Privacy policy

To process a booking the company collects the following details the user enters on the checkout screen: email, phone number (country code, area code and number), the family and given name of the guest for each room, billing details (name, address, city, postal code and country; everything except the country is optional), whether a smoking room is requested, and any special request to pass to the property (optional).

When a user asks an AI assistant (such as Claude or ChatGPT) for a payment link and gives it the guest details, the checkout screen opens filled in with them. The items are the email, the phone number (country code, area code and number), the family and given name of the guest for each room, a special request to pass to the property (optional), and the billing name (when the guest's name is not in Latin letters). If the assistant sends them through the company's connector, which the user added to the assistant themselves, the company receives and keeps them. If the assistant puts them in the payment link, only the user's browser reads them, and the company receives nothing until the user submits the booking on the checkout screen. The company uses them only to fill in the checkout screen in advance.

To look up a booking the company asks for the reference number or the itinerary ID and the email used for the booking.

The company does not collect card numbers or other payment details on the site. Toss Payments Co., Ltd. collects and processes them on its own payment screen.

The site stores some information in the user's browser to run the booking and a few conveniences. What it stores, where, and for how long is set out in section 10, Cookies and browser storage.

The site collects usage records automatically with Google Analytics for visit statistics. What it collects and how long it is kept is set out in section 10, Cookies and browser storage.

The company does not collect the personal data of a child under 14. On learning that it has, the company destroys it without delay and asks the accommodation supplier to delete it too.

Forming and fulfilling the booking: to request and confirm the booking with the accommodation supplier and the property.

Filling in the checkout in advance: to fill in the checkout screen with the guest details the user gave an AI assistant.

Confirmation and contact: to send booking confirmation details, to notify changes and cancellations, and for the property to reach the guest in an emergency.

Looking up, changing and cancelling: to identify the user's own booking with the reference number or the itinerary ID and the email.

Billing and settlement: to verify the billing address and process payment.

Disputes and legal compliance: to handle consumer complaints and to keep the transaction records the law requires.

Visit statistics and service improvement: to learn how much the site's screens and booking steps are used, and to improve the site.

The company destroys personal data without delay once the booking has been processed and the purpose of collection is fulfilled, except that the following records are kept for the period the law prescribes.

Under the Act on Consumer Protection in Electronic Commerce: records on contracts and withdrawals for 5 years, records on payment and supply of goods or services for 5 years, records on consumer complaints and dispute handling for 3 years, and records on labelling and advertising for 6 months.

Guest details an AI assistant passes through the connector are deleted from the server when the user first opens the checkout screen, and within 1 hour of being passed if the screen is never opened. Guest details in a payment link are not stored on the company's server; how long the browser keeps them is set out in 10. Cookies and browser storage.

To fulfil the booking the company provides personal data to third parties as follows. The user consents to this on the checkout screen; without that consent a booking cannot be made.

Recipients: the accommodation supplier and the property the user booked.

Data provided: guest names, email, phone number, billing details, smoking-room request and special requests.

Recipients' purpose: confirming and managing the booking, identifying the guest, handling changes and cancellations, and the property's preparation for the stay.

Recipients' retention: until the booking has been fulfilled, except that the accommodation supplier and the property may keep records for the period required by the law that applies to them.

The accommodation supplier and properties outside Korea are located outside the Republic of Korea, so the provision in section 4 is a cross-border transfer under Article 28-8 of the Personal Information Protection Act. The user consents to this transfer on the checkout screen.

Recipient: Expedia, Inc., a Washington corporation. Its registered office is 1111 Expedia Group Way W, Seattle, WA 98119, USA, and its privacy contact is privacy@expedia.com.

The supplier of the hotel reservation is Travelscape, LLC. Its registered office is 5000 W. Kearney Street, Springfield, MO 65803, USA.

The property the user booked is a recipient too. A property is not settled until the booking is made, so its name and address are given in the confirmation e-mail and on the booking page.

Destination countries: the country where the accommodation supplier operates and the country where the property is located.

Time and method: transmitted over an encrypted connection at the moment the user submits the booking.

Data transferred, recipients' purpose and retention: as in section 4.

How to refuse and the consequence: leave the consent box on the checkout screen unchecked and nothing is transferred. In that case the booking cannot proceed.

Usage records for visit statistics are transferred abroad too. This transfer happens whether or not the user books, as follows.

Recipient: Google LLC, a Delaware limited liability company. Its address is 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and its privacy contact is https://support.google.com/policies.

Destination country, time and method: the United States. Transmitted over an encrypted connection each time the user opens a screen on the site.

Data transferred: a cookie identifier, the address and title of each screen visited, the address of the previous screen or of the site the user came from, device and browser information, approximate region, the name of the region searched and the properties and amounts shown in the search results, the property, room, amount and itinerary ID seen on the property screen and during the booking steps, and why the property screen could show no rates and the kind of error. Before an address is sent, the company removes its query parameters. It keeps only the utm_ parameters that name where a visit came from, the ad click identifiers (gclid, gbraid, wbraid, dclid) and the region number on the search screen.

Recipient's purpose and retention: visit statistics. Under the company's data-sharing settings, Google also uses the data to improve its own products and services. Google keeps the data for 14 months from collection.

How to refuse and the consequence: install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout) and nothing is transferred. Refusing does not limit the use of the site.

The company entrusts the processing of personal data as follows.

Processor: Toss Payments Co., Ltd. Entrusted work: taking and reversing payment. Your name and e-mail reach Toss Payments directly when the payment screen opens.

Processor: Amazon Web Services Inc. Entrusted work: server hosting, and sending the booking e-mails.

Processor: Google LLC. Entrusted work: collecting and analysing visit statistics (Google Analytics).

Processor: MongoDB, Inc. Entrusted work: database hosting, including keeping the guest details an AI assistant passes through the connector, encrypted, until the checkout screen opens.

Each contract sets out the data-protection terms required by Article 26 of the Personal Information Protection Act, and the company supervises the processor. This policy is amended when the entrusted work or the processor changes.

Card details are outside what the company entrusts. Toss Payments collects and processes them directly, under its own privacy policy.

Users may at any time request access to, correction or deletion of, or suspension of the processing of their personal data.

Guest details included in a booking can be edited directly under My booking. Any other request can be made to the privacy officer in writing, by phone or by email, and the company acts on it without delay.

A legal representative or an authorised person may also exercise these rights, in which case a power of attorney in the form prescribed by the Enforcement Rules of the Personal Information Protection Act must be submitted.

Requests for deletion or suspension may be limited for data the law requires the company to keep.

The company destroys personal data without delay when the retention period ends or the purpose of processing is fulfilled. Electronic files are deleted in a way that prevents recovery; paper documents are shredded or incinerated.

Personal data is transmitted only over encrypted connections, and payment details never pass through the site.

Access to personal data is limited to the minimum number of people, and access rights are managed.

The email, phone number, names and billing details the user enters are never put in a cookie or in local storage. When the site has to hold them in the browser, it uses session storage only, which the browser clears when the tab is closed.

Using the site stores the following in the user's browser. No cookies are used for advertising.

The cookie named cur: remembers the display currency the user chose (one of KRW, USD and JPY). It is set when the user picks a currency, and the browser deletes it one year after the last pick.

The cookie named analytics_consent: remembers the answer the user gave on the cookie consent banner. Its value is granted when the user accepts and denied when the user declines. It is set only on the English site, never on the Korean site. It is set when the user answers the banner, and the browser deletes it six months after the last answer. Only the company's own site reads this cookie, and it is not shared with any third party, Google included. The user can change the answer with Cookie settings at the bottom of the page. Changing an acceptance to a refusal makes the site delete the cookie _ga and the cookies whose names start with _ga_.

Recent searches and recently viewed properties: kept in local storage so the home page can show them again. A recent search holds the destination, the dates, and the number of rooms and guests including the children's ages, up to 5 searches. A recently viewed property holds its name, photo address and city, and the dates and guests chosen when it was viewed, up to 6 properties. The company does not store these lists on its servers. They have no expiry and stay until the user deletes them, with the Clear button on the home page or in the browser settings.

The following four are kept in session storage, which the browser clears when the tab is closed.

The room and rate chosen: when the user picks a rate on the room list or the checkout screen, or opens a payment link made by an AI assistant, the property, room, rate, dates, guests, the price shown and the cancellation terms are stored. If the user opened a payment link an AI assistant made through the connector, the link's identifier is stored as well. The checkout screen uses it once to load the guest details the assistant passed. When the user consents and submits the booking on the checkout screen, the time of consent is added. The checkout and confirmation screens read it.

The guest details in a payment link: when an AI assistant puts guest details after the # of a payment link, the screen the link opens removes them from the address and stores them in session storage. The browser never sends the part of an address after # to the company's server, and the company does not send these details to Google Analytics either. When a checkout screen first opens, the site reads them, fills the checkout screen in with them and deletes them at once. Read more than 30 minutes after they were stored, they are deleted without filling anything. If no checkout screen opens, the browser deletes them when the tab is closed.

The booking details before payment: when the user presses the pay button, the email, phone number, guest names, smoking-room request, special requests and billing details entered on the checkout screen are stored with the amount and the reference number. Going to the payment screen clears the checkout screen, so they are used to complete the booking on return. When the payment screen sends the user back to the checkout screen with a payment result, successful or not, the site reads them and deletes them at once. When the payment window is closed, or fails, without leaving the page, the site deletes them at once. If the user never comes back to the checkout screen from the payment screen, the browser deletes them when the tab is closed.

The lookup details: when the user presses Check under My booking on a screen where a booking request failed, the reference number and email of that request are stored. When the My booking screen opens, the site fills them into the lookup form and deletes them at once. This keeps the email out of the link.

Values set by Toss Payments: when the checkout screen shows the Toss Payments payment-method selector, the Toss Payments payment script stores a random value identifying the browser in local storage and a random value identifying the payment session in session storage. Toss Payments manages these values, and the company does not read them. The value in local storage has no expiry and can be deleted in the browser settings.

Google Analytics cookies: the company uses Google Analytics, by Google LLC, for visit statistics and service improvement. On the Korean site the Google Analytics script loads when the user opens a screen. On the English site it loads only after the user accepts the cookie consent banner, and nothing is sent to Google before that. The script stores a random value identifying the browser in the cookie _ga, and the visit-session details in a cookie whose name starts with _ga_. The browser deletes these cookies two years after the last visit. With the cookie identifier, Google Analytics collects the address and title of each screen visited, the address of the previous screen or of the site the user came from, device and browser information, approximate region, the name of the region searched and the properties and amounts shown in the search results, the property, room, amount and itinerary ID seen on the property screen and during the booking steps, and why the property screen could show no rates and the kind of error. Before an address is sent, the company removes its query parameters. It keeps only the utm_ parameters that name where a visit came from, the ad click identifiers (gclid, gbraid, wbraid, dclid) and the region number on the search screen. The region is estimated from the IP address, and Google Analytics does not store the IP address itself. No name, e-mail or phone number is sent. Google keeps the collected data for 14 months, then deletes it. On the English site, users can also decline on the cookie consent banner, or change an acceptance to a refusal in Cookie settings. Users can refuse cookies in their browser settings, or refuse the collection by installing the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout). Refusing does not limit the use of the site.

Users can refuse cookies, or delete cookies and stored data, in their browser settings. If cookies are refused, the chosen currency is not kept.

The company appoints a privacy officer who oversees the processing of personal data and handles complaints and remedies. The officer's name is shown in the business information on this page. The officer is reached through the company phone number and email shown there.

Users can report or seek advice on a personal data infringement from the following bodies: the Personal Information Infringement Report Center (118), the Personal Information Dispute Mediation Committee (1833-6972), the Cybercrime Investigation Division of the Supreme Prosecutors' Office (1301) and the Cyber Bureau of the Korean National Police Agency (182).

A change to this policy is announced on the site at least 7 days before it takes effect; a change that materially affects users' rights is announced at least 30 days in advance.

This policy applies from the day it is posted on the site.