Privacy Policy

Agent Two Ltd
Last updated: 12/09/26

1. Who we are

Agent Two Ltd ("we", "us", "Agent2") is registered in England and Wales, company number, registered office 112 St Augustine Street, Taunton, TA1 1QN.

Email: dom@agent2.co.uk

We have not appointed a Data Protection Officer, as we are not required to. Data protection queries go to dom@agent2.co.uk.

2. When we are a controller, and when we are a processor

This distinction matters, so we set it out up front.

We are the controller for data about our own enquirers, clients, suppliers and website visitors. This policy covers that data.

We are a processor for personal data held in systems we access on a client's behalf, such as their website, CRM, analytics or Google Business Profile. In those cases the client decides why and how that data is used, and their own privacy policy applies. We act only on their documented instructions under a written data processing agreement.

If you are a customer of one of our clients and want to exercise your rights, contact that business directly. We will pass on any request we receive.

3. What we collect, and where it comes from

Directly from you:

Enquiry and contact data, meaning your name, email, phone, company, website and anything else you tell us. Client data, meaning billing details, business information and access credentials for platforms we manage. Marketing data, meaning your name and email if you subscribe.

Automatically when you visit our site:

IP address, browser and device type, pages viewed, referral source and interaction data, collected through analytics and only where you have consented to non-essential cookies.

From other sources:

Where we carry out business development, we may collect business contact details from publicly available sources such as company websites, Companies House and LinkedIn. We use business contact details only, and only to make contact about services relevant to that business. If we contact you this way, we will tell you where we got your details.

4. Why we use it, and our lawful basis

We respond to enquiries on the basis of our legitimate interest in replying to people who approach us.

We deliver our services and manage billing on the basis of our contract with you.

We keep accounting and tax records because we are legally required to under the Companies Act 2006 and HMRC rules.

We run website analytics on the basis of your consent.

We send marketing emails to prospects on the basis of consent. We send marketing about similar services to existing clients on the basis of our legitimate interests, relying on the soft opt-in permitted under PECR.

We carry out business development outreach to business contacts on the basis of our legitimate interest in promoting our services.

We protect our systems from fraud and misuse on the basis of our legitimate interests.

We publish case studies and examples of our work on the basis of our legitimate interests, and always with the client's agreement.

Where we rely on legitimate interests, we have carried out a balancing assessment and concluded that our interests are not overridden by your rights and freedoms. You can request a summary of that assessment at any time.

Every marketing email carries an unsubscribe link. You can opt out at any point and we will stop.

5. Is providing your data required?

Providing contact data is not a statutory requirement. Where we need certain information to perform a contract with you, such as billing details or platform access, we will say so at the time. Without it we may be unable to provide the service.

6. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects, and we do not use your personal data for profiling of that kind.

7. Who we share it with

We use third party providers to run the business. These currently include Google for Workspace, Analytics, Search Console and Ads, Xero for invoicing and bookkeeping; Framer for our website; SEO and analytics tools including Semrush, Local Falcon & Moz; and Go Cardless for taking payment.

We may also share data with our accountant or professional advisers, and with law enforcement or regulators where we are legally required to.

8. How long we keep it

Enquiries that do not become clients are kept for 12 months from last contact.

Client records and contracts are kept for the duration of the engagement and 6 years afterwards.

Financial and tax records are kept for 6 years from the end of the accounting period.

Marketing subscriber details are kept until you unsubscribe.

Records of unsubscribes and objections are kept indefinitely, so that we can continue to honour your preference.

Website analytics data is kept for 26 months.

We delete or anonymise data once these periods expire.

10. Security

We hold personal data on access-controlled systems. Access is limited to those who need it. Client platform credentials are stored in a password manager and we ask clients to revoke our access when an engagement ends.

No system is completely secure. If a breach occurs that is likely to result in a risk to your rights, we will report it to the ICO within 72 hours and tell you where the law requires it.

11. Cookies

Our site uses strictly necessary cookies to function, and analytics cookies to understand how it is used.

Analytics and any marketing cookies are only set after you consent through our cookie banner. Strictly necessary cookies do not require consent. You can change or withdraw your choice at any time through the banner or your browser settings.

12. Your rights

Under UK GDPR you have the right to be informed about how we use your data, which is what this policy is for. You also have the right to access a copy of the data we hold about you, and to have anything inaccurate or incomplete corrected.

You have the right to erasure and the right to restrict processing, both in certain circumstances.

You have the right to object to processing based on legitimate interests. Your right to object to direct marketing is absolute and we will always honour it.

You have the right to data portability for data you provided to us, where processing is based on consent or contract and carried out by automated means.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of anything we did before you withdrew it.

Email dom@agent2.co.uk to exercise any of these. We respond within one month, which we may extend by two further months for complex requests, in which case we will tell you within the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive.

We may ask you to verify your identity before we act.

13. Complaints

Please raise any concern with us first at dom@agent2.co.uk.

You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
0303 123 1113
ico.org.uk/make-a-complaint

14. Changes

We may update this policy. The version on this page is the current one and the date it was last updated is shown at the top. We will tell clients directly about any material change.