Question: We currently have a problem with new users being created that are destined for a secondary site collection. When activated they're being sent the wrong links (`www.contoso.co.uk/client` rather than `www.contoso.co.uk/second/brand/client`) and when you browse to the right link they do not have permissions.

`www.contoso.co.uk/brand` - Primary Site collection (where manage users section is to activate) 

`www.contoso.co.uk/second/brand` - Secondary Site collection for new Project (where we need to have new external FBA users with permissions to the client sites they associate with)

So. We create a new external user at `www.contoso.co.uk/brand` (the admin console) with the association to the `www.contoso.co.uk/second/brand/client` site.

I guess my question is how does permissions and users work across site collections. Are they combined or separate? Are there additional places I need to add permission for this setup to work?

Answer: 
If you are asking about permissions on cross site collections.

If you have to two site collections and you want a user access both site collections. Then you need to add the User into Both Site collections. 

If both Site collections are in same web app, you can add the user in the policy of web app then user will access all site collection in that web app.

But if you are talking about site collection & its sub sites...then once you add it as site collection admin, user will access everything in that web app.
The sites and subsites are defined by the admins and that decides if they are combined or seperate (breaking the inheritance). 
How the sites and subsites permissions work togeather , PS : <http://office.microsoft.com/en-us/windows-sharepoint-services-help/about-controlling-access-to-sites-and-site-content-HA010100144.aspx>