Privacy Policy

We look after HR and payroll records, which is about as personal as business data gets. That is a responsibility we take seriously, and this page sets out plainly what we hold, why we hold it, and what you can ask us to do about it. We have avoided legal padding — if anything here is unclear, please write to us and a person will answer.

1. Who this applies to, and our role

This policy covers Garuda HR, Garuda ERP, our website, and our companion mobile applications (together, the "Services"). Garuda Yantra Technologies is based in Chennai, Tamil Nadu, India.

It helps to be clear about two different situations:

• Data your employer puts into the platform. If your employer uses Garuda HR, then your employer decides what is collected and why. They are the data fiduciary; we hold and process that information on their instructions in order to run the service for them. Questions about your own records are usually best raised with your HR team first — though you are always welcome to come to us as well.
• Data you give us directly. If you contact us, request a demonstration or subscribe, we are the data fiduciary for that information and this policy governs it in full.

The Garuda HCM employee mobile app has its own dedicated notice, because it works differently — it can capture location during an active duty or trip. Please see the Garuda HCM Privacy Policy for that.

2. What we hold

Garuda HR is a hosted service, so your organisation's records live on servers we operate rather than only on a device. It is important to us that this is stated clearly. Depending on which modules your organisation uses, that can include:

• Employee master data — name, employee code, contact details, designation, department, branch, dates of joining and leaving
• Statutory identifiers your organisation is required to hold, such as PF, ESI, PAN and UAN references
• Attendance and time records, including punches from biometric devices and from the mobile app, and any location captured with them
• Leave, permission and regularisation records and their approval history
• Payroll — salary structures, payslips, deductions, loans, reimbursements and settlement records
• Documents and photographs uploaded by your organisation or by employees, including profile photographs
• Recruitment records where the module is in use — applications, interview notes and offers
• Helpdesk tickets, announcements and in-app messages

From your visit to this website, we collect only what is needed to serve the pages and keep the service secure — request logs of the ordinary kind. Our calculators run entirely in your browser: the figures you type are never sent to us or stored anywhere.

If you get in touch, we keep your name, contact details and the correspondence itself, so that we can help you properly and remember the context next time.

3. Why we hold it

• To provide the Services your organisation has subscribed to, and to keep them running correctly
• To calculate attendance, leave and payroll, and to produce the statutory outputs your organisation must file
• To keep the platform secure, investigate problems and maintain an audit trail
• To answer your questions, provide support and issue invoices
• To meet our own legal and tax obligations

We do not use your data to train products for other customers, we do not build advertising profiles, and we do not sell or rent personal data to anybody. We never have and we do not intend to.

4. Where it is stored

Your data is hosted on infrastructure located in India, and each customer's records are held in a separate database rather than pooled together. Backups are taken regularly and are held to the same standard as the live system.

5. Who else sees it

Very few people, and only where there is a reason:

• Our own team, where access is genuinely needed to operate the platform or to answer a support request — and only to the extent required
• A small number of specialist service providers who help us operate, for example for payment processing, email delivery and hosting infrastructure. They receive only what their function requires and are bound to protect it
• Where the law requires it, or to protect the safety and rights of people using the Services

If our business were ever to change hands, we would tell you before your data moved, and this policy would continue to apply to it.

6. Keeping it safe

• All traffic is encrypted in transit using HTTPS/TLS
• Each customer's data is separated at the database level
• Passwords are hashed, never stored in a readable form
• Administrative access requires two-factor authentication
• Actions inside the platform are recorded in an audit log
• Access by our team is limited to those who need it, and is reviewed

No system is beyond risk, and we would not claim otherwise. What we can promise is that we take it seriously and that we act quickly. If you believe you have found a security issue, we would genuinely welcome hearing from you at security@garudayantra.com — see our security.txt. We do not pursue researchers who report in good faith; we thank them.

7. How long we keep it

• Your organisation's records are kept for as long as the subscription is active
• After a subscription ends we retain data for a limited handover period so nothing is lost, provide a complete export on request, and then delete it
• Where a law requires us to keep something for longer — tax and statutory records, for instance — we keep only that, and only for as long as required
• Enquiry correspondence is kept while it is useful to us both, and removed on request

8. Your rights under the DPDP Act, 2023

If you are in India, the Digital Personal Data Protection Act, 2023 gives you the right to:

• Ask what personal data of yours we hold, and how it is being processed
• Ask for it to be corrected, completed or updated
• Ask for it to be erased, where no legal obligation requires us to keep it
• Nominate someone to exercise these rights on your behalf
• Raise a grievance, and have it answered

Write to privacy@garudayantra.com and we will help. Where the data belongs to your employer's account, we will need to act on their instruction — so we will coordinate with them rather than leave you to chase it yourself.

9. Cookies and tracking

This website does not use advertising cookies, and we do not track you across other sites. We keep the analytics we use minimal, and there is nothing here that follows you around the internet.

10. Children

The Services are intended for use by organisations and their employees. They are not directed at children, and we do not knowingly collect data from them.

11. Changes to this policy

If we make a material change we will tell our customers rather than quietly editing this page, and the "last updated" date above will always reflect the current version.

12. Talking to us

13. Grievance Officer

In accordance with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and the Digital Personal Data Protection Act, 2023, our Grievance Officer's details are published below. Any complaint about how we collect, use, store or delete personal data can be raised with them directly.