GRNX LEGAL
Privacy Policy
This Policy explains what personal information GRNX processes during booking and luggage delivery, why it is needed, who receives it, and when it is deleted.
Effective · August 29, 2026
Controller and privacy contact
GRNX complies with Korea's Personal Information Protection Act and other applicable law. GRNX determines the purposes and methods of processing needed to operate the Service and acts as the personal information controller.
| Item | Details |
|---|---|
| Business | GRNX |
| Representative / Privacy Officer | Logan Park |
| Address | 7F, 9-1, Gugal-ro 60beon-gil, Giheung-gu, Yongin-si, South Korea |
| hello@grnx.kr |
Information and collection methods
GRNX does not directly collect card numbers, bank account numbers, or PayPal login credentials. For direct booking, PortOne and PayPal process payment-method data while GRNX retains only payment status, transaction identifiers, amount, and refund records. Do not place unnecessary sensitive information in special requests or uploaded files.
| Source | Information processed |
|---|---|
| Klook, KKday, or another booking channel | Booking channel, external order number, name, email, phone number, preferred language, service date and window, hotel name, address and room, flight, departure time and terminal, luggage size and quantity, and special requests |
| Booking lookup, edit, and cancellation | Booking number, email, booking access credentials, changed booking fields, cancellation reason, and support messages |
| Files uploaded by customers or service personnel | Optional luggage photos and hotel confirmation, pickup overview, booking-label and airport handover photos, and capture or upload time |
| Website-generated data | IP address, browser and device data, access time, requested URL and booking-page identifiers, advertising click identifiers, security, error and performance logs, and booking access information held in session or local storage |
Purposes of processing
- Verify orders and identity, confirm bookings, and handle edit or cancellation requests
- Coordinate hotel-front-desk pickup, custody history, airport transport, and handover
- Send schedule and status notices, support customers, investigate loss, damage or delay, and respond to disputes
- Prevent abuse, control access, analyze errors, and maintain security and service reliability
- Analyze website journeys and measure purchases attributed to Google Ads and campaign performance
- Comply with tax, accounting, consumer protection, and other legal duties and establish or defend legal claims
Retention
GRNX keeps personal information only for the period needed for its purpose and deletes it without undue delay after the period below. Information may be isolated and kept longer if another law requires it or if a dispute or investigation remains open.
| Information or record | Retention period |
|---|---|
| Contract or cancellation records | 5 years after completion or cancellation |
| Payment and service-supply records | 5 years after service completion or cancellation |
| Consumer complaint or dispute records | 3 years after the matter is resolved |
| Luggage, hotel-confirmation, pickup and handover photos | Deleted without undue delay after the Service and verification purpose are complete. Photos tied to an incident or dispute are isolated until resolution and expiry of the applicable legal period |
| Website access and security logs | Kept for the minimum period needed for security review, or longer only where law or an incident investigation requires it |
Website analytics and advertising measurement
Where separate consent is not required by applicable law or Google policy, GRNX enables Google Analytics and its linked Google Ads account by default to process pages visited, access times, approximate region, browser and device information, advertising click identifiers, and general site journeys. For direct-booking checkout, GRNX also processes checkout initiation, payment-method submission and purchase completion together with a browser-generated random transaction identifier, payment value and currency, and luggage type and quantity. GRNX uses this information to attribute purchases to Google Ads and measure campaign performance.
Personalized advertising, remarketing, and Google signals remain disabled. GRNX does not intentionally send booking numbers, contact details, hotel or flight details, or other form contents for analytics or advertising measurement, and the measurement tag is not loaded on secure booking-detail pages whose URL contains a booking identifier.
When advertising measurement is active, GRNX may retain one of gclid, gbraid, or wbraid from a Google ad click URL and limited UTM values in the browser for up to 90 days. When direct checkout starts, GRNX stores them separately with capture time, measurement choice, Privacy Policy version, and a random transaction ID. Only a verified live PortOne PayPal purchase is sent to Google Ads Data Manager with value and currency. Test payments are excluded, and stopping measurement before upload cancels the pending server conversion. After Google reports its final processing result, GRNX promptly erases raw click identifiers and UTM values from its server and retains only a de-identified processing record.
For visitors in the European Economic Area (EEA), United Kingdom, or Switzerland, and when the visitor country cannot be determined, analytics and advertising measurement begin only after the visitor allows them. Visitors elsewhere may stop measurement at any time through ‘Measurement settings’ in the footer. GRNX then removes Google Analytics and Google Ads measurement cookies available to the site and stops future transmission from that browser.
Disclosure to third parties
GRNX does not normally disclose personal information to a third party without consent. It may disclose the minimum information below when needed to perform an order or where another lawful basis applies.
GRNX may also disclose information within the scope permitted by law in response to a valid warrant or request, or where urgently needed to protect life or physical safety.
| Recipient | Purpose | Information | Retention |
|---|---|---|---|
| Klook or KKday through which the order was placed | Order-status coordination, cancellation or refund support, customer support, and dispute handling | External order number, booking number, service status, and information needed for a cancellation, incident, or support request | Under the recipient's policy and applicable law |
| The hotel or front desk designated by the customer | Confirm the luggage and hand it over to the driver | Booking number, customer name, room, service date and pickup window, luggage quantity, and necessary contact details | Deleted without undue delay after handover and completion of the purpose |
Processors and service providers
GRNX entrusts limited technical or operational work to the providers below. Contracts and access controls are used to prevent unauthorized access and processing outside the stated purpose. This Policy will be updated when a processor changes or is added.
| Processor | Work performed |
|---|---|
| Vercel Inc. | Website hosting, content delivery, and processing of security, error, and performance logs |
| Functional Software, Inc. (Sentry) | Error and performance monitoring and incident analysis for customer and staff web surfaces and the backend |
| Amazon Web Services (AWS) | Private storage and protection of luggage and verification images in the Seoul Region (ap-northeast-2) |
| Google LLC (Google Workspace) | Delivery of booking confirmation, reminder, pickup, and airport-delivery emails and attached photos |
| Google LLC (Google Analytics and Google Ads Data Manager) | Website visit statistics, journey analysis, Google Ads purchase attribution, and campaign performance measurement |
| PortOne and PayPal | Direct-booking payment authorization, status verification, cancellation, full refunds, and payment-fraud prevention |
| Assigned drivers and required service personnel | Hotel pickup, transport, airport handover, status and photo records, and incident response |
Overseas processing
GRNX uses the overseas cloud services below to provide the website, booking-status emails, and error and performance monitoring. This processing is needed to perform the Service contract and maintain service reliability and security, and GRNX uses encrypted transmission and other safeguards appropriate to the processing.
You may contact hello@grnx.kr before using the Service if you object to overseas processing. Because it is essential to the website and booking-status notices, refusal may prevent booking lookup or edit functions and email notices.
| Recipient and country | Information | Time and method | Purpose and retention |
|---|---|---|---|
| Vercel Inc. — primary facilities in the United States and countries where Vercel's published subprocessors operate (privacy@vercel.com) | IP address, browser and device data, access time, requested URL and booking-page identifiers, and security, error and performance logs | Sent over an encrypted network when you access the website | Website hosting, content delivery, security, and incident response; kept for the service-contract period and applicable backup-deletion cycle |
| Functional Software, Inc. (Sentry) — the United States or Germany data-storage region selected by GRNX and countries where Sentry's published subprocessors operate | IP address, browser, device and platform information, access time, requested path after query strings and booking numbers are removed, stack traces, and error or performance metadata (excluding request bodies, cookies, authentication data, and user information) | Sent over an encrypted network when an error occurs or a performance trace is sampled | Error detection, analysis, and incident response; processed for the retention period configured for the Sentry project |
| Google LLC — United States and countries where Google Workspace's published subprocessors operate | Customer name and email, booking number, service date, hotel and destination, secure booking link, email content, and attached pickup or airport-delivery photos | Encrypted with TLS when a booking confirmation, previous-day reminder, pickup, or airport-delivery notice is sent | Transactional email delivery, security, and abuse prevention; kept for the Google Workspace contract period and applicable service-deletion cycle |
| Google LLC — United States and countries where Google Analytics and Google Ads subprocessors operate | Online identifiers, IP address, approximate region, browser and device information, advertising click identifiers, access time and ordinary pages visited, random transaction identifiers, purchase value and currency, and luggage type and quantity (excluding secure booking-detail pages and booking numbers, contacts, hotel or flight details, and other form contents) | Sent over an encrypted network when a customer page is accessed or a checkout-funnel event occurs; only after permission in regions requiring consent or when country detection fails | Visit statistics, site improvement, and Google Ads performance measurement; processed for the retention period configured in Google Analytics (currently 14 months), with new transmission stopped after measurement is disabled |
Deletion and security measures
When a retention period ends or the purpose is complete, information is isolated and erased in a manner designed to prevent recovery. Any paper records are shredded or securely destroyed.
- Single-use or expiring booking access credentials and role-based access controls
- Encryption in transit, private file storage, and limited file access through signed paths
- Minimum necessary information shown to personnel, with administrative and custody activity recorded
- Periodic access reviews, security updates, and an incident response process
Your rights and how to exercise them
You may request access, correction, deletion, suspension of processing, or withdrawal of consent for your personal information. Edit information directly where the booking page allows it, or send your booking number and the information needed to verify identity to hello@grnx.kr for other requests.
GRNX will explain the result within the period and in the manner required by law. A request may be restricted where another law requires retention or it would affect another person's rights, and GRNX will explain the reason. An authorized representative may need to provide proof of authority and identity.
Policy changes and remedies
If this Policy changes, GRNX will announce the effective date and material changes on the website in advance. A material change involving collected data, third-party disclosure, or overseas processing will receive any separate notice or consent required by law.
Send privacy questions or complaints to the Privacy Officer. If the issue remains unresolved, you may seek assistance from Korea's Personal Information Protection Commission Privacy Portal, the Personal Information Dispute Mediation Committee, or the KISA Privacy Infringement Report Center.