Skip to content
Ricardo C. Johnson

Privacy Policy

Last updated: 25 October 2026

This policy explains what personal data we collect through this website and in our work, why we collect it, how long we keep it and the rights you have. We keep it short and specific.

1. Who we are

Ricardo C. Johnson is the trading name of RCJ Innovations Ltd, a company registered in England and Wales with company number 15734354. Our registered office is 167 Great Portland Street, London, England, W1W 5PF.

RCJ Innovations Ltd is the controller of your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number ZC211490.

For any question about your data, email info@ricardocjohnson.com.

2. What we collect

  • Booking form: your name, email, phone number (optional), company name, website (optional), turnover band, expected turnover in 12 months (for some turnover bands), how long you have been trading, number of staff, sector, the problem you describe, how you heard about us and whether you want marketing emails.
  • Revenue Growth Diagnostic: your name, business name, email, phone number and website (optional), your answers to the diagnostic questions (industry, revenue band, team size, challenges, enquiry volume, how you manage enquiries, areas of interest, timing and budget range), the recommendation we show you, and the campaign parameters in the page address if you arrived through a campaign link. We do not ask for financial documents or customer data.
  • Exit Readiness Assessment: your name, email, company name, turnover band, sector, when you might sell, your answers and the scores they produce.
  • Downloads: your first name, email and company name (optional).
  • Calls and emails: what you tell us when we speak or write to each other.
  • Clients: contact details, a record of your acceptance of our engagement letter (your typed name, the date and time, and the IP address and browser used), and the business and financial information you share for the work. This is mainly about your business, but it sometimes includes personal data, such as salaries or director drawings.
  • Business contacts we approach: if we contact you about our services, your name, business, role, business contact details and public profile information, taken from LinkedIn, business directories you are listed in, or your business website, and a record of our messages.
  • Website use: anonymous, combined visit counts from Vercel Web Analytics. It sets no cookies and does not identify you.

We do not collect special category data, such as health information, and we ask you not to send it.

3. Why we use it and our lawful basis

  • To show you a suggested next step and reply to your diagnostic. Lawful basis: steps you ask us to take before a contract, and our legitimate interest in replying to people who contact us. The suggestion is produced by fixed rules from your answers. It is guidance only and has no legal or similarly significant effect on you.
  • To reply to your enquiry and arrange a call. Lawful basis: steps you ask us to take before a contract, and our legitimate interest in replying to people who contact us.
  • To send the report or download you asked for. Lawful basis: our legitimate interest in providing what you requested.
  • To contact business owners about our services. Lawful basis: our legitimate interest in offering relevant services to businesses. Tell us you are not interested and we stop straight away and do not contact you again.
  • To follow up on your enquiry, report or download. Lawful basis: our legitimate interest in offering relevant help to people who have shown an interest in our services. You opt out at any time by replying to say so.
  • To send occasional marketing emails. Only if you tick the box to agree. Lawful basis: consent. You withdraw it at any time by unsubscribing or emailing us.
  • To deliver our services to clients. Lawful basis: performance of our contract with you.
  • To keep business, accounting and tax records. Lawful basis: legal obligation.
  • To keep the website secure and understand how it is used. Lawful basis: our legitimate interest in running a secure, useful website. The analytics data is anonymous.

4. Automated scoring

The Exit Readiness Assessment calculates a score from your answers automatically. The score is guidance only. It does not lead to any decision that has a legal or similarly significant effect on you, so it is not automated decision-making under UK data protection law.

5. Who we share it with

We do not sell your data. We share it only with the service providers we use to run the website and the business, under contracts that require them to protect it and use it only on our instructions:

  • Vercel Inc. Website hosting and anonymous analytics. United States.
  • Supabase Inc. Database for form submissions and engagement records. Data stored in Supabase's West EU region, in Europe.
  • Zoho Corporation B.V. Email. Data stored in Zoho's EU data centre.
  • Calendly LLC. Call scheduling, only if you book a call. United States.
  • Google. Storage of client files on Google Drive.
  • Stripe Payments Europe Ltd. Card payments and invoices for clients. Stripe processes your card details directly. We never see or store them. Ireland, with some processing in the United States.

We also share data with our professional advisers, such as our accountant, lawyer or insurer, where they need it, and with authorities where the law requires it.

6. International transfers

Some of our providers process data outside the UK. Data stored in the European Economic Area is covered by the UK's adequacy regulations for the EEA. For transfers to the United States and elsewhere, the transfer is protected by UK adequacy regulations, such as the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge), or by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

7. How long we keep it

  • Enquiries, assessments and downloads that do not lead to work: 24 months after our last contact with you.
  • Business contacts we approach who do not become clients: 24 months after our last contact. If you ask us not to contact you, we keep only your name and profile link on a do-not-contact list, so we never contact you again.
  • Marketing consent: until you unsubscribe. We then keep only your email address on a suppression list, so we do not contact you again.
  • Client records: six years after the end of the engagement, to meet tax and legal requirements.

After these periods we delete or anonymise the data.

8. How we protect it

Form data travels over an encrypted connection and is stored in a database that only our server code accesses. Client files are stored on Google Drive, and access is limited to us. We use strong passwords and two-factor authentication on the services that hold your data.

9. Your rights

Under UK data protection law, you have the right to:

  • ask for a copy of the personal data we hold about you
  • ask us to correct data that is wrong or incomplete
  • ask us to delete your data
  • ask us to restrict how we use your data
  • object to us using your data on the basis of legitimate interests, including for follow-up emails
  • ask us to transfer your data to you or to another organisation
  • withdraw your consent to marketing at any time

To use any of these rights, email info@ricardocjohnson.com. There is no charge. We reply within one month, and we ask for proof of identity if we need it to protect your data.

10. Complaints

If you are unhappy with how we handle your data, please tell us first so we have the chance to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. Children

This website and our services are for business owners. We do not knowingly collect data from anyone under 18.

12. Changes to this policy

We update this policy when our use of data changes. The date at the top shows when it last changed.