This policy is provided in good faith and in plain English. It is not legal advice. Last updated 4 September 2026.
Who is responsible for your data
This site, jonnyelliott.com, is run by Jonny Elliott ("I", "me"). I am the data controller for the personal data described here. You can reach me at jonny@jonnyelliott.com.
What I collect, and why
| Enquiries | If you use the contact form, I collect your name, email and message so I can reply and work out whether I can help. Lawful basis: taking steps at your request before any agreement, and my legitimate interest in responding. |
| Audit and waiting list | If you complete the Founder Operating Audit or join the EOS waiting list, I collect your name and email so I can send your result and updates. Lawful basis: your consent. |
| Booking a call | If you book a call, my scheduling tool collects your name, email and the time you choose. Lawful basis: taking steps at your request. |
| Payments | If you buy a product or a consulting plan, my payment provider collects the details needed to take payment. I do not see or store your full card details. Lawful basis: performance of a contract. |
| Spam protection | Forms use Google reCAPTCHA, which may process technical and usage data to tell humans from bots. Lawful basis: my legitimate interest in keeping the site secure. |
| Your portal account | Every enquiry and every completed audit is also sent to my client portal at portal.jonnyelliott.com, which is where I actually work: it holds your name, your email and what you wrote so it does not get lost in an inbox. Completing the audit also opens a portal account for you and emails you the login, with your score in it. The page tells you when that has happened. Lawful basis: taking steps at your request, and my legitimate interest in running the business from one place rather than several. |
| Where you came from | When you send a form I record the page you were on, the site that referred you if there was one, and any campaign tags in the link you followed. It is attached to your enquiry so I can tell a cold email apart from a LinkedIn post. It sets no cookie and it does not follow you anywhere. Lawful basis: my legitimate interest in knowing which of my own efforts work. |
The services that process your data
I keep the stack small and use established providers. Each has its own privacy policy:
- Netlify hosts the site and handles contact-form submissions. Policy
- MailerLite stores email-list sign-ups (the audit, the waiting list and any newsletter) and sends emails. Policy
- Stripe processes payments for the consulting plans and digital products. Policy
- Google reCAPTCHA protects forms from spam. Policy
- Akiflow powers call bookings. Policy
- Substack runs the newsletter. If you subscribe, Substack processes your email under its own terms. Policy
- My own client portal at portal.jonnyelliott.com holds enquiries, audit results and, if you have one, your account. It runs on Netlify and nothing in it is shared with anybody else. Policy
Cookies and tracking
The site itself does not set advertising or analytics cookies, and there is no tracking pixel and no tag manager. It does record the page you arrived on and any campaign tag in the link you followed when you send a form, which is described above and is not a cookie. Some embedded third-party tools, such as Google reCAPTCHA, Stripe checkout and any Substack embed, may set their own cookies or process data when you interact with them, under the policies linked above. If I add website analytics in future, I will update this policy.
International transfers
Some of these providers are based outside the UK, including in the United States. Where data is transferred outside the UK, those providers rely on appropriate safeguards such as the UK extension to the EU Standard Contractual Clauses, or an adequacy decision.
How long it is kept
I keep personal data only as long as needed for the purpose it was given. You can unsubscribe from emails at any time using the link in any email, and you can ask me to delete your data at any time.
Your rights
Under UK GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its use, to data portability, and to withdraw consent at any time. To exercise any of these, email jonny@jonnyelliott.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
I may update this policy from time to time. The date at the top shows when it last changed.