Privacy policy

Last updated: November 12, 2026

This policy explains what data the GRH application (human resources management for Windows) and this website process, why, where the data is stored and what your rights are.

1. Who we are

GRH is published by GRH, Antananarivo, Madagascar. For any question about your data: prestapro913@gmail.com or +261 34 71 754 06.

2. Who is responsible for which data

• Employee data is entered by the client company, which is responsible for it: the company decides what it records and why. GRH processes this data on the company's behalf, as a service provider, solely to operate the service.
• User account, subscription and payment data is processed by GRH, which is responsible for it.

An employee who wishes to exercise their rights should first contact their employer; we help the employer respond.

3. Data processed

User accounts

Last name, first name, email address, role (HR administrator, manager, employee) and password. The password is handled by our hosting provider's authentication service: it is only stored in hashed, unreadable form, never in plain text.

If you choose “Continue with Google”, Google sends us your name, email address and profile picture to open your session. GRH never receives your Google password.

Company

Company name, legal form, legal identifiers (NIF, STAT, RCS, CNaPS), address, contact details, legal representative, logo and application settings (working hours, leave, payroll currency, badge colors).

Employees, entered by the company

• Identity and contact details: last name, first name, date of birth, sex, address, phone number, email addresses, marital status, national ID card number and date of issue, nationality, photo.
• Employment: employee number, position, department, contract type, hiring date, base salary.
• Working time: attendance, clock-ins (time and device), late arrivals, leave and absences.
• Payroll and documents: payslips, certificates, contracts and generated badges.

Time clocks

• The network address of each time clock and, for each clock-in, the person's identifier and the time.
• A time clock's password is encrypted by Windows on the computer where it is entered; it is never sent to our servers.
• Fingerprints stay in the time clock. When the administrator changes an employee's identifier on a time clock, the application copies their fingerprints and card from one enrollment to the other, on the same time clock, without storing them or sending them anywhere else.
• A technical log of connection incidents is kept on the computer, without any password.

Subscriptions and payments

Payment is made by Visa card on Papi's secure page. GRH neither sees nor stores your card details. We store the chosen plan, the amount, the payment reference and status, the payment method and date, and the activation code issued. The email address of the administrator who pays is sent to Papi so that the receipt can be delivered.

Computer (free trial)

To limit the free trial to one per computer, the application computes a fingerprint of two technical identifiers of the computer (the Windows installation identifier and the motherboard identifier). Only their encrypted fingerprint (SHA-256) is sent: the identifiers themselves never leave the computer.

Sign-in verification

The first time you sign in with a password on a computer, then every 30 days, a one-time code is sent to your email address. The computer then keeps a random token, encrypted by Windows; we only keep its fingerprint (SHA-256), for 30 days, together with the identifier of the confirmed session.

This website

This website sets no cookies and contains no audience measurement or advertising tools. Like any web server, its host keeps technical logs (IP address, date, page requested).

To display the number of GRH downloads, the home page requests it from GitHub, which then receives the visitor's IP address. This number is kept for ten minutes in the browser (local storage); it contains no personal data.

4. Why we process data

• To provide the service: management of staff, attendance, leave, payroll and documents.
• To manage accounts, subscriptions, the free trial and payments.
• To ensure security: access control, separation between companies, abuse prevention.
• To answer your support requests.

We do not sell or rent your data, we do not use it for advertising and we do not include any advertising tracking tools.

5. Hosting and service providers

Application data is therefore hosted outside Madagascar, in the United Kingdom. It travels encrypted (HTTPS), and each company can only access its own data, according to each account's permissions.

6. Retention period

Data is kept as long as the company's account is active. An archived record remains available for history. A deleted record is deleted together with its attendance, leave, badges and documents; it cannot be deleted while it carries approved payslips. When closing its account, the company can ask us to delete its data, subject to legal retention obligations.

7. Security

• Encrypted exchanges between the application and our servers (HTTPS).
• Role-based access and strict separation between companies, enforced by the database.
• Time clock passwords encrypted by Windows, on the computer only.
• Single-use activation codes, reserved for the company that paid for them.

8. Your rights

In accordance with Malagasy Law No. 2014-038 on the protection of personal data, you have the right to access, rectify, erase and object to the processing of data concerning you. To exercise these rights, write to prestapro913@gmail.com. Employees should first contact their employer, who is responsible for their data. You may also refer the matter to the Malagasy data protection authority.

9. Minors

GRH is a service intended for businesses; it is not directed at children.

10. Changes

We may update this policy to reflect changes in the application or in the law. The date of the last update appears at the top of this page.

11. Contact

GRH · Antananarivo, Madagascar
Email: prestapro913@gmail.com
Phone: +261 34 71 754 06