글로벌케이무브 (GlobalKmove, service name GLOBALKMOVE, the "Company") establishes and publishes this Privacy Policy in accordance with the Personal Information Protection Act and other applicable laws to protect users' personal data and to handle related inquiries and complaints.
Article 1 (Purposes and Items of Personal Data Processing)
1. The Company processes the minimum personal data necessary to provide the service, and distinguishes between information needed at registration and information needed at the order and shipping stages.
- Registration and account management (email sign-up, required): email, password, name, country, phone number, address, preferred language. Optional: initials of your name in English (used for your Korean warehouse address). At registration the Company generates a customer ID and a Korean warehouse delivery address.
- Google account login: email, name and account identifier received from Google. Country, phone number and address are then collected as needed to use the service.
- Shipping forwarding (pre-registration of incoming packages and shipping requests): domestic courier tracking number, product name, quantity and value, destination country and address, recipient phone number, selected carrier, packing options and additional services, and remarks.
- Purchasing agent: product URL, product name, options, quantity, price and remarks.
- Receipt, storage and packing: package management number, receipt and dispatch records, and photos of packages, inspections and additional photos taken at the warehouse.
- International shipping and customs: recipient name, country, address, phone number, email, product name, quantity and value, and waybill number.
- Payment and refund: order number, payment provider's payment key, payment method type, payment amount, currency, applied exchange rate and approval time, receipt link, and refund amounts and reasons. Full card numbers, expiry dates and CVC codes are processed by the payment provider and are not stored by the Company.
- Inquiries and reviews: member information (name, email), inquiry subject and content, replies, and review content.
- Service operation records: order and package status change history (time and handler) and notification email logs. The Company's system does not separately store access IP addresses or device information; the hosting platform keeps request logs (IP, access time, browser information) for a short period for security and incident response (see Article 3).
2. Required and optional items, and items requiring consent, are distinguished on the collection screen. Declining to provide optional information or to receive promotional messages does not restrict use of the basic service.
3. Where a password is required, it is processed securely through the authentication system, and passwords are not stored in a form that can be read.
4. Payment authentication data such as full card numbers, expiry dates and card security codes are processed by the payment service provider (Toss Payments), and PayPal account data (login credentials, cards and bank accounts registered with PayPal) is processed by PayPal. The Company receives and stores only the payment key, payment method type, amount, currency, approval time and receipt link from the payment provider.
5. The Company takes care that unnecessary personal data is not included in inquiries or inspection photos, and does not request resident registration numbers or passport copies without a legal basis.
Article 2 (Collection Methods and Legal Basis)
1. The Company collects personal data through input on the Site, service applications, customer support, Google login integration and records generated in the course of using the service.
2. Personal data is processed on the basis recognized by applicable law, such as the conclusion and performance of a contract with the user, compliance with legal obligations, or the user's consent.
3. Where consent is required, the Company explains the purpose, items, retention period and the consequences of refusing consent, and obtains consent. Publication of this Policy alone is not deemed consent to all processing.
4. Where a user enters the information of a recipient other than themselves, the user must have a lawful basis to provide that information for delivery purposes.
Article 3 (Retention and Use Period)
1. The Company destroys personal data without delay once the purpose of processing has been achieved or the retention period has expired. Information that must be retained by law is kept separately to the extent necessary.
- Records on contracts or withdrawal of offers: 5 years, under the Act on Consumer Protection in Electronic Commerce and its Enforcement Decree.
- Records on payment and supply of goods or services: 5 years, under the same law.
- Records on consumer complaints or dispute handling: 3 years, under the same law.
- Records on labeling and advertising: 6 months, under the same law.
2. Member information is in principle processed until withdrawal or the end of the account management purpose. Where orders, shipping, settlement or disputes remain, only the information needed for that work is retained on a lawful basis.
3. Information subject to retention under other laws, such as tax evidence, is retained according to the applicable law and starting point. All member information is not retained on this ground.
4. Other information is retained for the following periods and then deleted.
- On withdrawal: the account is deactivated immediately, and personal data such as name, contact details and addresses is deleted or de-identified within 30 days of withdrawal. Order, payment and dispute records subject to statutory retention are kept separately for the periods in paragraph 1.
- Warehouse photos (package, inspection and additional photos): 90 days from the dispatch date of the package.
- Inquiry and reply records: 3 years from completion (as consumer complaint and dispute records).
- Notification email logs: 1 year from the sending date.
- Hosting platform request logs (IP, access time, browser information): automatically deleted after at most 1 day. Database platform access logs: automatically deleted after 7 days.
- Database backups: created daily and automatically deleted after 7 days. If data is restored from a backup, deletion is reapplied after restoration so that already deleted information is not reused.
Article 4 (Provision of Personal Data to Third Parties)
1. The Company does not provide personal data to third parties who use it for their own independent purposes without the user's consent or a legal basis.
2. Transfers of information related to international transport and customs clearance are classified as third-party provision, outsourced processing or statutory submission according to the actual contract and processing role.
3. Where separate consent is required for third-party provision, the Company explains the recipient, purpose, items, retention and use period and the consequences of refusal, and obtains consent.
4. For purchasing agent orders, only the Company's warehouse address is given to the seller and the user's personal data is not transferred; such sellers are therefore not listed as recipients. Where user information is required, such as for event entries, separate notice and the necessary procedures are followed.
5. The Company provides personal data to third parties as follows.
- Recipient: international carriers (FedEx or the carrier selected by the user) / Purpose: international transport, tracking and customs clearance / Items: recipient name, country, address, phone number, email, product name, quantity and value / Retention: until transport is completed and for the period under the carrier's policy / Basis: performance of the shipping contract with the user
- Recipient: customs authorities and customs brokers in the destination country / Purpose: import and export clearance / Items: recipient name, address, phone number, product name, quantity and value / Basis: legal obligations under customs law
Article 5 (Outsourcing of Personal Data Processing)
1. The Company may outsource personal data processing to external providers to deliver the service.
2. When outsourcing, matters such as the prohibition of processing beyond the purpose, security measures, sub-processing, supervision and liability are set and managed in accordance with applicable law.
3. The providers the Company outsources personal data processing to, and their tasks, are as follows.
- Toss Payments Co., Ltd. (Republic of Korea): card and PayPal payment approval, cancellation and refund processing, receipt issuance / Items: email, name, order name, payment amount, card data (collected directly by Toss Payments). For PayPal payments, the order name, product description, amount, recipient name, destination country and address are passed to PayPal (for seller protection and fraud prevention)
- Supabase, Inc. (United States): database operation, member authentication (password and Google login), photo file storage / Items: all member, order, payment and inquiry data and photos held by the Company / Sub-processor: Amazon Web Services (servers located in the Seoul region, Republic of Korea)
- Vercel Inc. (United States): website hosting and server program execution, request logs for incident response (at most 1 day) / Items: information sent to the server in the course of using the service / Sub-processor: Amazon Web Services
- Resend, Inc. (United States): sending notification emails for registration, orders, receipt, payment and refunds / Items: recipient email, name, and order numbers and amounts included in the email body / Sub-processor: Amazon Web Services
- Google LLC (United States): Google account login authentication / Items: Google account email, name and identifier (passed from Google to the Company)
Article 6 (Overseas Transfer of Personal Data)
1. The Company may provide, outsource or store personal data overseas in the course of international shipping or use of external systems. Whether data can be viewed or accessed from overseas is also taken into account.
2. Overseas transfers are made on the basis permitted by applicable law, and where separate consent is required, the necessary information is provided and consent obtained.
3. For each transfer, the Company discloses the legal basis, the exact name and contact of the recipient, the destination country, the items transferred, the time and method of transfer, the purpose, the retention and use period, how to refuse the transfer and the consequences of refusal.
4. Requests to refuse a transfer may be submitted to the Privacy Officer. Whether the service is restricted is determined individually based on the necessity of the transfer and whether an alternative is available; the service is not uniformly restricted.
5. The Company's overseas transfers of personal data are as follows.
- Supabase, Inc. (United States, privacy@supabase.io) / Country: Republic of Korea (data stored in the AWS Seoul region); personnel located in the United States may access data for technical support and incident response / Items: member, order, payment and inquiry data, photos / Time and method: stored and retrieved over the network as the service is used / Purpose: outsourced database, authentication and file storage / Retention: until the outsourcing contract ends or the Company requests deletion / Basis: outsourced processing and storage for performance of the service contract
- Vercel Inc. (United States, privacy@vercel.com) / Country: server programs run in the Republic of Korea (Seoul region); request logs and CDN caches are held in the United States and global locations / Items: information sent to the server as the service is used, request logs (IP, access time, browser information) / Time and method: network transmission on each visit to the Site / Purpose: outsourced website hosting / Retention: request logs at most 1 day, other data deleted immediately after processing / Basis: outsourced processing
- Resend, Inc. (United States, privacy@resend.com) / Country: United States / Items: recipient email, name, order information in the email body / Time and method: network transmission when notification emails are sent / Purpose: outsourced email delivery / Retention: up to 1 year from the sending date / Basis: outsourced processing
- Google LLC (United States) / Country: United States / Items: login request information (Google account identifier) / Time and method: when Google login is used / Purpose: login authentication / Retention: according to Google account policy / Basis: the user's choice to log in with Google (consent)
- FedEx Corporation and local carrier entities (United States and destination countries) / Country: United States (systems), transit and destination countries / Items: recipient name, country, address, phone number, email, product name, quantity and value / Time and method: transmitted when a shipping request is processed / Purpose: international transport and customs clearance / Retention: the period under the carrier's policy / Basis: third-party provision necessary for performance of the shipping contract
- PayPal Pte. Ltd. (Singapore) and PayPal, Inc. (United States) / Country: Singapore, United States / Items: where the User chooses PayPal, email, name, order name and product description, payment amount (USD), recipient name, destination country and address / Time and method: transmitted via Toss Payments when a PayPal payment is requested / Purpose: PayPal payment processing, seller protection and fraud prevention / Retention: according to PayPal's user agreement and privacy statement / Basis: the User's choice to pay with PayPal (performance of the payment contract)
- Toss Payments is a Korean company and does not constitute an overseas transfer. No data is passed to PayPal when only card payment is used.
Article 7 (Destruction of Personal Data)
1. Personal data that is no longer needed because the retention period has expired or the purpose has been achieved is destroyed without delay.
2. Where other laws require continued retention, only that information is stored separately or with restricted access.
3. Electronic files are deleted securely so that they cannot be recovered or reproduced, and paper records are shredded or incinerated.
4. Retention periods and deletion cycles also apply to backups, and the Company manages restoration so that already deleted information is not reused.
Article 8 (Rights of Users and Legal Representatives)
1. Users may request access to, correction or deletion of, suspension of processing of, and withdrawal of consent to their personal data in accordance with applicable law.
2. Requests may be made through the functions provided in My Page, by email to globalkmove@gmail.com or by phone at +82 10-7282-9820.
3. The Company verifies, to the extent necessary, that the requester is the data subject or an authorized representative, and acts within the statutory period.
4. Where a request cannot be fully accommodated due to statutory retention obligations or similar reasons, the Company explains the reason and how to object.
5. The Company does not accept membership registration by children under 14 years of age. If it finds that such a child's personal data has been collected improperly, it takes the necessary protective measures.
Article 9 (Cookies and Automatic Collection Tools)
1. The Company may use cookies and browser storage for necessary functions such as keeping you logged in, security and language settings.
2. Users may delete stored data or block cookies in their browser settings. Blocking storage for essential functions may limit features such as login.
3. If analytics or advertising tools are used, the Company separately announces the tools, items collected, purpose, retention period and how to opt out, and applies the necessary consent procedures.
4. The storage items actually used by the Company are as follows.
- Staying logged in: a login token is stored in the browser's local storage (valid for 7 days, deleted on logout).
- Language setting: the selected language (Korean/English) is stored in the browser's local storage.
- Offline support: a browser service worker caches page layout files (no personal data).
- Analytics tools and advertising pixels: not used. If the Company starts using them, this Article will be revised and announced.
- Users may delete site data or block storage in their browser settings; in that case the login state is not kept.
Article 10 (Security Measures)
The Company applies and manages the necessary protective measures, including minimizing the number of personnel handling personal data and their access rights, protecting credentials and data in transit, access control and access log management, security updates, backup, recovery and deletion management, training of personnel handling personal data, and supervision of outsourced providers.
The specific measures the Company applies are as follows.
- Password protection: passwords are stored using one-way encryption (bcrypt) and cannot be read in plain text. The Company does not hold passwords for users who log in with Google.
- Protection in transit: all communication between the Site, the server and external services is encrypted with HTTPS (TLS).
- Access control: the database is accessed only through the server program, and administrator functions are available only to accounts logged in with administrator privileges. Login tokens expire after 7 days.
- Processing records: order and package status changes are recorded with the handler and time. Database platform access logs are kept for 7 days.
- Backup and recovery: the database is backed up automatically every day and backups are deleted after 7 days.
- Minimization of access rights: operational system accounts (database, hosting, payment, email) are owned and managed by the Company, and personnel handling personal data are kept to a minimum.
Article 11 (Privacy Officer and Contact)
The Company designates the following Privacy Officer to oversee personal data processing and to handle users' inquiries, complaints and requests for remedy.
Business name: 글로벌케이무브 (GlobalKmove) / Service name: GLOBALKMOVE
Privacy Officer: Yunmi Hong / Position: Representative
Email: globalkmove@gmail.com / Phone: +82 10-7282-9820
Address: 5F, 362 Ori-ro, Gwangmyeong-si, Gyeonggi-do, Republic of Korea
Users may submit privacy inquiries and requests to exercise their rights to the contact above. If you object to the Company's handling, you may use the consultation and remedy procedures of the Personal Information Protection Commission, the Personal Information Infringement Report Center and the Personal Information Dispute Mediation Committee.
Article 12 (Changes to this Policy)
1. When this Policy is changed, the Company announces the changes and effective date on the Site. In principle, notice is given 7 days before the effective date, and changes that materially affect users' rights are announced with sufficient advance notice.
2. Changes that require new consent are not replaced by an announcement alone; the procedures under applicable law are followed. Previous versions and the change history are kept available.
Effective Date
This Policy takes effect from the service launch date. (Effective date to be stated once confirmed.)