Kexpress24
Privacy Policy
- Version:
- 2026-09-02-v1.2
- Published:
- 2026-09-02
1. Hanpumsokdal (Kexpress24) is the controller. The representative and privacy officer is 조원진. Requests for access, correction, deletion, restriction, or withdrawal may be made by email, WeChat, LINE, or WhatsApp. The phone number is `010-5064-1606` on Korean pages and `+82 10-5064-1606` on other-language pages, and consultation hours are stated in KST. 2. To operate orders, quotes, payments, refunds, delivery, support, fraud prevention, and legal compliance, Kexpress24 processes customer name; email; payer name or payer identifier; the selected contact channel and account or phone number; ordered items and quantities; accommodation name and address; reservation name; check-in and check-out information; accommodation exterior or entrance and expected parcel-receipt-location photos required by accommodation type; payment-method and transaction, approval, and cancellation identifiers; tracking and delivery evidence; reviews and attachments; policy version and acceptance time; HMAC digests of IP address and User-Agent; and security and audit records. Original card credentials are handled by the payment provider, while Kexpress24 retains required transaction identifiers. 3. Data is collected through web order, lookup, payment, and review pages; customer communications; payment webhooks; and delivery or accommodation verification. Processing is based on contract formation and performance, customer requests, legal obligations, legitimate security needs, or separate consent where required. 4. The proposed periods are 180 days after completion or cancellation for ordinary contact, accommodation, address, and delivery evidence; 1,095 days for review media; one day for expired lookup sessions; 365 days for security events; and 1,825 days for protected audit records. Approved periods trigger anonymization or secure deletion. Statutory records are kept separately, including five years for contract, cancellation, payment, and supply records; three years for complaints and disputes; and six months for display or advertising records. Legal holds remain protected until released. 5. Alibaba Cloud ECS handles web, API, file, and MySQL hosting; PortOne/KICC handles payment processing and transaction verification; Coupang handles product ordering and delivery; and Google Places, Kakao Local, and the Korean road-address APIs handle address search and verification. Only data needed for each purpose is sent. Google Places receives only the address or place query, an opaque session token, the place ID, locale, and South Korea region condition; it does not receive the customer name, contact details, reservation data, order number, lookup code, payment data, or browser IP. Telegram is used only for a generic new-order alert and an administrator order-list URL that contains no customer data; no order number, internal UUID, customer name, contact, payer, accommodation, stay date, item, or amount is sent. 6. During service use and record creation, the operational data in paragraph 2 is transferred over TLS to and stored in the China (Hong Kong) `cn-hongkong` ECS region provided by `Alibaba Cloud (Singapore) Private Limited` (`legal.cloud@alibabacloud.com`). The purposes are web, API, file, and ECS-internal MySQL operation, disaster recovery, and encrypted backup. It is retained only for the approved periods in paragraph 4 and any statutory or legal-hold period, then deleted or anonymized. Refusal makes order, payment, and delivery service unavailable. For Google address search, the direct contracting entity for the verified Korean billing profile is `Google Cloud Korea LLC` in South Korea, and Google processes the search information as an independent controller. Google's onward processing and transfers follow the applicable Google privacy and controller terms. A customer may refuse by stopping address search, but cannot submit an order without a verified delivery address. 7. At the end of the approved period, electronic records are securely deleted or identifiers are anonymized, including attachments in public and private storage. Legally retained records are separated and restricted from unrelated use. 8. Safeguards include HMAC-only lookup-code storage, HttpOnly and Secure cookies, idle and absolute session expiry, attempt limits, invalidation on reissue, idempotent payment and refund verification, payment-provider inquiry, administrator TOTP, access controls, chained audit records, sensitive-log masking, encrypted backup, and monthly isolated restore testing. 9. Data subjects may request access, correction, deletion, restriction, or withdrawal. A request may be limited where records are required for law, an active transaction, or a dispute, and the reason will be explained. Refusal to provide data required for the contract or a necessary overseas transfer may prevent order, payment, or delivery service. 10. The policy version and effective date are published on the service, and material changes are announced before taking effect.