GT Tour Co., Ltd. (the "Company") handles the personal information of foreign travelers and users carefully and complies with the Personal Information Protection Act of the Republic of Korea and related laws. Through this Privacy Policy, the Company informs users of the purposes and methods of use of the personal information they provide, and of the measures taken to protect that information.

1. Personal Information Collected and Collection Methods

The Company collects only the minimum personal information necessary to provide services, conclude and perform reservations, and handle customer inquiries. Booking services on this platform are available after membership registration. Guest (non-member) booking is not provided.

A. Items Collected

Category	Items Collected	Purpose of Collection
Membership registration	Email (ID), password, name, nationality, contact information, date of birth, gender, mobile messenger ID, etc.	Member identification, service use, and membership management
SNS easy login	Social account unique identifier (UID), email, profile name, etc.	Easy sign-up and account verification
Tour and cultural experience booking	Name of the booker and companions (passport English name), date of birth, gender, nationality, contact information, mobile messenger ID (WhatsApp, KakaoTalk, etc.), hotel/pickup location, etc.	Issuing tour vouchers, on-site escort and pickup services, emergency contact
K-beauty and medical-related booking	Name (passport English name), date of birth, gender, desired consultation schedule, etc.	Proxy pre-registration for medical consultation, assigning dedicated interpretation, and assisting 1:1 care services
Unique identification information	Passport number (only when using the relevant service, such as foreign-patient registration and duty-free/admission procedures)	Foreign-patient registration, preparation of duty-free forms, and pre-registration for treatment
Sensitive information	Desired consultation/treatment area, etc. (only for K-beauty and medical-related bookings)	Confirming customized consultation schedules and proxy pre-registration with medical institutions
Customer inquiries	Name, contact information, email, inquiry details, etc.	Customer consultation and handling of complaints and issues
Payment and settlement	Credit card payment information (card issuer, approval number, and other PG-encrypted tokens), refund account information (for bank transfer), etc.	Payment of product fees, cancellation fee settlement, and refund processing
Automatically generated during service use	IP address, cookies, access logs, service usage records, device information, etc.	Fraud prevention, service statistics, and environment optimization

B. Collection Methods

• Website membership registration, product booking forms, and 1:1 customer center inquiry boards
• Collection through official customer consultation channels and mobile messengers
• Automatic generation and collection through log analysis tools during service use

2. Purpose of Use of Personal Information

The Company uses collected personal information only for the purposes below. If the purpose changes, separate prior consent will be obtained.

• Service provision and contract performance: inbound tours, cultural experiences, wellness/beauty and medical consultation booking agency, dedicated transport and interpretation support, electronic voucher issuance
• Customer support and on-site response: post-arrival itinerary change notices, on-site meeting guidance, emergency contact to prevent lateness and no-shows, handling complaints and issues
• Membership management and security: identity verification, prevention of unauthorized use, monitoring of unauthorized macros and fraudulent card use
• Marketing and statistics: multilingual new tour recommendations, promotional notices (only to those who have consented), analysis of usage trends by country

3. Provision of Personal Information to Third Parties

In principle, the Company does not provide users' personal information to outside parties. However, the minimum information necessary is provided to independent third parties (suppliers) as below for the smooth performance of inbound booking and travel services for foreign visitors.

Recipient	Purpose of Provision	Items Provided	Retention and Use Period
Partner medical institutions and wellness/beauty partners (dermatology, plastic surgery, spa, etc.)	Pre-registration of foreign patients, confirmation of customized consultation schedules, and preparation of duty-free forms	English name, date of birth, gender, nationality, passport number (if applicable), desired treatment/consultation area	Destroyed when the statutory retention period expires after completion of treatment and service
Local tour/transport suppliers and guides	Tour dispatch, airport pickup/drop-off, dedicated guide accompaniment, and on-site identity verification	English name, contact information, mobile messenger ID, hotel/pickup location	Destroyed when the statutory retention period expires after the tour schedule ends
Partner organizers of cultural events, exhibitions, and experience venues	Advance reservation list confirmation, mobile/on-site voucher exchange, and identity verification	Booking number, English name, date of birth, contact information	Destroyed when the statutory retention period expires after the end of attendance and use of the event
EMS (Express Mail Service) (Korea Post)	International delivery of goods, customs clearance, and shipment tracking	Recipient name, address, contact information, and information required for customs clearance, etc.	Destroyed when the statutory retention period expires after delivery is completed

※ Users may refuse consent to third-party provision. However, refusal may make it impossible to confirm the booking and provide the relevant partner product or service.

4. Entrustment of Personal Information Processing

The Company entrusts personal information processing to specialized companies as follows for smooth system operation and payment convenience.

Trustee	Entrusted Work
Payment gateway (PG)	Credit card, easy-pay, and multilingual overseas payment approval, payment cancellation, and settlement
System development and cloud infrastructure partners	Server infrastructure hosting, database storage, and system security maintenance
Notification and messaging service providers	Booking confirmation notices, My Page comment notices, and guidance email dispatch

5. Retention and Destruction of Personal Information

1. Member information is retained and used until membership withdrawal. When a member withdraws or the purpose of collection and use has been achieved, the Company destroys the relevant information without delay in a manner that cannot be restored. Personal information used for marketing is destroyed without delay if the relevant consent to receive such information is withdrawn.
2. However, where retention is required under the Act on Consumer Protection in Electronic Commerce and other related laws, the Company stores the information separately for the period prescribed by law:
   • Records on contracts or withdrawal of offers: 5 years
   • Records on payment and supply of goods: 5 years
   • Records on consumer complaints or dispute resolution: 3 years
   • Website access records (logs): 3 months
   Thereafter, the information may continue to be stored until the member withdraws, for the convenience of service use and history inquiry.
3. Destruction method: Personal information recorded in electronic files is permanently deleted using technical methods that prevent recovery, and printouts are shredded.

6. Rights of Users and Legal Representatives and How to Exercise Them

1. Users (including foreign customers) may view or correct their personal information at any time through the [My Page] menu on the platform, and may withdraw consent to collection by requesting membership withdrawal.
2. Users may request deletion or suspension of processing of personal information through the customer center inquiry board or email. The Company will take action without delay after identity verification.
3. Processing of personal information of children under 14 years of age requires the consent of a legal representative. Without such consent, membership registration and use of the services are restricted.

7. Use of Cookies and How to Refuse Them

The Company uses cookies to provide services and analyze usage statistics. Users may refuse or delete cookies through their web browser settings.

• Essential cookies: Required to provide services, including maintaining login sessions and security. Refusing them may restrict some functions such as login.
• Analytics cookies: Used to analyze access and service usage statistics through Google Analytics. Storage may be refused through browser settings.

8. Measures to Ensure the Security of Personal Information

The Company takes the following measures to prevent loss, theft, leakage, or alteration of personal information:

• Encrypted storage of passwords and unique identification information (such as passport numbers) and application of SSL on transmission channels
• Minimizing personnel who handle personal information and conducting regular security training
• Operating firewalls and controlling server access to block external intrusion

9. Personal Information Protection Officer and Inquiry Desk

The Company designates a personal information protection officer as follows to handle inquiries and complaints related to users' personal information.

Category	Contact Information
Personal Information Protection Officer	Name: Yeom Cheol-ho / Title: CEO
Customer support and inquiries	Email: admin@gttourkorea.com Phone: 02-548-0190 (Korea)

10. Remedies for Infringement of Rights

If you need to report or consult regarding an infringement of personal information, you may contact the following institution.

• Personal Information Infringement Report Center: privacy.go.kr / 118 (no area code) (Korea)