Effective date: October 2026
HOLIDAY TOUR, operated by Holiday Tour Inc., is a B2C online travel and transportation booking platform at holidaykr.com where international visitors and domestic travelers can search, book, and pay for Korea tours, private transfers, shuttles, guided experiences, and tickets.
This Privacy Policy has been established pursuant to Article 30 of the Personal Information Protection Act and related notices to clearly inform data subjects (hereinafter, 'Users') about the collection, use, provision, destruction of personal information, and the rights of data subjects.
This Policy applies to general members and booking/payment users of holidaykr.com (B2C). Users of the B2B Partner Portal (partner.holidaykr.com) are subject to that portal's separate privacy policy.
We lawfully collect and process personal information only to the minimum extent necessary to provide services and perform contracts.
Personalized recommendations and usage statistics. (1) Usage statistics: only if you agree (on the web, by choosing "Analytics" in the cookie banner; in the app, by turning on "Help with usage statistics" in Settings), we store anonymous totals — the date, your country and language, and how many times a service, search term or product was opened. We do not store anything that identifies you, your device, your IP address or your session. Totals are kept for up to 90 days (product and service open totals: 13 months) and then deleted. Search terms with fewer than 5 searches are never shown, and terms that look like personal data (email addresses, phone numbers, links, numbers of 7 or more digits) are not stored. (2) Personalized recommendations: on the web, only if you agree to the "personalization" cookie; in the app, they are on by default and you can turn them off anytime in Settings ("Personalized recommendations"). The products you recently viewed, saved or booked stay on your device and are sent only with the request that builds your home screen; we do not store them. For push notifications we process only your device's notification token (Firebase), and we do not use advertising IDs, Android ID or IMEI. When personalization is off, we use only country-level and overall popularity.
Location and maps: your current location is used only when you choose a feature such as "Nearby search" (in the App, only while the App is open on your screen), and only to handle that request. We do not save it in our database, files or access logs; it stays only in the server's memory while the answer is prepared and in short-lived response caches that clear themselves within about 30 minutes. It is not linked to your name, account or device. To answer some requests (bus stops, nearby tourist places, taxi fare) the coordinates alone are passed to the public-data or route service that returns the answer (Korea Public Data Portal, Korea Tourism Organization, TMAP), without any information that identifies you. Map screens are drawn with NAVER Maps (NAVER Cloud): map requests (and, if you allow location access, your position on the map) are processed by NAVER to display the map. You can turn off location access at any time in your device settings.
| Member Type | Purpose of Collection and Use | Required Items | Retention and Use Period |
|---|---|---|---|
| B2C General Member | Membership approval, identity verification, prevention of duplicate registrations, and notifications of important information such as booking completion | Name, email address, password, country code, mobile phone number | Destroyed immediately upon membership withdrawal (except where legal mandatory retention periods apply) |
| Booking and Payment Customer | Payment authorization, guide assignment, issuance of flight/shuttle boarding passes, and processing of booking refunds | Passport number, English name, flight number, encrypted credit card information (card number, expiration date), mobile messenger ID | Retention of payment and withdrawal-of-offer records for 5 years pursuant to applicable laws (e-Commerce Act, etc.) |
| Website Visitor (members and non-members) | Stable operation of the website, anonymous visit statistics, and ordering of content by language, country and season | Collected automatically: language, country (worked out from your connection; your IP address is not stored for this and is not sent to third parties), browser/device type, pages visited, referring page, time on page. An anonymous visitor ID (a random UUID) is created only if you allow analytics. | Anonymous aggregate statistics: 13 months. The visitor ID stays on your device until you withdraw consent or clear your browser storage. IP addresses are not stored. |
When accepting membership or bookings from children under the age of 14, we provide practical verification methods (mobile phone identity verification, credit card verification, etc.) to obtain and confirm explicit consent from the legal guardian.
A legal guardian may at any time request access, correction, deletion, or suspension of processing of the child’s personal information, and we will take necessary measures without delay.
We do not provide personal information to third parties or disclose it externally beyond the scope of collection without the user's prior consent. However, for the actual fulfillment of reservations for global local rental cars, driver-guides, and resort and activity distributors in Gangwon-do and the outskirts of Seoul, we provide to third parties and conduct cross-border transfers as follows.
Specifications of cross-border data transfer:
Recipient of the data: Overseas local land operators and vehicle partners providing services as specified on the booking page
Purpose of transfer: Allocation of dedicated local vehicles overseas, passenger verification for shuttles and chartered guides, and response to local emergencies
Items transferred: English name, passport number, mobile messenger ID (WhatsApp/LINE/WeChat), flight number, date of use
Method and timing of transfer: Real-time transmission over a secure network (SSL/TLS) upon completion of booking payment
Retention and use period: Destroyed immediately after service use and settlement are completed; however, if retention is mandated under applicable local tax laws overseas, such laws will be observed
Users have the right to refuse the above cross-border transfers; however, refusal may restrict reservations for overseas local products and registration/use of the platform.
When personal information becomes unnecessary due to the expiration of the retention period, achievement of the processing purpose, etc., we destroy such personal information without delay (typically within 5 days).
Information in electronic file form is deleted using technical methods that render records irrecoverable (e.g., low-level format), and personal information printed on paper is destroyed by shredding or incineration.
Visit statistics are kept only in anonymous aggregate form for 13 months and are then deleted. Backup copies kept for security and recovery are stored for up to 7 days and then deleted; backup copies that still contain past visit records will be deleted by October 31, 2026.
To protect users' personal information rights and handle grievances and inquiries related to personal information smoothly, we designate the following Personal Information Protection Officer.
Personal Information Protection Officer: CEO Park Un-yong
Dedicated department for complaint handling: Platform Information Security Team
Email and main phone: info@holidaykr.com | +82-32-657-8888
For booking fulfillment, the Company may entrust limited processing of personal information to payment processors, booking system providers, local land operators, driver-guides, vehicle companies, hotels, resorts, ticket suppliers, messaging providers, and customer-support vendors only within the scope necessary to provide the booked service.
A partner or processor may not re-entrust passenger lists, passport details, contact information, location information, or booking data to a second- or third-tier subcontractor without the Company's prior written approval. The Company may require a written data processing agreement, security checklist, training evidence, deletion confirmation, and audit cooperation from processors and re-processors.
If a processor or partner becomes aware of unauthorized access, loss, theft, disclosure, falsification, alteration, damage, or suspected leakage of personal information, it must notify the Company without delay and cooperate with investigation, user notice, regulatory reporting, remediation, and evidence preservation.
If the Company confirms or reasonably suspects unauthorized access, leakage, loss, theft, falsification, alteration, or damage involving personal information, the Company will take measures required by applicable law, including prompt notice to affected users and regulatory reporting where required.
Incident notices may include the categories of affected information, timing and route of occurrence, measures taken by the Company, user protective steps, contact point for inquiries, and available remedies such as damage compensation claims or personal information dispute mediation where applicable.
Operational details such as statutory thresholds, reporting forms, and authority submission procedures are maintained in the Company's internal incident-response manual and are subject to confirmation by legal/privacy counsel before external filing.
The platform may order products, sections and home tiles using language, country (worked out from your connection), the season, and aggregated view and booking counts that do not identify any person. This ordering is not a profile of you. A personalization setting is offered in the cookie banner; at present we do not use your own browsing history to order content, and if we ever do, it will happen only with your permission and the history will stay on your device.
You can change or withdraw your cookie choices at any time through the cookie banner, the footer control, your browser settings, or by contacting info@holidaykr.com. We do not make fully automated decisions that significantly affect your rights or obligations; if one ever applies, we will explain it and offer a way to request human review as required by applicable law.
When you use the HOLIDAY mobile app (the "App"), it uses the device features below only as far as needed to provide the service. You choose whether to allow each feature on the operating system's permission screen the first time you use it, and even if you choose not to allow one, you can keep using everything else in the App, such as searching for products, booking, and paying.
| Feature (optional) | Purpose | Information processed | If you choose not to allow it |
|---|---|---|---|
| Camera | To attach a photo you take to a customer support chat | Only the photo you take and choose to send | Only the take-a-photo option stays off; attaching from your photo library or files and sending text messages work as usual. |
| Photo library and files | To attach an image or PDF to a customer support chat | Only the image or PDF you pick yourself (one at a time) | Only file attachment stays off; text messages work as usual. |
| Biometric authentication (Face ID, fingerprint) | To unlock the App on this device | The Company does not collect, store, or transmit face, fingerprint, or other biometric data. Your device's operating system performs the check and the App only receives a success or failure result. The App stores only your "use biometric authentication" setting on your device. | You can sign in with your email and password or with social login. |
| Location (Nearby search, map) | To show nearby bus stops, lockers, restrooms, pharmacies and tourist places, and your position on the map | Your current location, only while the App is open and only when you use a location feature. It is not saved on our servers or in logs, and is not used for advertising or analytics. | Only the location-based features stay off; you can still search by name or area. |
| Notifications (optional) | To send customer support replies and booking notices | A push notification token (an address that Google's Firebase Cloud Messaging issues for your device), linked to your account or chat session. Advertising ID, Android ID and IMEI are not collected. | Only notifications stay off; you can still see replies and booking status inside the App. |
Push notifications (optional): if you allow notifications, the App registers a push notification token (an address that Google's Firebase Cloud Messaging issues for your device) with our server and links it to your account or chat session, only to send customer support replies and booking notices. It is not used for advertising, analytics or marketing. We stop using it when you turn notifications off or log out. The App does not use an advertising ID or a device unique number (Android ID, IMEI).
If you sign in with a Google, Apple, Kakao, LINE, Facebook, or WeChat account, we use the unique identifier, email address (if provided), and name (if provided) that the provider shares with your consent to identify you and link your account. You can disconnect a linked account on the sign-in methods (linked accounts) screen of the App. Each provider handles personal information under its own policy.
For convenience, the App stores your language and currency settings, recently viewed products, your biometric authentication setting, and unsent customer support chat drafts on your device only. When you log out, recently viewed products, chat drafts, and offline voucher copies are deleted, and deleting the App removes all information stored on your device.
You can request to withdraw your membership yourself in the App under [My Page > Personal Information > Delete account]. If you signed in with Apple, we also ask Apple to revoke the Sign in with Apple connection when we process your account deletion. Once processed, your member information is made unidentifiable, and booking and payment records are kept separately for the period stated in Article 1 (5 years) under applicable laws such as the e-Commerce Act, and then destroyed. If you have an upcoming or in-progress booking, please complete or cancel it first and then proceed with withdrawal.
You can change the camera, photo library, location, notification, and biometric authentication permissions at any time in your device settings (Apps > HOLIDAY). Entrustment, provision to third parties, and cross-border transfer of information processed in the App follow Articles 3 and 6, and you can contact us through the details in Article 5.
1. When you use the website we process the following automatically. (1) IP address: used only to work out your country and not stored; the IP address is not sent to any third party. (2) Anonymous aggregates: visit counts by country, language and page, which do not identify any person. (3) Cookies and browser storage: language/currency settings and your consent choice (essential); an anonymous visitor ID (only if you allow analytics).
2. Legal basis. Essential cookies: processing necessary to provide the service. Analytics: your consent (Article 15(1)1 of the Personal Information Protection Act of Korea and, for users in other jurisdictions, the consent requirements of applicable law such as GDPR Article 6(1)(a)). The service remains fully available if you do not consent.
3. How to give and withdraw consent. On your first visit you can choose "Allow all", "Customize" or "Do Not Sell or Share My Personal Information" in the cookie banner; analytics are not used before you choose. You can change your choice at any time with "Manage Cookie Preferences" on the Cookie Policy page. If you withdraw, the visitor ID on your device is deleted at once and nothing further is sent; processing before withdrawal remains lawful. If your browser sends a Global Privacy Control or Do Not Track signal, optional items start switched off and stay off until you turn them on yourself.
4. No third-party disclosure. We do not sell or share visit statistics or IP addresses with third parties for advertising or marketing.
5. Questions and requests to access, delete or restrict: info@holidaykr.com (see Article 5).
Holiday Tour Travel Concierge
Holi
Hello! I’m Holi, your Holiday Tour travel assistant. Ask me about tours, bookings, or a custom itinerary anytime.
