GRNX LEGAL
Privacy Policy
This Policy explains what personal information GRNX processes during booking and luggage delivery, why it is needed, who receives it, and when it is deleted.
Effective · August 1, 2026
Controller and privacy contact
GRNX complies with Korea's Personal Information Protection Act and other applicable law. GRNX determines the purposes and methods of processing needed to operate the Service and acts as the personal information controller.
| Item | Details |
|---|---|
| Business | GRNX |
| Representative / Privacy Officer | Logan Park |
| Address | 428, Seolleung-ro, Gangnam-gu, Seoul, South Korea |
| hello@grnx.kr |
Information and collection methods
GRNX does not directly collect card numbers, bank account numbers, or other payment-method details used for purchases through Klook or KKday. Please do not place unnecessary sensitive information in special requests or uploaded files.
| Source | Information processed |
|---|---|
| Klook, KKday, or another booking channel | Booking channel, external order number, name, email, phone number, preferred language, service date and window, hotel name, address and room, flight, departure time and terminal, luggage size and quantity, and special requests |
| Booking lookup, edit, and cancellation | Booking number, email, booking access credentials, changed booking fields, cancellation reason, and support messages |
| Files uploaded by customers or service personnel | Optional luggage photos and hotel confirmation, pickup overview, booking-label and airport handover photos, and capture or upload time |
| Website-generated data | IP address, browser and device data, access time, requested URL and booking-page identifiers, security, error and performance logs, and booking access information held in session or local storage |
Purposes of processing
- Verify orders and identity, confirm bookings, and handle edit or cancellation requests
- Coordinate hotel-front-desk pickup, driver assignment, custody history, airport transport, and handover
- Send schedule and status notices, support customers, investigate loss, damage or delay, and respond to disputes
- Prevent abuse, control access, analyze errors, and maintain security and service reliability
- Comply with tax, accounting, consumer protection, and other legal duties and establish or defend legal claims
Retention
GRNX keeps personal information only for the period needed for its purpose and deletes it without undue delay after the period below. Information may be isolated and kept longer if another law requires it or if a dispute or investigation remains open.
| Information or record | Retention period |
|---|---|
| Contract or cancellation records | 5 years after completion or cancellation |
| Payment and service-supply records | 5 years after service completion or cancellation |
| Consumer complaint or dispute records | 3 years after the matter is resolved |
| Luggage, hotel-confirmation, pickup and handover photos | Deleted without undue delay after the Service and verification purpose are complete. Photos tied to an incident or dispute are isolated until resolution and expiry of the applicable legal period |
| Website access and security logs | Kept for the minimum period needed for security review, or longer only where law or an incident investigation requires it |
Disclosure to third parties
GRNX does not normally disclose personal information to a third party without consent. It may disclose the minimum information below when needed to perform an order or where another lawful basis applies.
GRNX may also disclose information within the scope permitted by law in response to a valid warrant or request, or where urgently needed to protect life or physical safety.
| Recipient | Purpose | Information | Retention |
|---|---|---|---|
| Klook or KKday through which the order was placed | Order-status coordination, cancellation or refund support, customer support, and dispute handling | External order number, booking number, service status, and information needed for a cancellation, incident, or support request | Under the recipient's policy and applicable law |
| The hotel or front desk designated by the customer | Confirm the luggage and hand it over to the driver | Booking number, customer name, room, service date and pickup window, luggage quantity, and necessary contact details | Deleted without undue delay after handover and completion of the purpose |
Processors and service providers
GRNX entrusts limited technical or operational work to the providers below. Contracts and access controls are used to prevent unauthorized access and processing outside the stated purpose. This Policy will be updated when a processor changes or is added.
| Processor | Work performed |
|---|---|
| Vercel Inc. | Website hosting, content delivery, and processing of security, error, and performance logs |
| Amazon Web Services (AWS) | Private storage and protection of luggage and verification images in the Seoul Region (ap-northeast-2) |
| Assigned drivers and required service personnel | Hotel pickup, transport, airport handover, status and photo records, and incident response |
Overseas processing
The GRNX website uses the overseas cloud service below. This processing is needed to perform the website service contract, and GRNX uses encrypted transmission and other safeguards appropriate to the processing.
You may contact hello@grnx.kr before using the website if you object to overseas processing. Because it is essential to website delivery, refusal may prevent use of GRNX booking lookup and edit functions; support through the booking channel or email will be explained instead.
| Recipient and country | Information | Time and method | Purpose and retention |
|---|---|---|---|
| Vercel Inc. — primary facilities in the United States and countries where Vercel's published subprocessors operate (privacy@vercel.com) | IP address, browser and device data, access time, requested URL and booking-page identifiers, and security, error and performance logs | Sent over an encrypted network when you access the website | Website hosting, content delivery, security, and incident response; kept for the service-contract period and applicable backup-deletion cycle |
Deletion and security measures
When a retention period ends or the purpose is complete, information is isolated and erased in a manner designed to prevent recovery. Any paper records are shredded or securely destroyed.
- Single-use or expiring booking access credentials and role-based access controls
- Encryption in transit, private file storage, and limited file access through signed paths
- Minimum necessary information shown to personnel, with administrative and custody activity recorded
- Periodic access reviews, security updates, and an incident response process
Your rights and how to exercise them
You may request access, correction, deletion, suspension of processing, or withdrawal of consent for your personal information. Edit information directly where the booking page allows it, or send your booking number and the information needed to verify identity to hello@grnx.kr for other requests.
GRNX will explain the result within the period and in the manner required by law. A request may be restricted where another law requires retention or it would affect another person's rights, and GRNX will explain the reason. An authorized representative may need to provide proof of authority and identity.
Policy changes and remedies
If this Policy changes, GRNX will announce the effective date and material changes on the website in advance. A material change involving collected data, third-party disclosure, or overseas processing will receive any separate notice or consent required by law.
Send privacy questions or complaints to the Privacy Officer. If the issue remains unresolved, you may seek assistance from Korea's Personal Information Protection Commission Privacy Portal, the Personal Information Dispute Mediation Committee, or the KISA Privacy Infringement Report Center.