Privacy Policy

VietSpots (the 'Company') establishes and discloses the following Privacy Policy in accordance with applicable laws in order to protect users' personal information and to promptly and smoothly handle related grievances.

Article 1 (Items of Personal Information Processed)

The Company collects the minimum personal information necessary to provide the Service.

• Required items: Email, password (stored encrypted)
• Optional items: Nickname, phone, chat content with merchants, delivery and pickup addresses (accommodation name and detailed address)
• When using overseas purchasing-agency/delivery: recipient's name and contact, delivery address, and Personal Customs Clearance Code (PCCC). Of these, the PCCC and contact are stored encrypted.
• When making payments: payment/settlement records and payment-result information. Detailed payment-instrument data such as card numbers is handled by the payment gateway; the Company retains only minimal information such as the payment result, approval number, and transaction identifier.
• Automatically collected items: IP, device information, access logs, push tokens (when using the mobile app, including the device unique identifier (advertising identifiers such as ADID/IDFA), OS version, and model name)

Article 2 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes. The personal information being processed is not used for any purpose other than the following, and if the purpose of use changes, the Company will take necessary measures such as obtaining separate consent.

• Member identification, login, coupon claiming, and reservation brokerage (including delivery, massage, shopping, restaurant, motorbike rental, barbershop, and laundry services, and the provision of app push notifications)
• Handling 1:1 inquiries with merchants, and operating local open chat and community services (including real-time translation features)
• Processing online payments, verifying payments, and preventing fraudulent payments
• Purchasing overseas purchasing-agency goods, export/import customs clearance, international shipping, and status updates
• Prevention of acts violating laws and the Terms
• Responding to customer inquiries

Article 3 (Retention Period)

Personal data is destroyed immediately upon withdrawal. However, in accordance with applicable laws, the following information is retained for the periods below.

• Records on contracts or withdrawal of subscription: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on payment and the supply of goods, etc.: 5 years (Act on Consumer Protection in Electronic Commerce)
• Records on consumer complaints or dispute handling: 3 years (Act on Consumer Protection in Electronic Commerce)
• Records related to import customs clearance and overseas purchasing-agency transactions (name, Personal Customs Clearance Code (PCCC), etc.): 5 years (Customs Act)

Destruction procedure and method: The Company selects personal data for which grounds for destruction have arisen and destroys it with the approval of the Privacy Officer. Personal data stored in electronic file form is permanently deleted using technical methods that make the records unrecoverable, and personal data recorded/printed on paper documents is destroyed by shredding or incineration.

Article 4 (Provision to and Entrustment of Third Parties)

The Company does not provide personal information to third parties without the user's consent. Only the minimum information necessary to proceed with a merchant reservation (nickname/time/number of people) is delivered to the merchant, and for delivery and laundry services, the delivery/pickup address is included.

• Recipient of personal information: The local Vietnamese partner merchant for which the member applied to reserve/use the service (delivery companies, massage shops, shopping merchants, restaurants, motorbike rental shops, barbershops, laundries)
• Purpose of use by the recipient: Confirming delivery addresses and delivering goods, collecting and returning laundry, confirming reservations and concluding rental agreements, and performing local services
• Retention and use period of the recipient: Until the relevant local service is provided and settlement is completed

Matters regarding the outsourcing of personal-data processing and cross-border transfer are set out in Article 8.

Article 5 (PII Masking)

Phone numbers, emails, and external messenger IDs in chat messages are automatically masked on the server, and only the masked version is provided to merchants.

Article 6 (User Rights)

Users may at any time request to view, correct, delete, or suspend the processing of their personal information. Please submit requests through the settings screen or by contacting the operations team.

Members using the mobile app may refuse the provision of location information and the collection of the smartphone advertising identifier (ADID/IDFA) at any time through the operating system (OS) settings menu of the mobile device.

Article 7 (Personal Information Protection Officer)

The Company takes overall responsibility for the handling of personal information and, for the handling of user complaints and remedy of damages, designates a Personal Information Protection Officer as follows.

• Department responsible for personal information protection: VietSpots Operations Team
• Position: Personal Information Protection Officer
• Email: younggonnim@enjoyworks.co.kr
• Phone: +82-2-6224-3125

Article 8 (Entrustment of Personal Information Processing and Cross-Border Transfer)

For the smooth provision of the Service, the Company entrusts personal-information processing tasks as set out below, and owing to the nature of the Service, some personal information is transferred overseas.

• Payment agency (processing entrustment): PortOne (KG Inicis), PayPal — online payment processing, payment verification, and prevention of fraudulent payments. Retention/use period: the retention period required by applicable laws, or until termination of the entrustment agreement.
• Analytics & Authentication (outsourcing; cross-border transfer to the USA): Google LLC — usage-statistics analysis and service improvement via Google Analytics, and social (Google/Apple)/email login authentication via Firebase Authentication. Retention/use period: until membership withdrawal or termination of the outsourcing contract.

Details of the cross-border transfer of personal information are as follows.

• Overseas payment (PayPal): Transferee — PayPal; destination country — the United States, etc.; items transferred — payment and transaction identification data; purpose of transfer — overseas payment processing; date and method of transfer — transmitted over the information and communications network at the time of payment; retention/use period — the period required by applicable laws.
• Analytics & Authentication (Google): Transferee — Google LLC; destination country — the United States; items transferred — usage statistics, device/access information, and login authentication data; purpose of transfer — usage-statistics analysis and social/email login authentication; date and method of transfer — transmitted over the information and communications network when the Service is used; retention/use period — until membership withdrawal or termination of the outsourcing contract.
• Provision to local Vietnamese merchants: Transferee — the local Vietnamese merchant with which the member reserved/purchased (the specific business name is individually displayed and notified on-screen at the time of the member's reservation/payment); destination country — Vietnam; items transferred — the minimum information necessary to fulfill the reservation/delivery (nickname, time, number of people, recipient's contact, delivery address, etc.); purpose of transfer — fulfillment of the local reservation, delivery, and purchasing agency; retention/use period — until the service is provided and settlement is completed.

Users may refuse the cross-border transfer of their personal information; in such case, use of the relevant payment method or local service may be restricted.

Article 9 (Measures to Ensure the Security of Personal Information)

The Company takes the following measures to ensure the security of personal information.

• Encryption of personal information: Important information such as passwords, the Personal Customs Clearance Code (PCCC), and contacts is stored and managed in encrypted form.
• Access control: Access privileges to the personal-information processing system are minimized and access is controlled.
• Encryption of transmission: Users' personal information is transmitted through encrypted communication (HTTPS/TLS).
• Retention of access logs and prevention of forgery/tampering: Access logs of the personal-information processing system are retained, and forgery and tampering are prevented.