relevant legal conditions apply

•  receive information you supplied in a structured, commonly used and machine-readable format and ask for it to be transmitted to another controller where portability applies

•  object to processing based on legitimate interests, and object at any time to direct marketing

•  withdraw consent at any time, without affecting use that was lawful before withdrawal

•  ask for human involvement where a solely automated decision with legal or similarly significant effects is used; Grace Expressed does not currently make such decisions

To exercise a right, contact Grace Expressed using the details in section 1. There is normally no charge. Identity or authority may need to be confirmed, and Grace Expressed will respond within the period required by law. A request may be limited or refused only where the law permits, with an explanation.

​

13 Cookies and marketing

​

The website may use essential cookies needed for operation and security. Analytics, advertising or other non-essential cookies will be used only in line with the website's cookie controls and applicable electronic-communications law. You can change non-essential cookie choices through the available settings, although browser settings may also affect website functions.

Marketing messages will identify Grace Expressed and provide a clear way to unsubscribe. Service messages about a booking, order or requested information are not marketing and may still be sent where needed to perform the service or meet a legal obligation.

​

14 Information needed to provide a service

​

Some information is needed to prepare a quotation, enter into a contract, safely plan a ceremony, take payment or fulfil a shop order. If it is not provided, Grace Expressed may be unable to offer or complete the requested service. Optional information will be identified by the context, and a person may decline to share personal background that is not needed.

​

15 Questions and complaints

​

Please contact Grace Expressed first if you have a question or concern about personal information. The concern will be acknowledged, investigated fairly and answered without undue delay in line with the Complaints Policy. Raising a concern will not affect the standard of service you receive.

You also have the right to complain to the Information Commissioner's Office, the UK data protection regulator. Current contact and complaint information is available at www.ico.org.uk. If you live or work outside the UK, you may also be entitled to contact the data protection authority where you are located.

​

16 Changes and review

​

This policy is reviewed at least annually and sooner where services, systems, suppliers or legal requirements change. A current version will be made available through Grace Expressed. If a change materially affects how existing information is used, reasonable steps will be taken to bring it to the attention of the people concerned before the new use begins.

​

17 Related policies and legal framework

​

This policy should be read alongside the Grace Expressed Confidentiality Policy, Data Retention Policy, Safeguarding Policy, Complaints Policy, Cookie Policy and Terms and Conditions. It reflects the UK General Data Protection Regulation, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, the Privacy and Electronic Communications Regulations, and relevant guidance from the Information Commissioner's Office.