Garuda HCM Privacy Policy

Garuda HCM ("the App") is the employee self-service mobile application for organisations that use the Garuda HR platform. The App is used only with an account provided by your employer. This policy explains what data the App processes and why.

1. Who controls your data

Your employer (the organisation that gave you access) is the data controller. Garuda Yantra Technologies operates the App and the Garuda HR backend as a data processor on your employer's behalf. Questions about your personal records should go to your employer's HR team; questions about the App or this policy can be sent to [email protected].

2. Information we process

• Profile & identity — name, employee ID, email, phone and profile details provided by your employer
• Attendance & location — when you punch in/out or record a field trip, the App may capture your device's GPS location (including in the background during an active duty/trip, shown by a persistent notification) to geo-tag attendance
• Photos & files — selfies for attendance verification, and documents or expense receipts you choose to upload
• Face verification data — when your employer enables selfie verification, the selfie you take at punch-in/out or passwordless sign-in is transmitted securely to your employer's Garuda HR instance and compared with your enrolled profile photo to confirm your identity. The image is used solely for this one-time validation: it is discarded immediately after the match completes, no biometric template or faceprint is created or stored, and face data is never shared with any third party.
• Requests & messages — leave, expense, loan and helpdesk requests, and in-app chat with colleagues in your organisation
• Device identifiers — a push-notification token to deliver alerts

We do not sell your data, use it for advertising, or share it with third parties. Data is transmitted only to your employer's Garuda HR instance.

3. How we use it

Solely to provide the App's functions — recording attendance, processing leave/expense/loan requests and approvals, showing payslips and documents, enabling chat and notifications, and keeping your account secure.

4. Permissions we request

• Location — to geo-tag attendance punches and field/driver trips (background only while on an active duty/trip)
• Camera — attendance selfie verification and document/receipt capture
• Storage / files — to attach documents and expense receipts
• Notifications — approvals, announcements and reminders
• Biometric — optional fingerprint/face/PIN app lock

5. Security

All data is encrypted in transit using HTTPS/TLS. Login credentials are stored in the device's secure keystore. The App supports a fingerprint/face/PIN app lock.

6. Data retention & deletion

Face verification selfies are not retained — they are discarded immediately after the identity match completes, on every punch and sign-in. All other records are retained by your employer for as long as your employment and their legal obligations require. You may request access to or deletion of your data by contacting your employer's HR team, by writing to [email protected], or via our data deletion request page. Verified requests are actioned on your employer's instruction.

7. Children

The App is intended for employees aged 18 and over and is not directed at children.

8. Changes

We may update this policy and will revise the "last updated" date above.

9. Contact us