Privacy Policy

Enjoyworks Co., Ltd. (service name 'VietSpots'; the 'Company') establishes and discloses the following Privacy Policy in accordance with applicable laws in order to protect users' personal information and to promptly and smoothly handle related grievances.

Article 1 (Items of Personal Information Processed)

The Company collects the minimum personal information necessary to provide the Service.

• Required items: Email, password (stored encrypted)
• Optional items: Nickname, phone, chat content with merchants, delivery and pickup addresses (accommodation name and detailed address)
• When using overseas purchasing-agency/delivery: recipient's name and contact, delivery address, and Personal Customs Clearance Code (PCCC). Of these, the PCCC and contact are stored encrypted.
• When making payments: payment/settlement records and payment-result information. Detailed payment-instrument data such as card numbers is handled by the payment gateway; the Company retains only minimal information such as the payment result, approval number, and transaction identifier.
• Automatically collected items: IP, device information, access logs, push tokens (when using the mobile app, including the device unique identifier (advertising identifiers such as ADID/IDFA), OS version, and model name), cookie and local-storage identifiers, browser type, language and screen settings, pages visited and time spent, referral source (referrer and ad-click identifiers), and app installation and first-launch records

Article 2 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed is not used for any purpose other than the following, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent.

• Member identification, login, coupon claiming, and reservation brokerage (including delivery, massage, shopping, restaurant, motorbike rental, barbershop, and laundry services, and the provision of app push notifications)
• Handling 1:1 inquiries with merchants, and operating local open chat and community services (including real-time translation features)
• Processing online payments, verifying payments, and preventing fraudulent payments
• Purchasing overseas purchasing-agency goods, export/import customs clearance, international shipping, and status updates
• Analysis of service usage statistics and improvement — analysis of visit and usage statistics, identification of errors, and feature improvement
• Advertising performance measurement and personalized advertising — identifying visit, installation and conversion paths from advertisements, measuring advertising campaign performance, and providing advertisements tailored to users' interests. Details are set out in Article 10.
• (Optional) Sending advertising information: emailing marketing information such as new coupons, events and travel tips. This purpose is processed only for members who gave separate consent, and declining does not limit your use of the service. You may withdraw consent anytime in My Page > Notification settings or via the unsubscribe link in any email.
• Prevention of acts violating laws and the Terms
• Responding to customer inquiries

Article 3 (Retention Period)

Personal data is destroyed without delay upon withdrawal. However, in accordance with applicable laws, the following information is retained for the periods below.

• Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on payment and the supply of goods, etc.: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on consumer complaints or dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce)
• Records related to import customs clearance and overseas purchasing-agency transactions (name, Personal Customs Clearance Code (PCCC), etc.): 5 years (Customs Act)
• Cookies and behavioral information: 25 months from the date of collection (Article 10)

Destruction procedure and method: The Company selects personal data for which grounds for destruction have arisen and destroys it with the approval of the Privacy Officer. Personal data stored in electronic file form is permanently deleted using technical methods that make the records unrecoverable, and personal data recorded/printed on paper documents is destroyed by shredding or incineration.

Article 4 (Provision to and Entrustment of Third Parties)

The Company does not provide personal information to third parties without the user's consent. Only the minimum information necessary to proceed with a merchant reservation (nickname/time/number of people) is delivered to the merchant, and for delivery and laundry services, the delivery/pickup address is included.

• Recipient of personal information: The local Vietnamese partner merchant for which the member applied to reserve/use the service (delivery companies, massage shops, shopping merchants, restaurants, motorbike rental shops, barbershops, laundries)
• Purpose of use by the recipient: Confirming delivery addresses and delivering goods, collecting and returning laundry, confirming reservations and concluding rental agreements, and performing local services
• Retention and use period of the recipient: Until the relevant local service is provided and settlement is completed

However, to the extent necessary for service operation, analytics and advertising performance measurement, the Company entrusts processing to the entrustees listed in Article 8. Matters regarding the entrustment of personal-information processing and cross-border transfer are set out in Article 8.

Article 5 (PII Masking)

Phone numbers, emails, and external messenger IDs in chat messages are automatically masked on the server, and only the masked version is provided to merchants.

Article 6 (User Rights)

Users may at any time request to view, correct, delete, or suspend the processing of their personal information. Please submit requests through the settings screen or by contacting the operations team.

Members using the mobile app may refuse the provision of location information and the collection of the smartphone advertising identifier (ADID/IDFA) at any time through the operating system (OS) settings menu of the mobile device.

Members using a web browser may refuse the storage of cookies through their browser settings; the specific methods are described in Article 10.

Article 7 (Personal Information Protection Officer)

The Company takes overall responsibility for the handling of personal information and, for the handling of user complaints and remedy of damages, designates a Personal Information Protection Officer as follows.

• Department responsible for personal information protection: VietSpots Operations Team
• Position: Personal Information Protection Officer
• Email: younggonnim@enjoyworks.co.kr
• Phone: +82-2-6224-3125
• Company name: Enjoyworks Co., Ltd. (Business registration number: 209-81-62091)
• Address: 3F, Building 2, 239-1 Neungdong-ro, Gwangjin-gu, Seoul, 04998, Korea

Article 8 (Entrustment of Personal Information Processing and Cross-Border Transfer)

For the smooth provision of the Service, the Company entrusts personal-information processing tasks as set out below, and owing to the nature of the Service, some personal information is transferred overseas.

• Payment agency (processing entrustment): PortOne (KG Inicis), PayPal — online payment processing, payment verification, and prevention of fraudulent payments. Retention/use period: the retention period required by applicable laws, or until termination of the entrustment agreement.
• Analytics, Authentication & Advertising Measurement (processing entrustment; cross-border transfer to the USA): Google LLC — usage-statistics analysis and service improvement via Google Analytics, social (Google/Apple)/email login authentication via Firebase Authentication, measurement-tag management via Google Tag Manager, and advertising conversion measurement and building remarketing audience lists via Google Ads. Retention/use period: until membership withdrawal or termination of the entrustment agreement.
• Advertising Performance Measurement (processing entrustment; cross-border transfer to Ireland and the USA): Meta Platforms Ireland Ltd. — measurement of visits and conversions from advertisements and personalized advertising via the Meta Pixel. Retention/use period: until membership withdrawal or termination of the entrustment agreement.
• App Attribution Analysis (processing entrustment; cross-border transfer to Israel and the USA): AppsFlyer Ltd. — analysis of the referral sources of app installation and launch events (attribution). Retention/use period: until membership withdrawal or termination of the entrustment agreement.
• Usage-Statistics Analysis (processing entrustment; cross-border transfer to Russia): YANDEX, LLC — usage-statistics analysis via Yandex Metrica. Retention/use period: until termination of the entrustment agreement.

Details of the cross-border transfer of personal information are as follows.

• Overseas payment (PayPal): Transferee — PayPal; destination country — the United States, etc.; items transferred — payment and transaction identification data; purpose of transfer — overseas payment processing; date and method of transfer — transmitted over the information and communications network at the time of payment; retention/use period — the period required by applicable laws.
• Analytics, Authentication & Advertising Measurement (Google): Transferee — Google LLC; destination country — the United States; items transferred — usage statistics, device/access information, login authentication data, cookie identifiers, page-navigation history, and ad-click identifiers; purpose of transfer — usage-statistics analysis, social/email login authentication, advertising conversion measurement, and building remarketing audience lists; date and method of transfer — transmitted over the information and communications network when the Service is used; retention/use period — until membership withdrawal or termination of the entrustment agreement.
• Advertising Performance Measurement (Meta): Transferee — Meta Platforms Ireland Ltd. and its affiliates; destination countries — Ireland and the United States; items transferred — cookie identifiers, IP, device and browser information, pages visited, and ad-click identifiers; purpose of transfer — measurement of visits and conversions from advertisements and personalized advertising; date and method of transfer — transmitted over the information and communications network when the Service is used; retention/use period — until membership withdrawal or termination of the entrustment agreement.
• App Attribution Analysis (AppsFlyer): Transferee — AppsFlyer Ltd.; destination countries — Israel and the United States; items transferred — advertising identifiers (ADID/IDFA), IP, device information, app installation and launch records, and referral-source information; purpose of transfer — analysis of app installation sources; date and method of transfer — transmitted over the information and communications network when the app is launched or installed; retention/use period — until membership withdrawal or termination of the entrustment agreement.
• Usage-Statistics Analysis (Yandex): Transferee — YANDEX, LLC; destination country — Russia; items transferred — cookie identifiers, IP, device and browser information, and page-navigation history; purpose of transfer — usage-statistics analysis; date and method of transfer — transmitted over the information and communications network when the Service is used; retention/use period — until termination of the entrustment agreement.
• Provision to local Vietnamese merchants: Transferee — the local Vietnamese merchant with which the member reserved/purchased (the specific business name is individually displayed and notified on-screen at the time of the member's reservation/payment); destination country — Vietnam; items transferred — the minimum information necessary to fulfill the reservation/delivery (nickname, time, number of people, recipient's contact, delivery address, etc.); purpose of transfer — fulfillment of the local reservation, delivery, and purchasing agency; retention/use period — until the service is provided and settlement is completed.

Users may refuse the cross-border transfer of their personal information; in such case, use of the relevant payment method or local service may be restricted. Cross-border transfers for analytics and advertising purposes may be refused using the methods described in Article 10, and even if refused, the basic functions of the Service remain available without restriction.

Article 9 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

• Encryption of personal information: Important information such as passwords, the Personal Customs Clearance Code (PCCC), and contacts is stored and managed in encrypted form.
• Access control: Access privileges to the personal-information processing system are minimized and access is controlled.
• Encryption of transmission: Users' personal information is transmitted through encrypted communication (HTTPS/TLS).
• Retention of access logs and prevention of forgery/tampering: Access logs of the personal-information processing system are retained, and forgery and tampering are prevented.

Article 10 (Collection, Use and Refusal of Cookies and Behavioral Information)

① Collection — The Company collects behavioral information through cookies and advertising identifiers in order to provide services and advertisements tailored to users.

② Behavioral information collected — Pages visited and time spent, search and click history, lists of products and merchants viewed with interest, advertisement impression and click history, and whether the app is installed.

③ Method of collection — Automatically collected and transmitted when a user visits the website or launches the app.

④ Purpose of collection — Analysis and improvement of service usage statistics, measurement of advertising performance, and provision of advertisements tailored to users' interests.

⑤ Retention/use period — 25 months from the date of collection. The information is destroyed without delay after the period expires.

⑥ Businesses processing behavioral information — Google LLC, Meta Platforms Ireland Ltd., AppsFlyer Ltd., YANDEX, LLC. The entrusted tasks and destination countries of each business are as set out in Article 8.

⑦ How users can refuse — Users may refuse the collection of behavioral information at any time.

• Web browsers: block in Chrome 〔Settings › Privacy and security › Third-party cookies〕, Safari 〔Preferences › Privacy〕, Edge 〔Settings › Cookies and site permissions〕
• Android: 〔Settings › Google › Ads › Delete advertising ID〕
• iPhone/iPad: 〔Settings › Privacy & Security › Tracking › turn off Allow Apps to Request to Track〕

If cookie storage is blocked, some convenience features such as staying logged in may be restricted, but basic use of the Service is not affected.

⑧ Inquiries and reports — Inquiries about the processing of behavioral information may be directed to the Personal Information Protection Officer in Article 7. In the event of an infringement of rights, users may request consultation from the Personal Information Infringement Report Center (118, no area code), the Personal Information Dispute Mediation Committee (1833-6972), the Cyber Investigation Division of the Supreme Prosecutors' Office (1301, no area code), or the Cyber Investigation Bureau of the Korean National Police Agency (182, no area code) (Republic of Korea).

Addendum

This Policy takes effect on October 8, 2026. The previous policy (effective July 7, 2026) is replaced by this Policy.

The changes are as follows.

• Preamble — Named the legal entity (Enjoyworks Co., Ltd.) as the personal information controller
• Article 1 — Added cookies and web-browser identifiers to the automatically collected items
• Article 2 — Added the purposes of service usage-statistics analysis, advertising performance measurement and personalized advertising
• Article 3 — Added the retention period for behavioral information
• Article 4 — Added the fact that processing is entrusted for service operation, analytics and advertising performance measurement
• Article 6 — Added guidance on refusing cookies in web browsers
• Article 7 — Added the company name, business registration number and address
• Article 8 — Added Meta Platforms Ireland Ltd., AppsFlyer Ltd. and YANDEX, LLC to the entrustees and cross-border transfer details; expanded the Google LLC entry (including building remarketing audience lists)
• Article 10 — Newly established the provision on the collection, use and refusal of cookies and behavioral information