Privacy Policy

Applicable Region — This Privacy Policy applies to users residing in the European Economic Area (EEA), the United Kingdom, and other jurisdictions outside South Korea and Japan. Residents of Korea should refer to the Korean version. Residents of Japan should refer to the Japanese version when published.

Roovook Inc. (the "Company", "we", "us", or "our") protects the personal data of its users in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy Directive (2002/58/EC), the UK GDPR and Data Protection Act 2018, and other applicable data-protection laws. We provide this Privacy Policy to explain clearly how we process personal data and how data subjects can exercise their rights.

This Policy governs the personal data of general users (event organisers, prospective guests, and inquirers) that we collect and process through the Sales-Engine (lead-capture pages embedded within EMS), Venue Network, and Group Bookings pages operated directly by Roovook. Personal data collected and processed independently inside EMS by our Service Providers (hotels and venues that subscribe to our SaaS product) is handled by those Service Providers as separate, independent controllers and is not covered by this Policy.

Article 1 (Purposes and Lawful Bases of Processing)

We process personal data for the purposes set out below. Each purpose is tied to one or more lawful bases under Article 6 GDPR. Personal data will not be used beyond these purposes; where purposes change materially, we will obtain fresh consent or rely on another appropriate lawful basis, with prior notice.

Note: Cross-border transfers additionally rely on Chapter V safeguards (Standard Contractual Clauses) as detailed in Article 8.

Article 2 (Categories of Personal Data Collected)

(1) Data provided directly by the user

(2) Data collected automatically during service use

• IP address, access timestamps, access logs, and page-use records
• Device information (model, operating-system version), browser information
• Information collected via cookies and similar tracking technologies

(3) Data collected during consultation

• Voice-call recordings from phone consultations
• Chat-consultation transcripts

(4) Data collected during payment

• As applicable (see Article 7 and Article 8 for details)

We do not collect national-identification numbers, passport numbers, driving-licence numbers, or other unique government-issued identifiers.

Article 3 (Call Recording — Legitimate Interest)

When a user speaks with us by telephone, we record the call as set out below. This processing is based on our legitimate interests under Art. 6(1)(f) GDPR (dispute prevention and consultation quality assurance); we have carried out a balancing test and concluded that these interests are not overridden by the interests or fundamental rights of the data subject, given the prior notice, limited retention, and ability to decline recording.

• Notice of recording: An automated voice notice at the start of the call informs the user that the call is recorded.
• Purposes: (i) consultation quality management, (ii) accurate confirmation of order/reservation details, and (iii) evidentiary record where a dispute arises between the user and a Service Provider.
• Retention: Recording files are erased without delay once the purpose is achieved. Where applicable law imposes a longer retention obligation (for example, records of consumer complaints/disputes), we retain recordings only for that legal period.
• Disclosure: Recording files may be disclosed to the Service Provider with whom the user made the inquiry, for dispute-prevention purposes. See the Third-Party Disclosure Consent for details.
• Right to refuse: A user may decline call recording. In that case, email (support@roovook.com), the web inquiry form, and chat remain available as non-voice alternatives.

Article 4 (Special Categories of Data — Art. 9 GDPR)

Roovook is a quote-stage B2B sales platform. Final contracts (and any special-category data such as dietary-restriction or allergy information that the Service Provider may separately collect for catering or operations purposes) are concluded directly between the Service Provider and the end guest, outside Roovook's systems. Accordingly:

• Roovook does not intentionally collect or process special categories of personal data as defined in Article 9(1) GDPR (racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data, health data, or data concerning a natural person's sex life or sexual orientation).
• Where such data is inadvertently provided (for example, in a free-text inquiry field), we delete it promptly upon becoming aware, unless an Article 9(2) derogation applies.

Article 5 (Retention Periods)

We retain personal data only for as long as necessary to achieve the processing purpose, or for the period required by applicable law, whichever is longer.

• Default: Personal data is deleted without undue delay once the purpose is achieved.

• Legal-retention obligations (where Korean export / consumer-protection records are involved for cross-border transactions):

  • Contract and order-withdrawal records — 5 years
  • Payment and supply records — 5 years
  • Consumer complaints and dispute records — 3 years
  • Advertising/marketing records — 6 months
  • Website and app access logs — 3 months

  These Korean statutory periods apply because Roovook Inc. is incorporated in the Republic of Korea; Korean retention obligations run in parallel with our GDPR-mandated data minimisation duties, and we retain such data in segregated storage with restricted access.

• User account information: Retained until the user requests deletion; any records subject to a statutory retention obligation are stored separately until that obligation expires.

• Marketing-consent records: Retained for 2 years from the date of consent unless withdrawn earlier.

Article 6 (Disclosure to Third Parties)

We process personal data solely for the purposes set out in Article 1 and do not disclose personal data to third parties without a lawful basis. The central disclosure is to the Service Provider the user has chosen to contact. The full consent procedure is in our separate Third-Party Disclosure Consent; the summary is below.

Article 7 (Processors — Art. 28 GDPR)

We engage the following processors under Article 28 GDPR. Each processor is bound by a written agreement that requires (i) processing only on our documented instructions, (ii) confidentiality commitments for authorised personnel, (iii) appropriate technical and organisational security measures, (iv) engagement of sub-processors only with prior authorisation, (v) assistance with data-subject rights and breach response, and (vi) deletion or return of personal data at the end of the engagement.

Where we add or replace a processor, we will update this Policy and give advance notice before the change takes effect.

Article 8 (International Transfers — Art. 44–49 GDPR)

To operate the service we rely on cloud and AI services located outside the EEA and the United Kingdom. The following transfers take place:

Roovook's core Google Cloud Platform infrastructure (Cloud Run, App Engine, Cloud SQL, Cloud Storage, and related services) operates in the asia-northeast1 (Tokyo) region. User data stored on this infrastructure physically resides in Japan. Transfers from the EEA or United Kingdom to Japan are covered by the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419, and the analogous UK adequacy regulations); no further supplementary safeguards (such as Standard Contractual Clauses) are required for this data location. The transfers listed in the table below apply only to data shared with providers or entrustees outside Japan.

Note: The Google LLC GCP infrastructure transfer previously listed in this table is covered by the Japan adequacy decision and is no longer enumerated separately. It is disclosed in Article 7 (Processors).

Adequacy references: Japan benefits from an EU adequacy decision under Article 45 GDPR (Commission Implementing Decision (EU) 2019/419), so transfers from the EEA to Japanese recipients do not require additional safeguards. The Republic of Korea similarly benefits from an EU adequacy decision (Commission Implementing Decision (EU) 2022/254) of 17 December 2021.

Users have the right to object to cross-border transfers that rely on consent. Objecting may limit the availability of some features; we will explain the impact before processing the objection.

Article 9 (Cookies and Automatic Collection — ePrivacy + Art. 7 GDPR)

(1) What cookies are

Cookies are small files that a website transmits to the user's browser and which may be stored on the user's device. We use cookies and similar tracking technologies to operate the service and to provide certain features.

(2) Consent model — prior opt-in with reject-all parity

• Strictly-necessary cookies (login session, security, CSRF protection): set on service use; no consent is required pursuant to Article 5(3) of the ePrivacy Directive.
• Functional, analytics, and marketing cookies: set only after the user has given prior, informed, freely given, specific, and unambiguous opt-in via our cookie banner. The banner provides "Accept all" and "Reject all" with equivalent visual prominence. Consent is recorded, revocable at any time, and can be adjusted via the "Cookie Preferences" link in the site footer.

(3) Third-party tools (loaded only with the relevant consent)

Roovook does not use marketing pixels such as Meta Pixel or TikTok Pixel. The Facebook SDK is used exclusively for social login authentication and is distinct from the behavioural-tracking Meta Pixel.

Information collected by these tools includes cookie identifiers, IP address, device/browser metadata, and page-use records. Social-login SDKs process only the minimum data needed for authentication (account identifier, authentication token); names, phone numbers, and other identifiers are not passed to analytics tools.

(4) Rejecting cookies

A user may decline cookies at any time via (i) the cookie banner (available on first visit and re-invocable from the "Cookie Preferences" link), or (ii) browser settings. Rejecting strictly-necessary cookies may impair core service functionality.

Article 10 (Security Measures — Art. 32 GDPR)

Taking into account the state of the art, implementation cost, and the nature, scope, context, and purposes of processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk:

1. Organisational measures: written internal security plan; periodic data-protection training for staff and processors; role-based access-control procedures; documented incident-response playbook.
2. Technical measures: access control to personal-data processing systems; encryption of passwords and key personal data at rest (AES-256) and in transit (TLS 1.2+); intrusion-detection and intrusion-prevention systems; log retention and periodic log review; anti-malware controls.
3. Physical measures: controlled access to server rooms and document-storage facilities.
4. Resilience: Systems are designed to maintain confidentiality, integrity, availability and resilience of processing, including redundancy, failover, and load balancing across multiple Google Cloud zones (Art. 32(1)(b)).
5. Restoration: We maintain daily encrypted backups with documented restoration procedures, tested quarterly, to ensure timely recovery from incidents (Art. 32(1)(c)).
6. Testing: Security controls are subject to regular testing, assessment and evaluation, including annual penetration tests and ongoing vulnerability scans (Art. 32(1)(d)).

Article 11 (Personal Data Breach Response — Art. 33–34 GDPR)

• Supervisory authority notification (Art. 33): On becoming aware of a personal-data breach, we notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where notification is not made within 72 hours, we accompany the delayed notification with reasons for the delay.
• Data-subject notification (Art. 34): Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, we communicate the breach to affected data subjects without undue delay, in clear and plain language, describing the nature of the breach, the likely consequences, and the measures taken or proposed.
• Internal logging: We document all breaches, their effects, and the remedial action taken, in a breach register made available to the supervisory authority on request.

Article 12 (Data-Subject Rights — Art. 15–22 GDPR)

Subject to the conditions in the GDPR, you have the following rights with respect to your personal data:

How to exercise: Contact us by email (support@roovook.com) or via the in-product support form. We will respond within one month (30 days) of receipt pursuant to Art. 12(3) GDPR; this period may be extended by up to two further months for complex or numerous requests, in which case we will notify you of the extension and the reasons within the first month. No fee is charged unless the request is manifestly unfounded or excessive.

Verification: We may ask for information reasonably necessary to confirm your identity. A data subject may also act through an authorised representative on presentation of valid authority.

Freeze during rectification: While a rectification or erasure request is being processed, we will not use or disclose the contested data beyond what is necessary to process the request.

Article 13 (Consent Withdrawal — Art. 7(3) GDPR)

Where processing is based on consent, you have the right to withdraw your consent at any time, as easily as you gave it, without affecting the lawfulness of processing based on consent before its withdrawal.

Concrete withdrawal paths:

• Marketing communications: unsubscribe link at the foot of every marketing email, or in account settings under "Communication preferences".
• Non-essential cookies: the "Cookie Preferences" link in the site footer (re-invokes the cookie banner with Reject-all parity).
• Cross-border transfer consent: by emailing support@roovook.com. We will confirm the scope of service that can still be provided without the transfer.
• Account and all consent-based processing: by closing your account via account settings, or by emailing support@roovook.com.

Withdrawing consent does not affect other lawful bases that may still apply to the same data (for example, statutory retention or contract performance).

Article 14 (Data Protection Officer and Supervisory Authorities)

Data Protection Officer (DPO) / Privacy Contact

• Name: Sungmo Kim
• Email: support@roovook.com
• Company: Roovook Inc.
• Japan-market alternative contact: support@roovook.com

EU Representative (Art. 27 GDPR)

Roovook has not appointed an EU representative under Article 27 at this time; our processing of EEA residents' data presently occurs on an occasional, low-risk basis. On formal EU market expansion we will appoint and publish an Article 27 representative, with designated contact details, by updating this Policy prior to launch.

Supervisory authorities

Data subjects in the EEA have the right to lodge a complaint with the data protection authority in their EU member state. The directory of supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

Article 15 (Revision History and Notice)

This Policy takes effect on its effective date. Where we make additions, deletions, or corrections driven by law or policy changes, we will publish the amended Policy via in-service notice at least 7 days before effect; for changes that are materially adverse to data subjects, we will give at least 30 days' prior notice and, where required, obtain fresh consent.

Last updated: 22 April 2026