Article 1 (Purpose)

Effective Date: March 3, 2026

Shuttle Co., Ltd. ("Company", "we", "us", or "our") complies with the Personal Information Protection Act of the Republic of Korea and other applicable laws. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our services.

Article 2 (Company Information and Scope of Services)

1. Data Controller
   • Company Name: Shuttle Co., Ltd.
   • Address: 5F, Aejeon Building, 247 Cheongpa-ro, Yongsan-gu, Seoul, Republic of Korea
   • CEO: Hyun Kyung Lee
   • Contact : lauren@shuttledelivery.co.kr
2. Scope of Service
   
   We operate:
   1) An online food ordering and delivery platform
   2) Delivery services in cooperation with delivery partners, agencies, and riders
   3) Order fulfillment services (including proxy purchasing from third-party platforms, where applicable)
   
   We process personal information only to the extent necessary to provide these services.

Article 3 (Categories of Personal Information Collected)

1. Account Registration
   • Required: Email Address(login ID), Password (encrypted), Mobile Number
   • Optional: Name, Nationality, Date of Birth, Language preference, Social login identifier
2. Order and Delivery Service
   • Required : Recipient information (name, contact, address)
   • Optional : Order details, Delivery instructions, Gate code
3. Order Fulfillment Services
   • Recipient information (name, contact, address)
   • Minimum necessary order information required to complete fulfillment
4. Payment Information
   • Transaction approval data (approval number, amount, date/time), Refund information
   • We do not store full credit card numbers. Payment processing is handled by licensed payment processors.
5. Customer Support
   • Email address, Contact information, Inquiry content, Chat records
6. Automatically Collected Information
   • Service usage records
   • Access logs
   • Cookies
   • IP address
   • Device information
   • Error logs

Article 4 (Purpose of Processing)

We use personal information for:

1. Account management and user identification
2. Order processing, payment handling, and delivery fulfillment
3. Proxy purchasing and fulfillment services
4. Customer support and dispute resolution
5. Fraud prevention and service security
6. Service improvement and analytics (where possible, using de-identified data)
7. Compliance with legal obligations

Article 5 (Retention Period)

We retain personal information only as long as necessary for the purposes described above, unless a longer retention period is required by law.

Upon account deletion, personal data is deleted without delay unless retention is required by law.

Article 6 (Disclosure to Third Parties)

We do not share personal information. However, we may share necessary information with:

1. Restaurants and Delivery Partners
   • Recipients: Partner restaurants, delivery riders, delivery agencies, and delivery platform operators (e.g., Barogo, Moaline, Saenggakdaero, etc.)
   • Categories of Personal Information Disclosed: Recipient information (name and contact number), delivery address, and order details.
   • Purpose of Disclosure: Food preparation and delivery fulfillment, responding to customer inquiries related to the order, and providing delivery route guidance.
   • Retention Period: Access to the information will be restricted or masked once the purpose of processing has been fulfilled. In the event of a dispute, the information may be retained in accordance with applicable laws and statutory retention requirements.
2. Disclosure for Order Fulfillment Services
   • Recipients: Third-party sales or distribution platforms, as well as their respective sellers, merchants, or logistics providers.
   • Categories of Personal Information Disclosed: Recipient name, contact number, delivery address, and the minimum order information necessary to complete the fulfillment process.
   • Purpose of Disclosure: Order placement, product preparation, and delivery fulfillment.
   • Retention Period: Personal information shall be retained in accordance with the retention policies of the respective recipients and applicable laws.
     The Company retains such information internally in accordance with Article 5 of this Privacy Policy.

※ The Company obtains the user's consent where required by applicable law.

Article 7 (Data Processing by Service Providers)

We engage trusted service providers:
1. Service Status

Article 8 (Cross-Border Data Transfers)

Due to the nature of our services, personal information may be transferred to service providers located outside Korea, including the United States.
Transfers are conducted through encrypted communication channels.
You may refuse consent to cross-border transfer; however, certain services (e.g., international payment, email delivery) may become unavailable.

Article 9 (Cookies)

We use cookies to improve user experience and analyze service usage.
You may disable cookies through your browser settings. However, certain features may not function properly if cookies are disabled.

Article 10 (Your Rights)

You have the right to:

• Access your personal information
• Request correction or deletion
• Request suspension of processing
• Withdraw consent

Article 11 (Children's Privacy)

Our services are not directed to children under 13 years of age.
We do not knowingly collect personal information from children under 13 without verifiable parental consent. If we become aware that such information has been collected, we will take appropriate steps to delete it.

Article 12 (Security Measures)

We implement appropriate technical and organizational measures, including:

• Access control based on role
• Encryption of sensitive data
• Logging and monitoring
• Security software and vulnerability management
• Internal data protection policies

Article 13 (Data Protection Officer)

• Data Protection Officer: Ben Hough
• Email: privacy@shuttledelivery.co.kr
• Phone: +82-2-1661-8482

Article 14 (Dispute Resolution)

For privacy-related complaints under Korean law, users may contact:

• Personal Information Infringement Report Center
• Personal Information Dispute Mediation Committee
• Supreme Prosecutors' Office (Cyber Crime)
• National Police Agency (Cyber Bureau)

Article 15 (Changes to This Policy)

We may update this Privacy Policy from time to time. Material changes will be announced in advance through our website.

Article 16 (Special Notice for U.S. Military Personnel and International Users)

Shuttle Co., Ltd. operates under the laws of the Republic of Korea. Our services are provided by a Korean company and are not affiliated with, endorsed by, or operated on behalf of the United States Department of Defense (DoD) or any U.S. government entity. If you are a member of the U.S. Armed Forces, a military family member, or an international user:

1. Your personal information is processed in accordance with applicable Korean data protection laws.
2. Your personal information is not shared with the U.S. military or any government authority unless required by applicable law.
3. Certain personal information may be processed or stored outside of Korea due to the use of global service providers (such as payment processors, cloud hosting services, email and messaging providers), as described in this Privacy Policy.
4. All personal information, including information relating to U.S. military personnel and international users, is protected using commercially reasonable technical and organizational safeguards. These safeguards include encrypted transmission, restricted access controls, monitoring, and contractual limitations on third-party service providers.
5. By using our services, you acknowledge that your personal information may be transferred internationally as described in this Privacy Policy.