Not bad
20% is a pretty good hit rate for a first-pass phishing test (I've run a couple in my time, using commercial services.) The first place we did it started with something like 45% click thru, from memory. Got it down below 10% after a year. Of course, there'll always be someone, sooner or later, which is why it doesn't matter if they give away a password, because they're all using hardware token 2fa. Right kids?
EDIT: Mildly surprised they were able to send realistic looking phish from a fake domain via GApps
Biting the hand that feeds IT
