Breakthrough Goal Privacy Policy

KD Johnson Group Ltd is the data controller for the Breakthrough Goal exercise. This means we decide why and how your personal information is used.

• Controller: KD Johnson Group Ltd.
• Company number: 14309172.
• Registered or business correspondence address: 1 Alt Grove, Wimbledon, London, SW19 4DY.
• Privacy, deletion and unsubscribe contact: kevin@kdjohnsongroup.com.

This policy explains how we handle information collected through this Breakthrough Goal form.

When you complete the exercise, we collect:

• Your first name, last name and email address.
• Your five Breakthrough Goal answers: your goal, risks, opportunities, capabilities and challenges.
• Your commitment confirmation.
• Whether you select the optional marketing-consent box. When you opt in, we also record the consent wording, version and date.
• Your submission date and a submission identifier.
• Campaign-source information where available, such as source, medium and campaign labels and a limited referring-page path.
• Limited security and delivery information, including form-start and verification information, duplicate-protection identifiers, temporary rate-limit counters and result-email delivery status and retry attempts.

Network-based rate limiting is used only if trusted network information can be safely verified. If enabled, it uses a protected identifier derived from an IP address, not a raw IP address in the lead record. This identifier is personal information, not anonymous data. Hosting providers may also process network information to deliver and secure the website.

Unfinished answers are temporarily held in your browser tab so you can move backwards and forwards or refresh without losing your work. This draft is cleared after successful completion or when you confirm a restart. It is not stored in browser local storage.

Please do not include sensitive personal information or confidential information about other people in your answers. The exercise does not require this information.

We use your information to:

• Process and save your completed exercise.
• Display your completed result and email you a copy, including a PDF attachment.
• Handle delivery problems and requests for support.
• Operate and secure the form, prevent spam and excessive submissions, and avoid processing the same submission twice.
• Understand which campaigns bring visitors to the exercise using limited campaign-source information.
• Send occasional related insights and follow-up marketing emails only when you separately opt in.
• Keep proportionate consent and withdrawal evidence, honour unsubscribe requests and respond to information-rights requests.

Required answers and contact details are needed to process the exercise and deliver the requested result. Marketing consent is not required.

Providing the exercise and requested result: we rely on legitimate interests in providing the exercise you requested and reliably displaying, saving and emailing your result.

Security and operation: we rely on legitimate interests in protecting the form, preventing misuse and duplicates, and resolving delivery problems.

Limited campaign analysis: we rely on legitimate interests in understanding the effectiveness of our campaigns. We do not use your exercise answers to build advertising profiles.

For processing based on legitimate interests, we consider our purposes alongside your rights and reasonable expectations. You may object to this processing by contacting us.

Optional future marketing: we rely on your consent. You can withdraw it at any time without affecting your requested result.

Compliance records and rights requests: we rely on legal obligations where applicable to respect your rights and demonstrate valid marketing consent, and on legitimate interests for proportionate records needed to resolve complaints or establish, exercise or defend legal claims.

The marketing checkbox is optional and unticked by default. Its wording is:

I'd like KD Johnson Group to email me occasionally with related insights and follow-up. I can unsubscribe at any time.

We display and send your requested result whether or not you tick this box. The result email is a service message; it does not give us permission to send future marketing.

Submitting a later exercise with the box unticked does not withdraw an earlier opt-in. To withdraw consent, email kevin@kdjohnsongroup.com and identify the email address you want unsubscribed. You do not need to give a reason.

We will stop future marketing to that address and record your withdrawal. Withdrawal does not affect the lawfulness of earlier processing or prevent us from sending a result you separately request.

We use:

• Lovable to host the form and securely forward completed submissions. The website does not maintain its own permanent database of exercise answers.
• Google Workspace and Google Sheets to store and manage submissions and separate consent and withdrawal records.
• Google Apps Script to process submissions, prepare results and manage delivery and records.
• Gmail to send your result email and PDF attachment.

The result email uses the sender name KD Johnson Group, with kevin@kdjohnsongroup.com as the From and Reply-to address.

Kevin, using kevin@kdjohnsongroup.com, is the only permanent staff member authorised to access the dedicated lead-magnet Sheet. Providers may process information as necessary to supply and secure their services. We do not sell your exercise information.

Providers may process information outside the UK. Where applicable data-protection law requires international-transfer safeguards, appropriate safeguards must apply. You can contact kevin@kdjohnsongroup.com for information about the arrangements applicable to your information.

Completed exercise answers: our retention period is up to 12 months from submission. Kevin manages the review and deletion process; deletion is not an automatic expiry feature. You may request deletion sooner, subject to any applicable legal exceptions.

Consent and withdrawal evidence: we keep the minimum evidence separately from exercise answers. This may include your email address, identifying details where needed, consent date and wording/version, withdrawal date and record identifiers. The separate retention process is designed to preserve evidence of permission and honour withdrawals without retaining your five answers for this purpose.

Withdrawal evidence and earlier related consent evidence are reviewed for deletion after six years from withdrawal, once related older exercise records no longer require that evidence. Active-consent evidence is retained while relied upon for marketing and reviewed at least once a year; if we are no longer relying on it, it is removed.

Temporary security checks: rate-limit counters are configured to last one hour. Other temporary cache entries have a maximum configured lifetime of six hours. These cache periods do not describe retention of identifiers stored with submissions or of provider logs.

Other copies and records: when you ask us to delete your information, we remove your record from the lead Sheet and the consent archive, delete the result email and PDF from the sent-items folder, and refresh the marketing export list so you are excluded. Copies held in hosting and Google backups expire in the ordinary course of those providers' policies. A result email or PDF already delivered to you is under your control in your own account or device.

Where a legal obligation or ongoing legal claim requires limited records to be kept longer, we retain only what is necessary and restrict their use.

Depending on applicable law and the purpose of processing, you may have the right to:

• Access your information and receive a copy.
• Correct inaccurate or incomplete information.
• Request deletion.
• Request restriction of processing.
• Object to processing based on legitimate interests.
• Object to direct marketing.
• Withdraw marketing consent at any time.
• Receive certain information in a portable format where the legal conditions apply.

Email kevin@kdjohnsongroup.com to exercise your rights. We may need proportionate information to verify your identity. Where UK GDPR applies, we normally respond within one month, subject to lawful extensions or exceptions. If we cannot fulfil a request, we will explain why.

If you have a concern, contact kevin@kdjohnsongroup.com.

You also have the right to complain to the Information Commissioner’s Office (ICO) where UK data-protection law applies:

https://ico.org.uk/make-a-complaint/

You do not have to contact us first. Other complaint rights may apply depending on the applicable jurisdiction.

We do not use your exercise answers for automated decisions with legal or similarly significant effects. Automated security checks may reject suspicious or excessive submissions. Contact us if you believe a check has wrongly prevented you from completing the exercise.