Last updated: 19 October 2026
1. Introduction
The Second Floor ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website thesecondfloor.io or engage with our SEO and paid media services.
The Second Floor is a trading name of Unchained Music Ltd, a company registered in England and Wales (company no. 16179634), registered office: 78 Friday Street, Leicester LE1 3BW. Unchained Music Ltd is the data controller responsible for your personal data.
Please read this privacy policy carefully. If you do not agree with the terms of this privacy policy, please do not access the site or use our services.
2. Information We Collect
Personal Information
We may collect personal information that you voluntarily provide to us when you:
- Fill out a contact form or enquiry form
- Request a free growth review
- Subscribe to our newsletter
- Engage with us for services
This information may include:
- Name and job title
- Email address
- Phone number
- Company name and website
- Information about your marketing goals and challenges
Automatically Collected Information
When you visit our website, we automatically collect certain information about your device and usage, including:
- IP address and location data
- Browser type and version
- Operating system
- Pages visited and time spent on pages
- Referring website addresses
- Click patterns and interactions
Information from public sources
If you represent a UK business that we have not dealt with before, we may also hold a limited amount of information about your company that we have collected from publicly available sources, in order to offer our services. We explain this separately in Business outreach: information we collect from public sources below.
3. Business outreach: information we collect from public sources
From time to time we contact UK businesses that we have not previously dealt with, to offer our services. Where we do this, we process a limited amount of information gathered from publicly available sources. This section provides the information required by Article 14 of the UK GDPR, which applies when we obtain personal data from sources other than the individual.
Who this applies to
We only carry out this outreach to limited companies and limited liability partnerships (LLPs). We do not target sole traders or ordinary partnerships, and we do not process their personal data for this purpose.
What information we hold
- The company name, company number and registered office address.
- The names of the company's directors.
- A business email address and telephone number taken from the company's own website.
- Publicly available information about the business, including its website content and loading speed, its Google Business Profile, its position on Google Maps and in search results, and how AI assistants describe it.
Where we obtain it
- The Companies House public register.
- The company's own website.
- Google, including Google Business Profile, Google Maps and Google PageSpeed.
- Local search ranking tools (Local Falcon).
- AI assistants.
How we use it, and our lawful basis
We use this information to prepare a free website and visibility audit for the business and to email it to a relevant business contact, followed by up to two short follow-up emails if we do not hear back. Our lawful basis is legitimate interests, namely offering our services to other businesses in a relevant and proportionate way. We have carried out a legitimate interests assessment that weighs our interest against the rights and interests of the individuals concerned, and we keep it on file.
Your right to object, and how to opt out
You can tell us to stop at any time. Reply to any of our emails with the word "unsubscribe", or email [email protected], and we will stop contacting you straight away. When you opt out, we keep only a minimal suppression record, enough to recognise you, so that we do not contact you again. We read the replies sent to [email protected] in order to record responses and act on opt-out requests.
How long we keep it
If a business does not reply, we keep the outreach information for up to 12 months after our last contact and then delete it. Suppression records are kept indefinitely, so that we can continue to honour opt-out requests.
4. How We Use Your Information
We use the information we collect to:
- Respond to your enquiries and provide customer support
- Deliver the services you have requested
- Send you newsletters and marketing communications where you have given your consent
- Contact businesses to offer our services, on the basis of our legitimate interests (see the business outreach section above)
- Improve our website and services
- Analyse usage patterns and trends
- Protect against fraudulent or unauthorised activity
- Comply with legal obligations
5. Cookies and Tracking Technologies
We use cookies and similar tracking technologies to collect and track information about your browsing activities. For detailed information about the cookies we use and your choices regarding cookies, please see our Cookie Policy.
6. Third-Party Services
We may share your information with, or rely on, third-party service providers who assist us in operating our website, carrying out our business outreach and delivering our services, including:
- Google Analytics: For website analytics and performance monitoring
- Google Tag Manager: For managing tracking scripts
- Google Ads: For advertising and conversion measurement
- Formspree: For processing contact and enquiry form submissions
- Cloudflare: For website hosting, delivery and security
- Namecheap Private Email: For sending and receiving our business outreach email
- Google Places and Google PageSpeed: For public business, maps and website-performance data used in our audits
- Local Falcon: For local search and map ranking data used in our audits
- Anthropic (Claude): For analysing public business information and helping to draft audits and communications
These third parties have access to your personal information only to perform specific tasks on our behalf, or process it as independent controllers of public data, and are obligated not to disclose or use it for any other purpose.
7. Data Retention
We will retain your personal information only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. Typically, we retain client data for 6 years after the end of our business relationship. Information collected through our business outreach is kept for the shorter periods described in the business outreach section above.
8. Your Rights Under UK GDPR
Under the UK General Data Protection Regulation (UK GDPR), you have the following rights:
- Right to access: You can request a copy of your personal data
- Right to rectification: You can ask us to correct inaccurate data
- Right to erasure: You can ask us to delete your data in certain circumstances
- Right to restrict processing: You can ask us to limit how we use your data
- Right to data portability: You can request your data in a machine-readable format
- Right to object: You can object to processing based on legitimate interests or direct marketing, including our business outreach
- Rights related to automated decision-making: You have rights regarding automated profiling
To exercise any of these rights, please contact us using the details provided below.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal information against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet or electronic storage is 100% secure, and we cannot guarantee absolute security.
10. International Transfers
Some of our third-party service providers are located outside the UK, including in the United States. These include Google, Cloudflare, Formspree, Namecheap, Local Falcon and Anthropic. When we transfer personal data to a provider outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the European Commission's Standard Contractual Clauses, or the UK Extension to the EU to US Data Privacy Framework where a provider is certified under it.
11. Children's Privacy
Our website and services are not intended for children under 16 years of age. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.
13. Contact Us
If you have any questions about this Privacy Policy or our data practices, please contact us at:
The Second Floor (the data controller)
A trading name of Unchained Music Ltd, a company registered in England and Wales (company no. 16179634)
Registered office: 78 Friday Street
Leicester LE1 3BW
United Kingdom
Email: [email protected]
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data in accordance with the law. Visit ico.org.uk for more information.