Privacy Policy

Applicable Region — This Privacy Policy applies to Service Provider personnel residing in the European Economic Area (EEA), the United Kingdom, and other jurisdictions outside South Korea and Japan. Residents of Korea should refer to the Korean version. Residents of Japan should refer to the Japanese version when published.

Roovook Inc. (the "Company", "we", "us", or "our") protects the personal data of its Service Providers (Service Provider personnel) in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the ePrivacy Directive (2002/58/EC), the UK GDPR and Data Protection Act 2018, and other applicable data-protection laws. We provide this Privacy Policy to explain clearly how we process personal data and how data subjects can exercise their rights.

This Policy governs the personal data of Service Provider personnel (hotel / venue sales staff) collected and processed through business.roovook.com (the product marketing site), the EMS Dashboard (ems.roovook.com), and the email-integration feature. Personal data of general end-users (event organisers, booking requesters, and so on) is covered by the separate B2C Privacy Policy.

Article 1 (Purposes and Lawful Bases of Processing)

We process personal data for the purposes set out below. Each purpose is tied to one or more lawful bases under Article 6 GDPR. Personal data will not be used beyond these purposes; where purposes change materially, we will obtain fresh consent or rely on another appropriate lawful basis, with prior notice.

Note: Cross-border transfers additionally rely on Chapter V safeguards (Standard Contractual Clauses) as detailed in Article 6.

Article 2 (Categories of Personal Data Collected)

(1) Service Provider personnel account information

(2) Demo / adoption-inquiry submissions

(3) Data collected during email integration

• OAuth 2.0 method (Microsoft Outlook, Gmail): email subjects, bodies, attachments, sender/recipient information, and email metadata (date, read status, folder information). Data is accessed only within the scope explicitly authorised by the user through the OAuth 2.0 consent screen; the user's email password is never stored by Roovook.
  • Gmail API scopes: gmail.readonly, gmail.send, gmail.modify, gmail.settings.basic, userinfo.email
  • Microsoft Graph API scopes: Mail.ReadWrite, Mail.Send, User.Read, offline_access
• IMAP/POP3 method: email address, password or app-specific password, mail-server address (IMAP/POP3/SMTP), port numbers. These credentials are encrypted at rest using AES-256 and stored in access-controlled systems. Accessed data includes email subjects, bodies, attachments, sender/recipient information, and metadata.

(4) Data collected automatically during service use

• IP address, access timestamps, access logs, and page-use records
• Device information (model, operating-system version), browser information
• Information collected via cookies and similar tracking technologies

(5) Data collected via messenger connector integration

• Slack/Teams workspace identifier, channel identifier, webhook URL or bot token
• Notification payload content (inquiry customer name, inquiry summary, associated venue/property)
• Installation metadata (installer user identifier, installation timestamp)
• OAuth 2.0 access and refresh tokens (Slack) or app-authorisation record (Teams), encrypted at rest

We do not collect national-identification numbers, passport numbers, driving-licence numbers, or other unique government-issued identifiers from Service Provider personnel.

Article 3 (Retention Periods)

We retain personal data only for as long as necessary to achieve the processing purpose, or for the period required by applicable law, whichever is longer.

• Default: Personal data is deleted without undue delay once the purpose is achieved.
• EMS account information: Retained for the duration of the SaaS subscription; deleted within 30 days of subscription termination.
• Email-integration data: Deleted immediately upon disconnection of the integration; OAuth 2.0 access tokens and refresh tokens are revoked and discarded at that point. On account termination, all integration-related data is deleted within 30 days.
• Demo / adoption-inquiry data: Retained for 1 year after the inquiry is resolved; if a contract is concluded, retained for the duration of the contract.
• Legal-retention obligations (where Korean consumer-protection records are involved for cross-border transactions):
  • Contract and order-withdrawal records — 5 years
  • Payment and supply records — 5 years
  • Website and app access logs — 3 months

Article 4 (Processors — Art. 28 GDPR)

We engage the following processors under Article 28 GDPR. Each processor is bound by a written agreement that requires (i) processing only on our documented instructions, (ii) confidentiality commitments for authorised personnel, (iii) appropriate technical and organisational security measures, (iv) engagement of sub-processors only with prior authorisation, (v) assistance with data-subject rights and breach response, and (vi) deletion or return of personal data at the end of the engagement.

Where we add or replace a processor, we will update this Policy and give advance notice before the change takes effect.

Article 5 (Role Allocation — Controller / Processor)

Roovook's role under Art. 28 GDPR varies by data type:

(a) Service Provider personnel data (name, work email, role, EMS account credentials) — Roovook acts as controller for account management, authentication, and billing (Art. 2 items 1, 2, 4).

(b) Email inbox content processed via OAuth (Gmail / Microsoft Graph) and messenger notification content (Slack / Teams) — Roovook acts as processor on behalf of the Service Provider (the employing hotel/venue), which is the controller for its own business communications and for any third-party personal data contained therein. Roovook processes such data strictly on documented instructions from the Service Provider (embodied in the EMS Terms of Service and the Data Processing Agreement).

(c) Upstream providers — Google (Gmail API, Gemini) and Microsoft (Graph API, Teams) act as independent controllers in respect of their direct end-user relationships, and as sub-processors to Roovook for the specific data accessed on behalf of the Service Provider under this scope.

Article 6 (International Transfers — Art. 44–49 GDPR)

To operate the service we rely on cloud, AI, and email-platform services located outside the EEA and the United Kingdom. The following transfers take place:

Roovook's core Google Cloud Platform infrastructure (Cloud Run, App Engine, Cloud SQL, Cloud Storage, and related services) operates in the asia-northeast1 (Tokyo) region. User data stored on this infrastructure physically resides in Japan. Transfers from the EEA or United Kingdom to Japan are covered by the European Commission's adequacy decision for Japan (Commission Implementing Decision (EU) 2019/419, and the analogous UK adequacy regulations); no further supplementary safeguards (such as Standard Contractual Clauses) are required for this data location. The transfers listed in the table below apply only to data shared with providers or entrustees outside Japan.

Note: The Google LLC GCP infrastructure transfer previously listed in this table is covered by the Japan adequacy decision and is no longer enumerated separately. It is disclosed in Article 4 (Processors).

Adequacy references: Japan benefits from an EU adequacy decision under Article 45 GDPR (Commission Implementing Decision (EU) 2019/419), so transfers from the EEA to Japanese recipients do not require additional safeguards. The Republic of Korea similarly benefits from an EU adequacy decision (Commission Implementing Decision (EU) 2022/254) of 17 December 2021.

Service Provider personnel have the right to object to cross-border transfers that rely on consent. Objecting may limit the availability of some features; we will explain the impact before processing the objection.

Article 7 (Management of Email-Integration Data)

(1) Disconnection and permission revocation

A user may disconnect the email integration at any time:

• Within EMS: Settings menu → disconnect the email account.
• Microsoft Outlook: revoke the "Roovook EMS" permission at account.microsoft.com/consent/manage. For Microsoft 365 organisational accounts, administrators can revoke app consent at entra.microsoft.com.
• Gmail: revoke the "Roovook EMS" permission at myaccount.google.com/permissions.
• IMAP/POP3: disconnecting in EMS triggers immediate deletion of the stored credentials (including passwords).

On disconnection, cached email data and OAuth 2.0 tokens are immediately deleted and revoked.

(2) Data-deletion requests

Independent of integration disconnection, a user may request deletion of specific data by emailing support@roovook.com; we process such requests within 30 days. On account termination, all email-integration data (cache, tokens, metadata) is fully deleted within 30 days.

(3) Access limitations

Roovook processes email data exclusively through automated systems; staff do not inspect individual email content directly. Access by staff is permitted only with the user's explicit consent (e.g., technical support), for security-incident investigation, or to fulfil a legal obligation, and is logged.

Article 8 (Google API Services User Data Policy)

1. Roovook's use of Gmail API data, and any transfer of information received from the Gmail API to other apps, complies with the Google API Services User Data Policy, including the Limited Use requirements.
2. Roovook does not use Google Workspace API data to develop, improve, or train generalised AI and/or ML models.
3. Email data accessed via the Gmail API is used solely to provide the user-requested email-management features (read, compose, send).
4. Roovook does not sell Gmail-API-derived user data to advertising platforms, data brokers, or other third parties.
5. Roovook does not use Gmail-API-derived user data for advertising purposes, including retargeting, personalised advertising, and interest-based advertising.
6. Roovook does not use Gmail-API-derived user data for credit assessment, loan-underwriting, or similar purposes.

Microsoft Graph API Compliance

Our use of information received from the Microsoft Graph API adheres to the Microsoft Graph API Terms of Use and the Microsoft Services Agreement. Data accessed via Microsoft Graph is used solely to provide the user-requested email-management features; it is not used to train generalised AI or ML models, and is not transferred or sold to third parties.

Article 9 (Cookies and Automatic Collection — ePrivacy + Art. 7 GDPR)

(1) What cookies are

Cookies are small files that a website transmits to the user's browser and which may be stored on the user's device. We use cookies and similar tracking technologies to operate the service and to provide certain features.

(2) Consent model — prior opt-in with reject-all parity

• Strictly-necessary cookies (login session, security, CSRF protection): set on service use; no consent is required pursuant to Article 5(3) of the ePrivacy Directive.
• Functional, analytics, and marketing cookies: set only after the user has given prior, informed, freely given, specific, and unambiguous opt-in via our cookie banner. The banner provides "Accept all" and "Reject all" with equivalent visual prominence. Consent is recorded, revocable at any time, and can be adjusted via the "Cookie Preferences" link in the site footer.

(3) Third-party tools (loaded only with the relevant consent)

Roovook does not use marketing pixels such as Meta Pixel or TikTok Pixel. The Facebook SDK is used exclusively for social login authentication and is distinct from the behavioural-tracking Meta Pixel.

Information collected by these tools includes cookie identifiers, IP address, device/browser metadata, and page-use records. Social-login SDKs process only the minimum data needed for authentication (account identifier, authentication token); names, phone numbers, and other identifiers are not passed to analytics tools.

(4) Rejecting cookies

A user may decline cookies at any time via (i) the cookie banner (available on first visit and re-invocable from the "Cookie Preferences" link), or (ii) browser settings. Rejecting strictly-necessary cookies may impair core service functionality.

Article 10 (Security Measures — Art. 32 GDPR)

Taking into account the state of the art, implementation cost, and the nature, scope, context, and purposes of processing, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk:

1. Organisational measures: written internal security plan; periodic data-protection training for staff and processors; role-based access-control procedures; documented incident-response playbook; annual CASA security assessment for Gmail restricted scopes.
2. Technical measures: access control to personal-data processing systems; encryption of passwords and key personal data at rest (AES-256, including IMAP/POP3 credentials) and in transit (TLS 1.2+); intrusion-detection and intrusion-prevention systems; log retention and periodic log review; OAuth-token rotation and revocation tracking; anti-malware controls.
3. Physical measures: controlled access to server rooms and document-storage facilities.
4. Resilience: Systems are designed to maintain confidentiality, integrity, availability and resilience of processing, including redundancy, failover, and load balancing across multiple Google Cloud zones (Art. 32(1)(b)).
5. Restoration: We maintain daily encrypted backups with documented restoration procedures, tested quarterly, to ensure timely recovery from incidents (Art. 32(1)(c)).
6. Testing: Security controls are subject to regular testing, assessment and evaluation, including annual penetration tests and ongoing vulnerability scans (Art. 32(1)(d)).

Article 11 (Personal Data Breach Response — Art. 33–34 GDPR)

• Supervisory authority notification (Art. 33): On becoming aware of a personal-data breach, we notify the competent supervisory authority without undue delay and, where feasible, not later than 72 hours after awareness, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where notification is not made within 72 hours, we accompany the delayed notification with reasons for the delay.
• Data-subject notification (Art. 34): Where a breach is likely to result in a high risk to the rights and freedoms of natural persons, we communicate the breach to affected data subjects without undue delay, in clear and plain language, describing the nature of the breach, the likely consequences, and the measures taken or proposed.
• Controller notification where Roovook acts as processor: Where Roovook processes personal data on behalf of a Service Provider as processor (Article 5), we notify the relevant Service Provider (controller) without undue delay upon becoming aware of a breach, in accordance with Art. 33(2) GDPR and the applicable DPA.
• Internal logging: We document all breaches, their effects, and the remedial action taken, in a breach register made available to the supervisory authority on request.

Article 12 (Data-Subject Rights — Art. 15–22 GDPR)

Subject to the conditions in the GDPR, Service Provider personnel have the following rights with respect to their personal data:

How to exercise: Contact us by email (support@roovook.com) or via the in-product support form. We will respond within one month (30 days) of receipt pursuant to Art. 12(3) GDPR; this period may be extended by up to two further months for complex or numerous requests, in which case we will notify you of the extension and the reasons within the first month. No fee is charged unless the request is manifestly unfounded or excessive.

Where Roovook acts as processor (email integration and messenger connector), requests concerning that data should be directed first to the Service Provider (controller); Roovook will assist the controller in responding, as required by Art. 28(3)(e) GDPR.

Verification: We may ask for information reasonably necessary to confirm your identity. A data subject may also act through an authorised representative on presentation of valid authority.

Article 13 (Consent Withdrawal — Art. 7(3) GDPR)

Where processing is based on consent, you have the right to withdraw your consent at any time, as easily as you gave it, without affecting the lawfulness of processing based on consent before its withdrawal.

Concrete withdrawal paths:

• Email integration: disconnect in EMS Settings, or revoke the app permission directly in Google / Microsoft account settings (see Article 7).
• Messenger connector (Slack, Teams): disconnect in EMS Settings or uninstall the app from the Slack/Teams workspace.
• Marketing communications: unsubscribe link at the foot of every marketing email, or in account settings under "Communication preferences".
• Non-essential cookies: the "Cookie Preferences" link in the site footer (re-invokes the cookie banner with Reject-all parity).
• Cross-border transfer consent: by emailing support@roovook.com. We will confirm the scope of service that can still be provided without the transfer.
• Account and all consent-based processing: by closing your account via account settings, or by emailing support@roovook.com.

Withdrawing consent does not affect other lawful bases that may still apply to the same data (for example, statutory retention or SaaS-contract performance).

Article 14 (Data Protection Officer and Supervisory Authorities)

Data Protection Officer (DPO) / Privacy Contact

• Name: Sungmo Kim
• Email: support@roovook.com
• Company: Roovook Inc.
• Japan-market alternative contact: support@roovook.com

EU Representative (Art. 27 GDPR)

Roovook has not appointed an EU representative under Article 27 at this time; our processing of EEA residents' data presently occurs on an occasional, low-risk basis. On formal EU market expansion we will appoint and publish an Article 27 representative, with designated contact details, by updating this Policy prior to launch.

Supervisory authorities

Data subjects in the EEA have the right to lodge a complaint with the data protection authority in their EU member state. The directory of supervisory authorities is maintained by the European Data Protection Board at edpb.europa.eu. UK residents may contact the Information Commissioner's Office (ICO) at ico.org.uk.

Article 15 (Revision History and Notice)

This Policy takes effect on its effective date. Where we make additions, deletions, or corrections driven by law or policy changes, we will publish the amended Policy via in-service notice at least 7 days before effect; for changes that are materially adverse to data subjects, we will give at least 30 days' prior notice and, where required, obtain fresh consent.

Last updated: 24 April 2026