Privacy Policy

Last update 2 June 2026

1. Scope and Who We Are

This Privacy Policy explains how Phoenix Software Inc. (“Phoenix”, “we”, “us” or “our”) collects, uses, shares, stores and protects personal data through our public websites, hosted payroll and human-resources services, Phoenix Portal, GPHC Mobile when provided by Phoenix, and any other Phoenix application or service that links to this Policy (collectively, the “Platform”).

If you use the Platform because your employer provides it to you, start with Section 2. Your employer decides what information is held about you and why, and most questions about your own records should go to your employer first. Your employer may also give you its own privacy notice, which applies alongside this one.

Phoenix Software Inc. is located at 73 Hadfield Street, Stabroek, Georgetown, Guyana. Phoenix Portal and GPHC Mobile are workplace mobile applications (the “Apps”, and each an “App”), not consumer social networks. This Policy should be read together with our Terms of Use.

Phoenix is established in Guyana and this Policy is governed by the laws of Guyana, including data protection legislation in force from time to time. Where Phoenix has agreed additional requirements with a Customer in writing, those requirements also apply. This Policy does not govern an employer’s own privacy practices, or a third-party website, application or service that Phoenix does not control.

This Policy applies from the date shown above and does not apply retroactively to information collected before that date, except where Phoenix has notified you otherwise.

2. Customer and Phoenix Roles

An employer, public body, business or other organization using the Platform is a “Customer”. An employee, officer, contractor, manager, administrator or other person permitted to use a Customer account is an “Authorized User”.

For payroll, employment and workforce records, the Customer decides why the data is processed, which records are entered, who may access them, how long they are kept, and what employment action follows. The Customer is the data controller for those records. Phoenix processes them as data processor, to provide the Platform under the Customer’s instructions and agreement.

This has a practical consequence. Phoenix has no independent relationship with an Authorized User and cannot disclose, correct or delete an employment record without the Customer’s instruction. If you want to see, correct or remove something in your payroll, leave, appraisal or personnel record, contact your Customer’s human-resources, payroll or Platform administrator. Phoenix will assist the Customer, not act around it.

Phoenix is the data controller for the limited information it needs to run its own business and protect the Platform, such as website inquiries, account security records, support communications, service logs and product diagnostics.

Where Phoenix provides an application for a single Customer, such as GPHC Mobile, Phoenix acts on that Customer’s instructions in the same way.

3. Information We Collect

Account and identity information. Names, work or personal email addresses, employee or badge identifiers, date of birth, department, job title, profile photograph, account roles, and authentication or verification information.

Payroll, HR and workforce information. Depending on the modules a Customer enables: compensation and payslip information, bank account details used to pay salaries, national identification and taxpayer identification numbers, National Insurance Scheme numbers, deductions and statutory payroll information, leave and time-off records, attendance information, appraisal and peer-review information, job-letter requests, workflow approvals, personal documents and other employment records supplied or approved by the Customer or Authorized User.

Sensitive information. Some of this information may be sensitive, most commonly a medical certificate or similar document supporting a leave request. Phoenix does not decide to collect this information and does not use it for any purpose of its own. It is entered by the Customer or Authorized User, held as part of the relevant record, and processed only on the Customer’s instructions, with the same access controls as other workforce data.

Content you provide. Information you enter, upload or submit, such as registration details, profile photos, supporting documents, leave requests, appraisal responses, acknowledgements, and messages to Phoenix support. When you contact us, we may retain your contact details and the content of the communication.

Device, application and network information. Internet protocol address, browser type, operating system and version, device type, app version, build number, package identifier, a device or vendor identifier supplied by the operating system, a Phoenix-generated per-install identifier, sign-in dates and times, requested endpoints, response codes and related security or service logs.

Push-notification information. If notifications are enabled, the App obtains a device token from Firebase Cloud Messaging (Google’s notification-delivery service) and associates it with the account and device identifier so that Phoenix can deliver service and workflow notifications.

Crash and diagnostic information. Release versions of the App use Firebase Crashlytics (Google’s crash-reporting service). When the App crashes or hits a serious error, Crashlytics may receive an installation identifier, crash or exception stack trace, timestamp, app version, operating-system details, device model and technical application state needed to identify and correct the problem. Phoenix does not use Google Analytics or any other analytics service, advertising SDKs or targeted-advertising trackers on its websites or in the current Apps.

Information from Customers and other users. Customers, administrators and authorized workflow participants may provide or generate information about another Authorized User, including employment records, assigned permissions, requests, approvals, comments and appraisal information.

4. Mobile Permissions and Device Features

The App requests access only when a related feature needs it or the operating system requires permission. Depending on the device, App and enabled features:

  • Camera: used when you choose to take a profile photo or photograph a supporting document.
  • Photos and files: used when you choose a profile image or supporting document to upload.
  • Notifications: used to deliver account, security, workflow and service updates.
  • Biometric authentication: used to unlock an existing local session after you enable the feature. The comparison is performed by the device operating system. Phoenix does not receive or store a fingerprint, facial image or biometric template.

Current versions of Phoenix Portal and GPHC Mobile do not request access to precise location, contacts or the microphone. You can grant or revoke permissions in device settings, although disabling a permission may prevent the related feature from working.

5. How We Use Information

Phoenix uses personal data as reasonably necessary to:

  • register, authenticate, secure and administer accounts and devices;
  • provide payroll, HR, leave, appraisal, document and other Platform features, and process the requests, approvals and instructions you or the Customer submit;
  • communicate with you, including push notifications, service email and support;
  • monitor, maintain and improve the Platform, including investigating crashes and compatibility issues;
  • detect, prevent and investigate fraud, misuse, unauthorized access and security incidents; and
  • maintain audit and compliance records, meet legal obligations, enforce agreements, and protect the rights, safety and property of Phoenix, Customers and others.

Depending on the context, this processing is performed to provide contracted services, follow the Customer’s lawful instructions, comply with legal obligations, protect legitimate operational and security interests, or act with consent where consent is required.

Automated calculation. The Platform calculates payroll, leave balances and statutory deductions from inputs supplied or approved by the Customer. The Customer reviews and approves those results before payments are made or statutory returns are filed. Phoenix does not make automated decisions about an Authorized User that have legal or similarly significant effects, and employment decisions taken using Platform information are made by the Customer.

What Phoenix does not do. Phoenix does not sell or rent personal data, does not use Customer workforce data for advertising, and does not use it to train machine-learning or artificial-intelligence models or make it available to any third party for that purpose.

6. When We Share Information

Phoenix discloses personal data only as reasonably necessary:

  • To the Customer and Authorized Users: according to roles, permissions and workflows configured by the Customer. For example, an approver may see the information needed to review a leave request.
  • To Phoenix personnel and contractors: where they require access to operate, secure or support the Platform, and are subject to confidentiality obligations.
  • To service providers: for infrastructure hosting, email and push delivery, crash diagnostics and other technical services described in Section 7.
  • At your direction: when you choose to export, download or share content with a destination you select.
  • For legal and safety reasons: where reasonably necessary to comply with law or lawful process, protect rights and safety, investigate misuse, or establish, exercise or defend legal claims.

Where Phoenix is compelled by law to disclose Customer data, Phoenix will notify the affected Customer unless prohibited from doing so.

7. Service Providers and International Processing

Phoenix engages the following service providers to process personal data on its behalf:

  • Amazon Web Services, Inc. Hosting of application and database infrastructure, and document storage where the relevant module is enabled. Hosted in the US East (N. Virginia) Region.
  • Twilio SendGrid, Inc. Delivery of transactional and service email, such as account, workflow and billing notifications.
  • Google LLC (Firebase). Firebase Cloud Messaging for push delivery and Firebase Crashlytics for crash diagnostics in the Apps.

Apple or Google may also process device, store and notification-delivery information when you obtain or use an App through their platforms.

This means personal data is processed outside Guyana, principally in the United States. Phoenix requires these providers to protect personal data consistently with this Policy and their contractual obligations, does not permit them to use Customer workforce data for their own purposes, and remains responsible for their acts and omissions in performing Phoenix’s obligations. Phoenix will give affected Customers at least 30 days’ notice before adding or replacing a service provider that processes personal data on its behalf.

Provider practices are described in the AWS Privacy Notice, Twilio Privacy Notice, Firebase Privacy and Security information, Apple Privacy Policy and Google Privacy Policy. Phoenix is not responsible for the privacy practices of a third-party site or service you reach from a link.

8. Data Retention

Phoenix keeps personal data only for as long as reasonably necessary for the purposes in this Policy, the Customer Agreement, the Customer’s lawful instructions, security, dispute resolution, and applicable payroll, employment, tax and audit requirements. Payroll and employment records are commonly subject to multi-year statutory retention periods, and the Customer decides how long its records must be kept.

Where a Customer Agreement ends, Phoenix deletes that Customer’s data from its live systems within 60 days of termination, unless the Customer Agreement or applicable law requires otherwise. Security and support records are kept for a limited period appropriate to their purpose. Backups are overwritten or deleted on a scheduled cycle, so a deleted item may remain in a protected backup until that cycle completes.

Google applies its own retention periods to Firebase data. Firebase currently states that Crashlytics retains crash stack traces and associated installation identifiers for 90 days before beginning removal from live and backup systems.

Phoenix may retain limited information after a deletion request where necessary for security, fraud prevention, compliance with law, the establishment or defence of legal claims, or enforcement of agreements. Where possible, information that no longer requires identification is aggregated or de-identified.

9. Account Deletion

Delete from the App. A signed-in Phoenix Portal or GPHC Mobile user can initiate permanent app-account deletion from Account → Security → Delete account. The App requires the current password and two confirmations before submitting the request, then signs the user out.

Request deletion from the web. If you cannot access the App, email support@phoenixsoftgy.com with the subject “Phoenix Portal account deletion”. Include the account email address, the employer name, and enough information for Phoenix to locate and verify the account. Never send your password or a security code by email.

Web application accounts. Access to the Phoenix web application is set up and managed by your Customer. To have a web account removed, contact your Customer’s Platform administrator. If you cannot reach them, email Phoenix at the address above and we will work with the Customer to action the request.

Phoenix aims to acknowledge a deletion request within 5 business days and to complete it within 30 days of verification. Phoenix will delete or de-identify the app account and the associated personal data it is responsible for, except information retained for a reason described in Section 8. Disabling or freezing an account is not treated as completing a deletion request.

Deleting an app account does not erase your employment records. Payroll, tax, appraisal, leave and audit records controlled by your employer are separate from the app account and may need to be kept by the employer or by Phoenix on the employer’s instructions or under law. Contact your employer’s human-resources or payroll administrator about those records. Uninstalling the App, signing out, or revoking a device permission does not submit a deletion request or delete server records.

10. Your Privacy Choices and Requests

You may ask Phoenix for access to, correction of, export of or deletion of personal data, or object to or ask us to restrict certain processing. Phoenix may need to verify your identity. Where the request concerns workforce records, Phoenix will pass it to the Customer that controls them, and tell you that it has done so.

Phoenix aims to acknowledge a request within 5 business days and respond substantively within 30 days. If a request is complex, or Phoenix must consult the relevant Customer, Phoenix will tell you and give an expected timeframe. There is no charge for a reasonable request.

You may disable notifications, camera, photo-library and biometric permissions through the App or device settings. Where processing relies on consent, you may withdraw it, although withdrawal does not affect processing already carried out lawfully and may make the related feature unavailable. Service and security communications are part of operating the Platform and may not offer an unsubscribe option while an account remains active.

If you are not satisfied with how Phoenix has handled a request or complaint, write to the contact address in Section 14 and it will be reviewed by a senior member of the Phoenix team.

11. Security

Phoenix maintains administrative, technical and organizational safeguards designed to protect personal data, covering encryption, access control, network and infrastructure security, and the separation of each Customer’s records from another’s. Phoenix personnel and contractors with access to personal data are bound by confidentiality obligations. Details of these measures are set out in our Security page, which forms part of this Policy.

Security incidents. Where Phoenix becomes aware of a breach of security leading to the accidental or unlawful destruction, loss, alteration or unauthorized disclosure of Customer data, Phoenix will notify the affected Customer without undue delay and in any event within 72 hours, describing what is known of the incident, the remedial action being taken and the expected timeline. Because the Customer controls the records concerned, the Customer is normally responsible for notifying its Authorized Users and any regulator, and Phoenix will assist. Where an incident arises from a Customer’s own systems, credentials, personnel or contractors, the Customer is responsible for remediation and should notify Phoenix promptly so we can help contain it.

Protecting your account. Phoenix will never ask you for your password, a one-time code or your full bank details by email, telephone or message. Treat any such request as fraudulent and report it. Use a password you do not use anywhere else, enable device security, sign out of shared devices, and tell your Platform administrator and Phoenix immediately if you think your account has been accessed by someone else.

No internet transmission or storage system can be guaranteed completely secure.

12. Cookies, Local Storage and Caches

Phoenix websites and hosted web applications use essential cookies or similar storage for authentication, security, traffic management and user preferences. Phoenix does not use advertising or tracking cookies on the Platform.

The Apps use protected device storage for the authentication token, and ordinary local storage for settings such as the remembered email choice, theme, biometric preference and display preferences. They may temporarily cache images and documents to display requested content. Signing out clears the active session; uninstalling or clearing app storage removes local information but does not delete server data.

Browser controls can block or delete cookies, and device settings can clear App storage. Disabling necessary storage may prevent sign-in or other features from working.

13. Changes to This Policy

Phoenix may update this Policy to reflect changes to the Platform, our data practices, our service providers or applicable requirements. The revised Policy will be posted here with an updated date. For a material change, Phoenix will give additional notice through the Platform, by email, or through the Customer, where appropriate or legally required.

Where a Customer Agreement is in force, no update to this Policy will reduce the protections Phoenix has committed to that Customer for the term of that agreement.

14. Contact Information

For privacy questions, requests or complaints, contact:

To help us respond, tell us which service you use and which employer or organization is involved. Do not send passwords, verification codes, payroll documents or identity documents by ordinary email unless Phoenix has given you a secure method.