1. About this notice
This notice explains how Sabre MS uses personal data when you visit our website, contact us, request a demonstration, receive marketing from us, or deal with us as a prospective customer, customer, supplier, adviser or other business contact.
It does not generally cover worker, candidate or other end-user data entered into a Sabre MS product by one of our customers. In those circumstances, the customer normally decides why and how the information is used and is the data controller. Section 3 explains this distinction.
2. Who we are and how to contact us
Sabre MS provides cloud-based software for recruitment, workforce, vendor and training management. When we decide why and how personal data covered by this notice is used, Sabre MS is the data controller.
| Organisation | Sabre MS |
| Website | https://sabrems.com |
| Privacy contact | Privacy Officer |
| dpo@sabrems.com |
3. When Sabre MS is a processor
Our customers use Sabre MS products to manage information about their workers, candidates, clients and other users. For that information, the customer will normally be the controller and Sabre MS will act as its processor under a written agreement.
If your question or rights request concerns an account or information managed by a Sabre MS customer, you should usually contact that organisation directly. We will support the customer in responding where required, but we cannot independently change or disclose customer-controlled data unless authorised or legally required.
4. Personal data we collect
Depending on how you interact with us, we may collect:| Category | Examples |
| Contact and identity information | Name, job title, employer, business address, email address, telephone number and communication preferences. |
| Enquiry and relationship information | Messages, demonstration requests, meeting notes, support or sales correspondence, interests and relationship history. |
| Contract and account information | Customer or supplier contacts, agreements, authorised users, service information and account administration records. |
| Financial and transaction information | Invoices, payment status and limited banking or payment information needed to pay suppliers or administer contracts. |
| Website and device information | IP address, browser and device information, pages viewed, referral information, timestamps, cookie identifiers and security logs. |
| Marketing information | Marketing preferences, communications sent, engagement and opt-out records. |
| Compliance and correspondence records | Rights requests, complaints, identity-check information where necessary, legal correspondence and audit records. |
5. How and why we use personal data
| Purpose | Typical information | Lawful basis |
| Respond to enquiries and arrange demonstrations | Contact, enquiry and relationship information | Legitimate interests and steps requested before entering a contract |
| Provide services and administer customer relationships | Contact, contract, account and transaction information | Contract, legitimate interests and legal obligation |
| Manage suppliers and advisers | Contact, contract and financial information | Contract, legitimate interests and legal obligation |
| Operate, secure and improve our website and services | Website, device, security and usage information | Legitimate interests; consent where required for non-essential cookies |
| Send relevant business marketing | Business contact, relationship, preference and engagement information | Legitimate interests or consent, subject to electronic marketing rules |
| Maintain records, manage risk and establish legal rights | Correspondence, contract, complaint and compliance information | Legal obligation and legitimate interests |
| Complete corporate transactions or due diligence | Relevant business contact, contract and relationship information | Legitimate interests, subject to confidentiality and proportionality |
6. Cookies and similar technologies
Our website uses cookies and similar technologies. Essential technologies support functions such as security and consent management. We will ask for consent before using non-essential cookies where required. You can change your choices through the website’s consent controls. More information, including cookie categories and providers, is available in our separate Cookie Policy.
7. How we obtain personal data
- directly from you when you complete a form, contact us, attend a meeting or communicate with us;
- from your employer or another organisation involved in the business relationship;
- from publicly available business sources, company websites and professional networking services;
- automatically through our website, server logs and consented analytics or similar technologies; and
- from service providers, advisers, referrals or event organisers where it is lawful and reasonable to do so.
8. Who we share personal data with
We may share personal data where necessary with:
- website, hosting, email, communications, customer relationship, security and IT service providers;
- professional advisers, including accountants, auditors, insurers and solicitors;
- payment, banking and financial administration providers;
- contractors and business partners who need the information for an authorised purpose and are subject to appropriate obligations;
- public authorities, regulators, law-enforcement bodies or courts where disclosure is required or permitted by law;
- a prospective buyer, investor or adviser in connection with a genuine corporate transaction, subject to suitable confidentiality controls; and
- other recipients where you ask us to share the information or give valid consent.
We do not sell personal data.
9. International transfers
Some technology and service providers may process personal data outside the UK. Where a restricted transfer occurs, we will use a lawful transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, and will apply additional measures where required. Information about the relevant safeguard can be requested from the Privacy Officer, subject to necessary redactions.
10. How long we keep personal data
We keep personal data only for as long as reasonably required for the purpose for which it was collected, including legal, accounting, security and dispute-management needs. Our usual periods are set out below, but a longer or shorter period may apply where justified and documented.| Record category | Usual retention |
| General enquiries and unsuccessful sales discussions | Up to 3 years after the last meaningful contact. |
| Customer and supplier contracts and material correspondence | Usually 6 years after the relationship ends, unless a longer period is required for an unresolved matter. |
| Invoices and accounting records | Usually 6 years after the end of the relevant financial year, or longer where tax law requires. |
| Business marketing records | Until you opt out or the information is no longer useful and accurate; a minimal suppression record may then be kept to honour the opt-out. |
| Website and security logs | For a period proportionate to security, diagnostics and legal needs, normally no longer than 12 months unless linked to an incident. |
| Rights requests and data-protection complaints | Usually 6 years after closure to demonstrate how the matter was handled. |
| Cookie information | As described in the Cookie Policy and website consent controls. |
11. How we protect personal data
We use technical and organisational measures appropriate to the nature and risk of the information. These include access controls, authentication, secure hosting, encryption where appropriate, backup, monitoring, supplier controls, staff awareness and incident-management arrangements. No method of storage or transmission is completely risk-free, but we regularly review and improve our safeguards.
12. Your rights
Depending on the circumstances and the lawful basis, you may have the right to:
- be informed about how your personal data is used;
- request access to your personal data;
- ask us to correct inaccurate or incomplete information;
- ask us to erase personal data in certain circumstances;
- ask us to restrict processing in certain circumstances;
- receive certain personal data in a portable format;
- object to processing based on legitimate interests or for direct marketing;
- withdraw consent where processing relies on consent; and
- challenge certain decisions based solely on automated processing that have legal or similarly significant effects.
These rights are not absolute. We may need information to confirm your identity and understand your request. We normally respond within one month, although the law allows an extension in some circumstances. We will explain any decision not to comply fully.
To exercise a right, contact dpo@sabrems.com.
13. Complaints
If you are unhappy with how we have used your personal data, please contact dpo@sabrems.com. We will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate, and tell you the outcome.
You may also complain to the Information Commissioner’s Office. Details are available at https://ico.org.uk/make-a-complaint/. We would welcome the opportunity to address your concern first, but you are not required to obtain our agreement before contacting the ICO.
14. Changes to this notice
We review this notice regularly and will update it when our processing, services or legal obligations materially change. The current version and publication date will be shown on our website. Where a change materially affects how we use existing personal data, we will take reasonable steps to bring it to the attention of affected people.
15. External references
- Information Commissioner’s Office: https://ico.org.uk
- Sabre MS Cookie Policy: https://sabrems.com/cookie-policy/
- Sabre MS contact page: https://sabrems.com/contact-us/