This policy is provided in good faith and in plain English. It is not legal advice. Last updated 18 June 2026.
Who is responsible for your data
This site, jonnyelliott.com, is run by Jonny Elliott ("I", "me"). I am the data controller for the personal data described here. You can reach me at jonny@jonnyelliott.com.
What I collect, and why
| Enquiries | If you use the contact form, I collect your name, email and message so I can reply and work out whether I can help. Lawful basis: taking steps at your request before any agreement, and my legitimate interest in responding. |
| Audit and waiting list | If you complete the Founder Operating Audit or join the EOS waiting list, I collect your name and email so I can send your result and updates. Lawful basis: your consent. |
| Booking a call | If you book a call, my scheduling tool collects your name, email and the time you choose. Lawful basis: taking steps at your request. |
| Payments | If you buy a product or a consulting plan, my payment provider collects the details needed to take payment. I do not see or store your full card details. Lawful basis: performance of a contract. |
| Spam protection | Forms use Google reCAPTCHA, which may process technical and usage data to tell humans from bots. Lawful basis: my legitimate interest in keeping the site secure. |
The services that process your data
I keep the stack small and use established providers. Each has its own privacy policy:
- Netlify hosts the site and handles contact-form submissions. Policy
- MailerLite stores email-list sign-ups (the audit, the waiting list and any newsletter) and sends emails. Policy
- Stripe processes payments for the consulting plans and digital products. Policy
- Google reCAPTCHA protects forms from spam. Policy
- Akiflow powers call bookings. Policy
- Substack runs the newsletter. If you subscribe, Substack processes your email under its own terms. Policy
Cookies and tracking
The site itself does not set advertising or analytics cookies. Some embedded third-party tools, such as Google reCAPTCHA, Stripe checkout and any Substack embed, may set their own cookies or process data when you interact with them, under the policies linked above. If I add website analytics in future, I will update this policy.
International transfers
Some of these providers are based outside the UK, including in the United States. Where data is transferred outside the UK, those providers rely on appropriate safeguards such as the UK extension to the EU Standard Contractual Clauses, or an adequacy decision.
How long it is kept
I keep personal data only as long as needed for the purpose it was given. You can unsubscribe from emails at any time using the link in any email, and you can ask me to delete your data at any time.
Your rights
Under UK GDPR you have the right to access your data, to have it corrected or deleted, to restrict or object to its use, to data portability, and to withdraw consent at any time. To exercise any of these, email jonny@jonnyelliott.com. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.
Changes
I may update this policy from time to time. The date at the top shows when it last changed.