개인정보처리방침Privacy Policy

GroundK Co., Ltd. (the "Company") establishes and publishes this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea, in order to protect the personal data of data subjects and to handle related complaints promptly.

1. Purposes of processing

The Company processes personal data for the purposes below and does not use it for any other purpose. Where the purpose changes, the Company takes the necessary steps, including obtaining separate consent under Article 18 of the Act.

2. Data we process

The Service has no membership registration, and the Company collects only the minimum needed at the time of booking.

2.1 Information you enter

2.2 Data processed when you retrieve a booking

• E-mail address and mobile number (checked against the booking to verify identity)
• One-time verification code, its expiry time and the number of attempts — held in server memory only and never written to disk. It is discarded as soon as it expires (10 minutes) or is used successfully.
• An access token issued after successful verification (valid 60 minutes). Immediately after completing a booking, a separate token limited to that one booking is issued instead (valid 30 minutes).

2.3 Data generated automatically

• IP address, access time, requested path and error logs (web server logs)
• The details of a booking in progress and the display language — stored only in your browser (see section 9).

2.4 What we do not collect

The Company does not collect resident registration numbers, passport numbers, dates of birth, biometric data, beliefs, health data or any other unique identifier or sensitive data under the Personal Information Protection Act. As there is no sign-up or log-in, no password is collected either.

3. How we collect it

1. Entered by the user on the booking screens
2. Entered by the user when retrieving a booking
3. Collected through customer support enquiries (e-mail, telephone)
4. Generated automatically while the Service is used (web server logs)

4. Retention periods

1. The Company processes and retains personal data within the period required by law or agreed with the data subject.
2. Retention periods are as follows.

Personal data is destroyed without delay under section 11 once the retention period ends or the purpose is fulfilled.

5. Disclosure to third parties

1. The Company discloses personal data to third parties only where Articles 17 and 18 of the Personal Information Protection Act allow it, including with the data subject's consent.
2. The service can only be performed by passing booking details to the supplier that actually carries the passenger or the baggage, so the disclosures below are essential to fulfil the booking. Without this disclosure the booking cannot be made.

The Company does not disclose, sell or lend personal data for any other purpose. No personal data of bookers is passed to the conference organising committee.

6. Processors

1. The Company entrusts the following processing in order to run the Service.

2. When entering into such contracts, the Company sets out in writing — as required by Article 26 of the Act — the prohibition on processing beyond the entrusted purpose, technical and administrative safeguards, restrictions on sub-processing, supervision of the processor and liability for damages, and supervises the processor's handling of the data.
3. Any change to the entrusted work or to a processor is published in this policy without delay.

7. Overseas transfers

The Company transfers personal data overseas as set out below. You may refuse the transfer, but the relevant payment method will then be unavailable.

Apart from the above, the Company does not transfer personal data overseas. The Service's infrastructure and e-mail delivery run in the Amazon Web Services Seoul region and the data is held in Korea.

8. Rights of data subjects and legal representatives

1. You may at any time ask the Company to give access to your personal data, to correct errors in it, to delete it or to suspend its processing.
2. Requests may be made by e-mail or telephone using the contact details in section 13, and the Company acts on them without delay (within 10 days).
3. Because the Service has no membership, exercising these rights requires verification through the e-mail address or mobile number used for the booking. This prevents another person's booking from being accessed, altered or cancelled improperly.
4. Where a right is exercised through a legal representative or an authorised agent, a power of attorney in the form prescribed in the Public Notice on Personal Information Processing Methods must be submitted.
5. Access, deletion or suspension may be restricted where:
   • a law requires the data to be retained (for example, 5 years of transaction records under the e-commerce Act);
   • it would unfairly harm the life, body, property or other interests of another person;
   • the data has already been passed to a supplier for a booking in progress and deleting it would make the carriage or delivery impossible.
6. Data subjects must keep their data accurate and are responsible for the consequences of entering inaccurate information.

9. Cookies and browser storage

1. The Company does not use cookies for advertising or behavioural profiling and installs no third-party tracking tools. The state of a booking in progress and the display language are kept only in your browser's sessionStorage and are not sent to the server.

2. You can delete browser storage or refuse it in your browser settings:
   • Chrome: Settings → Privacy and security → Delete browsing data
   • Safari: Preferences → Privacy → Manage Website Data
   • Edge: Settings → Cookies and site permissions
3. If you refuse it, details entered during a booking will not be kept and parts of the Service may not work.

10. Location data

The Company is registered as a location-based service provider (registration no. 12221) under the Act on the Protection and Use of Location Information, and processes personal location data as follows.

1. Purposes
   • Fixing pick-up and drop-off points for the chauffeur and baggage services, requesting dispatch and performing the carriage
   • Searching departure and arrival points and showing nearby pick-up points
2. Data processed — the address and coordinates (latitude and longitude) of pick-up and drop-off points you enter or select, and point codes for airports, stations and hotels. The Company does not collect the real-time location of your device.
3. Disclosure — disclosed to the relevant supplier under section 5 only so far as needed for dispatch and carriage. The Company does not use personal location data beyond the notified purpose or disclose it otherwise, and notifies you immediately of the recipient, the time and the purpose when it is disclosed.
4. Retention — kept for as long as needed to perform the booking and handle disputes. Under Article 16(2) of that Act, records confirming the collection, use and disclosure of personal location data are logged automatically and kept for at least 6 months.
5. Your rights — you may exercise the following by contacting the details in section 13:
   • withdraw consent to the collection, use or disclosure of personal location data, in whole or in part;
   • request temporary suspension of collection, use or disclosure;
   • request access to or notification of the confirmation records described above;
   • the Company does not refuse such requests and maintains the technical means to meet them. Where consent is withdrawn, the Company destroys the location data and the related records without delay.
   • However, withdrawing consent or requesting suspension means the chauffeur and baggage services, which depend on location data, cannot be used.
6. Children aged 8 or under — where a guardian consents to the processing of personal location data to protect the life or body of a child aged 8 or under, a person under adult guardianship or a person with a severe disability under the Act on Welfare of Persons with Disabilities, that consent is deemed to be the consent of the individual. The guardian must submit written proof of that status.
7. Location data manager — the data protection officer named in section 13 also acts as location data manager.

11. Destruction of data

1. The Company destroys personal data without delay once the retention period ends, the purpose is fulfilled or the data otherwise becomes unnecessary.
2. Where data must nevertheless be retained under another law, it is moved to a separate database or kept in a different storage location.
3. Destruction procedure and method:
   • Procedure — the data due for destruction is identified and destroyed with the approval of the data protection officer.
   • Method — electronic files are deleted by technical means that prevent recovery; paper documents are shredded or incinerated.

12. Security measures

Under Article 29 of the Personal Information Protection Act, the Company applies the following safeguards.

1. Administrative
   • Keeping the number of staff handling personal data to a minimum and training them regularly
   • Establishing and implementing an internal management plan
2. Technical
   • Differentiated access rights and access control for systems processing personal data
   • Verification codes and access tokens for booking retrieval are held in server memory only and never written to disk, with a 10-minute lifetime and a 5-attempt limit to block brute-force attacks
   • Encryption in transit (HTTPS/TLS)
   • No collection of payment credentials such as card numbers — payment processing is entrusted to the payment gateway
   • Payment results are verified by querying the payment gateway's server directly rather than trusting the user's device, preventing tampering
   • Secrets used to authenticate with supplier systems are kept on the server and never sent to the browser
   • Retention of access logs and protection against tampering
3. Physical — access control to the systems and premises where personal data is held

13. Data protection officer

The Company has designated the following data protection officer, who takes overall responsibility for personal data processing and for handling complaints and remedies.

The data protection officer also acts as location data manager (section 10.7).

For booking, cancellation and refund enquiries, please contact transport@aphrs2026.com (Mon–Fri 09:00–18:00 KST).

14. Remedies

You may apply to the following bodies for dispute resolution or advice about an infringement of your personal data.

A person whose rights or interests are infringed by a disposition or omission of the head of a public authority in response to a request under Articles 35, 36 or 37 of the Personal Information Protection Act may also file an administrative appeal under the Administrative Appeals Act.

15. Children under 14

1. Where the Company collects the personal data of a child under 14, it obtains the consent of a legal representative and may collect the representative's name and contact details to confirm that consent.
2. Where a booking includes a minor, the adult booker is treated as the child's legal representative or as having that representative's consent, and bears responsibility accordingly.

16. Changes to this policy

1. This policy applies from 22 August 2026.
2. Where content is added, removed or amended because of a change in law, policy or security technology, the Company gives notice on the Service at least 7 days before the change takes effect, or at least 30 days before where the change materially affects the rights of data subjects.
3. As this is the first version, there is no earlier history.

Company information

Effective 22 August 2026 · Last revised 22 August 2026 · The Korean text is the original; in the event of any discrepancy in interpretation, the Korean original prevails.