Privacy Policy

GroundK Co., Ltd. (the "Company") establishes and discloses this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act ("PIPA") in order to protect the personal data of data subjects and to handle related grievances promptly and effectively.

Article 1 (Purposes of Processing)

The Company processes personal data for the purposes below and does not use it for any other purpose. Where the purpose changes, the Company will take the necessary measures, including obtaining separate consent under Article 18 of PIPA.

Purpose	Details
Booking and ticketing	Securing train, bus and ferry seats; requesting dispatch for chauffeur and luggage delivery; booking tour and admission-ticket products; receiving and processing booking requests and acting as booking agent towards Suppliers
Payment and settlement	Payment method authentication, payment authorisation and verification, cancellation and refund processing, fraud checks
Booking notices and confirmation	Notices of booking confirmation, ticket issuance and schedule changes; provision of electronic vouchers and ticket information; identity verification for booking lookup
Customer support	Receiving and handling enquiries and complaints, notifying outcomes, responding to disputes
Service operation and improvement	Prevention of misuse, analysis of access frequency and usage statistics, ensuring service stability
Compliance	Retention of transaction records under the Act on Consumer Protection in Electronic Commerce and other applicable laws

Article 2 (Categories of Personal Data Processed)

The Company has no sign-up procedure and collects only the minimum information required at the time of booking.

1. Information entered directly by the User

Category	Required	Optional
Booker and passenger details	Name (for non-Korean users, the given and family name in Roman letters as shown in the passport), email address, mobile phone number, country	—
Itinerary	Departure and arrival points (station, terminal, port, airport, address), date and time of use, number of passengers and age category (adult, child, infant, senior, etc.)	Seat class, seat preference (window/aisle), luggage quantity, special requests
Chauffeur and luggage delivery	Pick-up and drop-off address and location data, pick-up date and time, airport code, number of passengers, luggage quantity	Vehicle options, other requests
Luggage delivery — routes including accommodation	Accommodation guest name (given and family name), mobile phone number including country code, email address used for the accommodation booking, accommodation booking confirmation file (PDF or image)	—
Luggage delivery — luggage photo	A photo of the luggage to be sent (all items together in one photo)	—
Partner product bookings	Additional information required by the Supplier for the particular product (e.g. date of birth, nationality)	—
Payment information	Payment amount, currency, payment method type, authorisation number and order number, authorisation time, payment status, receipt information	—

Luggage delivery where the drop-off or collection point is accommodation requires the accommodation guest details and the accommodation booking confirmation. The accommodation will not accept or hand over the luggage without verifying the guest with this information. Without it, that route cannot be booked.

A luggage photo is a required item for luggage delivery. After booking, it is registered through the link in the booking email or on the booking details page before the luggage is dropped off, and is used to confirm the pick-up point and to check for damage or loss. If no photo is registered, the service ends and no refund is issued under Article 14 of the Terms of Service.

Where a User enters or submits personal data of someone other than themselves (for example, an accommodation booking confirmation in the name of a travelling companion), the User must obtain that data subject's consent. The Company does not separately extract or use information from submitted files beyond what is needed to perform the booking.

2. Information processed during booking lookup

• Email address, a cryptographic hash of the one-time verification code (the code itself is never stored), the code's expiry time and the number of attempts
• Mobile phone number (used to match the booker for chauffeur and luggage delivery lookups)

3. Information generated automatically during use

• IP address, access time, service usage records, browser and device information, error logs
• Language setting and recently searched departure and arrival points stored in the browser for convenience (see Article 9)

4. Information not collected

The Company does not, as a rule, collect unique identifiers or sensitive data under PIPA, such as resident registration numbers, passport numbers, biometric data, beliefs or health information. Where a Supplier requires separate information as a condition of booking a particular partner product, the Company will disclose the item and purpose in advance and collect it only with separate consent.

Article 3 (Methods of Collection)

1. Direct entry by the User on the booking screen
2. Direct entry by the User during booking lookup
3. Collection during customer support enquiries (email, telephone)
4. Automatic generation and collection during use of the Service (web server logs)

Article 4 (Processing and Retention Periods)

1. The Company processes and retains personal data within the retention period required by law or agreed with the data subject.
2. The retention periods are as follows.

Category	Retention period	Basis
Booking and payment records (booker and passenger details, itinerary, payment history)	5 years	Act on Consumer Protection in Electronic Commerce
Records of contracts or withdrawal of offer	5 years	E-Commerce Act art. 6
Records of payment and supply of goods	5 years	E-Commerce Act art. 6
Records of consumer complaints or dispute handling	3 years	E-Commerce Act art. 6
Records of labelling and advertising	6 months	E-Commerce Act art. 6
Website access logs and IP addresses	3 months	Protection of Communications Secrets Act
One-time verification code (hash) for booking lookup	10 minutes from issuance (discarded immediately on expiry or successful verification)	Purpose fulfilled
Booking lookup session	30 minutes after verification	Purpose fulfilled
Luggage delivery attachments (luggage photo, accommodation booking confirmation) and accommodation guest details	60 days from the service date Uploads for bookings that were not concluded: 24 hours after upload	Checking damage or loss and confirming the luggage handover at the accommodation
Customer enquiry records	3 years	E-Commerce Act art. 6

Personal data whose retention period has expired or whose purpose has been fulfilled is destroyed without delay in accordance with Article 11.

Article 5 (Provision to Third Parties)

1. The Company provides personal data to third parties only where Articles 17 and 18 of PIPA apply, such as with the data subject's consent or under a specific statutory provision.
2. The Service can only be performed by transmitting booking details to the Suppliers that actually provide the transport or travel service, so the provision below is essential to performing the booking. Without consent to this provision, the relevant service cannot be booked.

Recipient	Purpose	Items	Retention period
Korea Railroad Corporation (Korail), SR Corporation (SRT)	Train seat reservation and ticket issuance	Passenger name, number of passengers and age category, route and date/time, seat class	Period under the recipient's passenger transport terms and applicable law
Intercity and express bus operators and booking system providers	Bus seat reservation and ticketing	Booker name, contact details, route and date/time, number of passengers	As above
Ferry operators and ferry booking system providers	Boarding pass reservation and issuance	Booker name, email, mobile phone number, date of use, number and type of passengers	As above
Tour and admission-ticket product suppliers and distribution platforms	Booking confirmation and voucher issuance	Booker name, email, mobile phone number, date of use, number of passengers, product-specific required information	As above
Chauffeur and luggage delivery service operators	Dispatch and performance of transport	Booker and user name, email, mobile phone number, pick-up and drop-off address and location data, pick-up date and time, number of passengers, luggage quantity, requests, and for luggage delivery the luggage photo and, on routes including accommodation, the accommodation guest's name, mobile phone number, email address and accommodation booking confirmation	As above
Payment gateways, card issuers and financial institutions	Payment authorisation and verification, cancellation and refund processing	Order number, payment amount, currency, payment method information, authorisation details	Period prescribed by applicable law

The Company does not provide, sell or lease personal data to third parties for any purpose other than those above.

Article 6 (Outsourcing of Processing)

1. The Company outsources personal data processing as follows in order to provide the Service smoothly.

Processor	Outsourced work	Retention period
NHN KCP Corp., Kakao Pay Corp., Naver Financial Corp., NHN Payco Corp.	Payment processing by credit card, simple payment and bank transfer	Until termination of the outsourcing agreement or the end of the statutory retention period
Eximbay Co., Ltd.	Overseas-issued credit card payment services	As above
PayPal	PayPal payment services	As above
Korea PortOne Inc. (PortOne)	Payment integration, payment lookup and verification, cancellation and refund processing	As above
Alligo Inc.	Sending SMS and KakaoTalk notification messages (informational)	Until termination of the outsourcing agreement
Amazon Web Services, Inc.	Email delivery (Amazon SES) and service infrastructure operation and data storage — Seoul region	Until termination of the outsourcing agreement

2. When entering into an outsourcing agreement, the Company specifies in the contract, in accordance with Article 26 of PIPA, the prohibition on processing personal data beyond the purpose of the outsourced work, technical and administrative safeguards, restrictions on sub-processing, supervision of the processor, and liability including compensation, and supervises whether the processor handles personal data safely.
3. Where the outsourced work or the processor changes, the Company will disclose this through this Privacy Policy without delay.

Article 7 (Cross-Border Transfer)

The Company transfers personal data overseas as follows. Data subjects may refuse the transfer, but in that case use of the relevant payment method or service may be restricted.

Recipient	Country	Time and method	Items	Purpose	Retention period
PayPal, Inc.	United States	Transmitted over the network when the User selects PayPal	Payer identifiers, order number, payment amount and currency	PayPal payment authorisation and refund processing	As per PayPal's privacy policy
International card networks and overseas acquirers	United States and others	Transmitted over the network when the User selects an overseas-issued card	Order number, payment amount and currency, card authorisation details	Authorisation and refund of overseas-issued card payments	As prescribed by applicable law and each operator's policy

The Company does not transfer personal data overseas other than as set out above. Tools used for internal purposes such as operational monitoring receive only non-identifying information such as order numbers.

Article 8 (Rights of Data Subjects and Legal Representatives)

1. Data subjects may at any time request access to their personal data, correction of errors, deletion, or suspension of processing.
2. Requests may be made to the contact in Article 13 in writing, by email or by fax, and the Company will act on them without delay (within 10 days).
3. As the Company does not operate a membership system, identity verification using the email address or mobile phone number entered at the time of booking is required when exercising these rights. This prevents another person's booking information from being improperly accessed, altered or deleted.
4. Where a data subject exercises rights through a legal representative or an authorised agent, a power of attorney in the form prescribed in Annex 11 of the Notice on Personal Information Processing Methods must be submitted.
5. Requests for access, deletion or suspension of processing may be restricted where:
   • a statute requires the personal data to be retained (e.g. 5 years of transaction records under the E-Commerce Act);
   • there is a risk of unfairly harming another person's life, body, property or other interests; or
   • the information has already been transmitted to a Supplier and the booking is in progress, such that deletion would make performance of the transport or travel service impossible.
6. Data subjects must keep their personal data accurate, and are responsible for the consequences of entering inaccurate information.

Article 9 (Automatic Collection Devices and How to Refuse Them)

1. The Company uses cookies and browser storage (localStorage, sessionStorage) to provide tailored services.

Type	Name / purpose	Stored data	Retention
Cookie	Language setting	Selected display language	1 year
Cookie	Administrator login session (staff only)	Signed session value	Until the session ends
localStorage	Convenience	Language setting, recently searched departure and arrival points and routes	Until deleted by the User
localStorage	Mobile payment resume	Booking in progress for mobile payment resume (including booker and accommodation guest details)	Deleted when the payment is approved, or when you return to the same browser from the payment window on mobile (including cancellation or failure). Other records (payment cancelled or declined on PC, or not returned to on mobile) are deleted when you try to pay again in the same browser more than one hour after they were saved; until then they remain until you delete them.
sessionStorage	Booking progress	Selections for the booking in progress (including accommodation guest details for luggage delivery), phone number for booking lookup, access credential from the luggage photo link	Deleted automatically when the browser tab closes

2. The Company does not use third-party tracking cookies for advertising or behavioural profiling.
3. Users may refuse cookie storage or delete stored cookies and browser storage through their browser settings.
   • Chrome: Settings → Privacy and security → Third-party cookies / Delete browsing data
   • Safari: Preferences → Privacy → Manage Website Data
   • Edge: Settings → Cookies and site permissions
4. Refusing cookies may restrict some functions, such as retaining your language setting and booking progress.

Article 10 (Processing of Personal Location Data)

The Company is registered as a location-based service provider (registration no. 12221) under the Act on the Protection and Use of Location Information (the "Location Information Act") and processes personal location data as follows.

1. Purpose
   • Determining pick-up and drop-off points, requesting dispatch and performing transport for chauffeur and luggage delivery services
   • Searching departure and arrival points and guiding nearby pick-up and drop-off points
2. Items — the pick-up and drop-off address entered or selected by the User and the coordinates (latitude and longitude) of that point, and point codes such as airport, station and terminal codes
3. Provision to third parties — provided to the relevant service provider under Article 5 to the extent necessary for dispatch and performance of transport. The Company does not use personal location data beyond the disclosed purpose or provide it to third parties otherwise, and immediately notifies the User of the recipient, the time and the purpose of provision.
4. Retention — retained for the period necessary for performing the booking and handling disputes. However, under Article 16(2) of the Location Information Act, records confirming the collection, use and provision of personal location data are automatically logged in the location information system and retained for at least 6 months.
5. User rights — Users may exercise the following rights by contacting the address in Article 13.
   • Withdraw consent, in whole or in part, to the collection, use and provision of personal location data
   • Request temporary suspension of the collection, use and provision of personal location data
   • Request access to or notification of the records confirming collection, use and provision
   • The Company does not refuse such requests and maintains the technical means to satisfy them. Where consent is withdrawn, the Company destroys the relevant personal location data and confirmation records without delay.
   • However, withdrawal of consent or a suspension request will restrict use of services for which location data is essential, such as chauffeur and luggage delivery.
6. Protection of children aged 8 or under — where a guardian consents to the processing of personal location data in order to protect the life or body of a child aged 8 or under, a person under adult guardianship, or a person with a severe disability under the Act on Welfare of Persons with Disabilities, such consent is deemed to be the consent of the person concerned. The guardian must submit documentation evidencing their status.
7. Location information manager — the personal information protection officer designated in Article 13 also serves in this role.

Article 11 (Destruction of Personal Data)

1. Where personal data becomes unnecessary — because the retention period has expired or the purpose has been fulfilled — the Company destroys it without delay.
2. Where personal data must continue to be preserved under another statute even after the agreed retention period has expired or the purpose has been fulfilled, the Company preserves it in a separate database or storage location.
3. The procedure and method of destruction are as follows.
   • Procedure: the Company identifies the personal data for which grounds for destruction have arisen and destroys it with the approval of the personal information protection officer.
   • Method: electronic files are deleted using technical means that make recovery impossible; paper documents are shredded or incinerated.

Article 12 (Security Measures)

The Company implements the following measures under Article 29 of PIPA.

1. Administrative measures
   • Designating the minimum number of personnel handling personal data and providing them with regular training
   • Establishing and implementing an internal management plan
2. Technical measures
   • Differentiated access rights to and access control over the personal data processing system
   • Password authentication and signature-verified session management for administrator pages
   • Storing booking lookup verification codes only as cryptographic hashes, never in plaintext, with a validity window (10 minutes) and attempt limit (5) to block brute-force attacks
   • Encryption in transit (HTTPS/TLS)
   • No collection of payment credentials (card numbers, etc.) — payment processing is delegated to payment gateways
   • Verifying payment results by querying the payment gateway's servers directly rather than trusting the User's device, to block tampering
   • Retention of access logs and prevention of tampering
3. Physical measures — access control to systems where personal data is stored and to the premises

Article 13 (Personal Information Protection Officer)

The Company designates the following officer to take overall responsibility for personal data processing and to handle data subjects' complaints and remedies.

Position	Representative Director
Name	Dongwon Jang
Telephone	+82-2-863-3540
Email	ops@groundk.com

The above officer also serves as the location information manager (Article 10(7)).

For booking-related enquiries such as cancellation and refunds, please contact +82-2-863-3541 (Mon–Fri 09:00–18:00 KST) or ops@rideus.net.

Data subjects may direct all enquiries, complaints and remedy requests relating to personal data protection arising from use of the Service to the personal information protection officer, and the Company will respond and act without delay.

Article 14 (Remedies for Infringement of Rights)

Data subjects may apply for dispute resolution or counselling to the following bodies in order to obtain remedies for infringement of personal data rights.

Body	Telephone	Website
Personal Information Dispute Mediation Committee	+82-1833-6972	www.kopico.go.kr
Privacy Infringement Report Centre (KISA)	118 (within Korea)	privacy.kisa.or.kr
ePrivacy Certification Committee	+82-2-550-9531~2	eprivacy.or.kr
Supreme Prosecutors' Office, Cyber Investigation Division	1301 (within Korea)	www.spo.go.kr
National Police Agency, Cyber Bureau	182 (within Korea)	ecrm.police.go.kr

In addition, a person whose rights or interests are infringed by a disposition or omission of the head of a public institution in response to a request under Articles 35 (access), 36 (correction and deletion) or 37 (suspension of processing) of PIPA may file an administrative appeal under the Administrative Appeals Act.

Article 15 (Personal Data of Children Under 14)

1. When collecting personal data of children under 14, the Company obtains the consent of their legal representative and may collect minimal information such as the legal representative's name and contact details in order to verify that consent.
2. For bookings that include child or infant passengers, the Booker (an adult) is deemed to be the child's legal representative or to have obtained the legal representative's consent, and bears responsibility accordingly.

Article 16 (Changes to This Policy)

1. This Privacy Policy applies from 1 January 2026.
2. Where content is added, deleted or amended due to changes in law, policy or security technology, the Company will give notice through the announcements section of the Service at least 7 days before the change takes effect, or at least 30 days before where the change materially affects data subjects' rights.
3. Revision history: 18 September 2026 — added accommodation guest details, accommodation booking confirmations and luggage photos for luggage delivery, their retention periods and the items provided to third parties (effective from the revision date).

Business Information

Company name	GroundK Co., Ltd.
Representative director	Dongwon Jang
Business registration no.	238-81-00429
E-commerce registration no.	2018-Seoul Gangseo-1293
Location-based service registration no.	12221
Address	Room 405, 45 Centum dong-ro, Haeundae-gu, Busan, Republic of Korea
Main line	+82-2-863-3540
Email	ops@groundk.com