Privacy Policy
Effective date 2026‑10‑18
Last Modified: October 18, 2026 Effective Date: October 18, 2026 TripFun Co., Ltd. (the “Company”) complies with the Personal Information Protection Act and other applicable laws and regulations and hereby establishes and publishes this Privacy Policy to safely process the personal information of data subjects who use the TripFun platform (www.tripfun.net and related mobile web and applications) and to promptly address related complaints. This Policy applies to both Members and Non-Member purchasers. The Company processes only the minimum personal information necessary to provide its services. Where additional information is required depending on the type of Product, Supplier, or conditions of use, the Company will separately inform the User of the relevant information and purpose of processing at the purchase or reservation stage.
Article 1 (Purposes of Processing Personal Information)
The Company processes personal information to the extent necessary for the following purposes:
1. Membership registration, social login, account management, identity verification, and Non-Member order lookup
2. Search, reservation, purchase, payment, Booking Confirmation, Ticket Issuance, and use of Products, including performances, shows, attractions, admission tickets, tours, activities, and transportation
3. Seat selection and assignment, reservation or seat holds, and generation and delivery of E-tickets, PDFs, QR codes, and electronic vouchers
4. Reservation and Ticket Issuance processing, modification, cancellation, and refund with Suppliers, original Suppliers, facility operators, and external reservation systems
5. Customer inquiries, complaints, dispute resolution, response to fraudulent transactions, fraudulent payments and chargebacks, and transaction record management
6. Transaction-related notices and customer support through email, SMS, Kakao Alimtalk, and similar channels
7. Service stability, incident response, security, access-log management, statistics, and service improvement
8. Provision of event, promotion, and marketing information where the User has separately consented
Article 2 (Personal Information Processed and Methods of Collection)
1. Membership Registration and Login
| Category | Required/ | Information Processed | Purpose |
|---|---|---|---|
| General membership registration | Required | Email address, password, name or identifying information required by the service, mobile phone number (where verification is used) | Member identification, account creation and management, login, customer support |
| Kakao Login | Required | Kakao Account email, profile nickname | Member identification, account creation/ |
| NAVER Login | Required | Email, name | Member identification, account creation/ |
| Marketing | Optional | Email or mobile phone number, consent status for receipt of promotional information | Event, benefit, and promotional notices |
※ A Kakao profile nickname is not used as the purchaser’s legal name. Where a legal name is required for ticket reservation or Ticket Issuance, the legal name of the purchaser or actual participant is collected separately at the payment or reservation stage.
2. Common Information Processed for Product Reservations, Purchases, and Ticket Issuance
| Category | Information Processed | Purpose |
|---|---|---|
| Purchaser information | Name, email, mobile phone number, order number, Member/ | Order management, reservation and Ticket Issuance notices, customer support |
| Actual participant / | Name (English name where required), date and time of use, number of persons/ | Reservation, Ticket Issuance, admission/ |
| Payment / | Payment method type, payment approval/ | Payment, cancellation, refund, settlement, fraud response |
| Reservation / | TripFun order number, Supplier reservation number, Ticket number, seat information, reservation/ | Booking Confirmation, Ticket Issuance, modification/ |
| Customer support | Inquiry details, consultation history, reservation/ | Inquiry, complaint, and dispute handling |
As a general rule, the Company does not directly store sensitive payment authentication information such as full card numbers or CVCs. The Company processes only the information necessary to operate the service, such as payment approval results and transaction identifiers provided by payment processors or payment service providers. If the actual implementation method changes, this Policy will be amended accordingly.
3. Additional Information by Product Type — Collected Only Where Actually Required
| Product/ | Basic Information Shared | Conditional Additional Information | Main Recipient and Purpose |
|---|---|---|---|
| Performances, shows, concerts, Reserved Seating Tickets | Purchaser/ | Date of birth, age-verification information, information required for identity-document verification where required by the facility | Venue, organizer, Ticket Supplier, reservation/ |
| Attractions / | Name, contact information, date and time of use, persons/ | Date of birth, age category, identity-verification information where required by Product conditions | Facility operator, admission-ticket Supplier, reservation system: reservation, voucher/ |
| Tours, activities, experiences | Participant name, primary contact information, date and time of use, number of persons, reservation number | Pickup location, accommodation name, local contact information, date of birth, weight/ | Tour/ |
| Transportation / | Passenger name, contact information, date and time of use, number of persons, departure/ | English name, date of birth, gender, nationality, passport information, and other information required by the carrier under applicable law or conditions of carriage | Carrier, reservation system: seat/ |
| Products involving physical receipt or delivery | Recipient name, contact information, delivery/ | Customs information and other information required by law, where applicable | Delivery/ |
| Modification / | Name, contact information, order/ | Refund account information, supporting documents where necessary | Supplier, payment service provider, customer support personnel: modification/ |
※ Passport information, visa copies, weight, accommodation information, pickup information, and similar data are not collected uniformly from all Customers. Such information is collected only where required for the reservation, operation, safety, or legal requirements of a specific Product, and the relevant Product screen will separately disclose the information collected and the purpose of collection.
4. Information That May Be Automatically Generated or Collected During Use of the Service
IP address, access date and time, access logs, browser/OS/device information, cookies and similar technology information, service usage records, error/incident records, and records of fraudulent use may be generated or collected for service stability, security, statistics, and improvement of the user environment.
5. Methods of Collection
Personal information may be collected through membership registration, login, reservation, purchase, payment, and inquiry screens on the website, mobile web, or application; social login providers; payment service providers; API integrations with Suppliers and external reservation systems; email, telephone, chat, and customer service; cookies; and logs generated during use of the service.
Article 3 (Processing and Retention Periods)
The Company destroys personal information without delay once the purpose of processing has been achieved. However, where retention is required by applicable law or where a dispute, settlement, refund, or similar matter remains pending, the Company retains the necessary information for the applicable period.
| Records Retained | Retention Period | Basis / |
|---|---|---|
| Records relating to contracts or withdrawal of offers, etc. | 5 years | Electronic commerce-related laws and regulations |
| Records relating to payment and supply of goods/ | 5 years | Electronic commerce-related laws and regulations |
| Records relating to consumer complaints or dispute resolution | 3 years | Electronic commerce-related laws and regulations |
| Records relating to labeling and advertising | 6 months | Electronic commerce-related laws and regulations |
| Service access logs and other records required to be retained by law | Period prescribed by applicable law | Security, cooperation with investigations, and other legal obligations |
| Member account information | Until withdrawal from membership; statutory retention information is separately retained | Membership management |
| Non-Member order/ | Statutory transaction-record retention period after completion of the transaction, or the period necessary for dispute handling | Order lookup, customer support, legal obligations |
The former rule providing for automatic separate storage of personal information of Users inactive for one year is not uniformly applied under the Company’s current operations and applicable law. If the Company separately implements a policy for managing long-term inactive accounts, Users will be notified in advance.
Article 4 (Provision of Personal Information to Third Parties)
As a general rule, the Company does not provide a data subject’s personal information to third parties beyond the scope of the purposes for which it was collected and used. However, where necessary to enter into and perform the contract for a Product selected by the User, including reservation, Ticket Issuance, admission, or tour operation, the Company provides the minimum personal information necessary to the Supplier or operator of the Product within the scope permitted by applicable law or based on separate consent. In particular, because the supply chain for overseas Tickets and travel Products may differ by Product, the Company provides information at the purchase stage so that the User can identify the actual Supplier, original Supplier, facility operator, or reservation system for the applicable Product and the personal information to be provided.
| Type of Recipient | Information Provided | Purpose | Retention/ |
|---|---|---|---|
| Venues, organizers, facility operators | Name, date/ | Booking Confirmation, seat assignment, Ticket Issuance, admission verification, schedule changes/ | Until completion of the applicable Product and for the recipient’s statutory/ |
| Ticket and tourism Product Suppliers | Name, contact information, date/ | Inventory securing, reservation, Ticket Issuance, modification/ | Until completion of the Product and for the Supplier’s statutory/ |
| Tour/ | Participant name, primary contact information, date/ | Tour reservation, communication, pickup, on-site operation, safety management | Until completion of the Product and for the operator’s statutory/ |
| Carriers | Passenger name, contact information, itinerary, departure/ | Boarding reservation, identity verification, transportation service | Until completion of transportation and for the carrier’s statutory/ |
| Payment service providers, card issuers, banks | Transaction information necessary for payment, payment amount/ | Payment approval, settlement, cancellation/ | Period prescribed by financial/ |
The Company distinguishes, based on the actual contract and processing structure, whether a Supplier is an independent third party processing personal information or a processor acting under the Company’s instructions. Specific business names and Product-specific provision details may be kept current and disclosed on the service screen or in a separate “Status of Personal Information Provision and Overseas Transfers.”
Article 5 (Outsourcing of Personal Information Processing)
The Company may outsource part of its personal information processing operations to specialized service providers for the smooth provision of services. The Company incorporates necessary matters into contracts and manages and supervises processors in accordance with applicable law so that personal information is processed securely.
| Processor / | Current or Planned Service | Outsourced Operations |
|---|---|---|
| Domestic payments | Toss Payments | Domestic payment approval, cancellation, refund, and payment-related processing |
| Overseas payments | Stripe | Overseas payment approval, cancellation, refund, payment-related processing, and fraud prevention |
| Cloud infrastructure | Amazon Web Services (AWS) | Service infrastructure, data storage/ |
| Customer support | ChannelTalk | Web/ |
| Messaging / | Kakao Alimtalk-related services, Twilio, and other actually integrated providers | Transaction-related messages for reservation, Ticket Issuance, cancellation, verification, etc. |
| Identity verification integration | PortOne and the actual identity-verification institution | Identity-verification integration and processing of verification results |
| Social login | Kakao, NAVER | Social login authentication and account linking |
※ The legal characterization of the services listed above may constitute “outsourced processing,” “provision to a third party,” or “overseas transfer” depending on the actual contract and integration structure. Before Production deployment, the Company will verify the actual contracting party, processing location, and data flow and finalize and disclose the applicable classification.
Article 5-2 (Mobile Information and SMS Consent)
1. The Company processes mobile phone numbers and SMS consent information to send booking-related text messages to users who have expressly opted in. These messages may include order confirmations, ticket issuance and delivery updates, cancellations, and schedule changes.
2. The Company maintains records of SMS consent status, consent timestamps, and opt-out requests for the purposes of SMS delivery and consent management.
3. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent will not be shared with any third parties for their marketing or promotional purposes.
4. The Company may use messaging service providers, including Twilio, to process the information necessary to deliver transactional SMS notifications on its behalf, solely for message delivery and related service operations.
5. The Company's SMS notification program does not include advertising, marketing, or promotional messages.
6. Users may withdraw their SMS consent at any time by replying STOP to a message. The Company will discontinue SMS notifications covered by the withdrawn consent.
Article 6 (Overseas Transfer of Personal Information)
In the course of providing services such as reservations and Ticket Issuance for overseas Products, overseas payments, and global cloud and messaging services, the Company may transfer personal information overseas. Overseas transfer may include not only providing personal information to an overseas business but also processing, storing, or making such information accessible outside Korea. The Company establishes a lawful basis under the Personal Information Protection Act and discloses or obtains separate consent for required matters, including the personal information transferred, destination country, timing and method of transfer, recipient, purpose and retention period, and the method and effect of refusing the transfer.
| Purpose / | Recipient or Category | Information Transferred | Country / | Purpose and Retention Period |
|---|---|---|---|---|
| Overseas performance/ | Overseas Supplier, original Supplier, venue/ | Name, necessary contact information, date/ | Country where the relevant business is located / | Reservation, Ticket Issuance, admission, modification/ |
| External reservation/ | Global Ticket distribution and Ticket Issuance system (GDS/ | Name, reservation/ | Country where the system is operated / | Inventory inquiry, reservation, Ticket Issuance, modification/ |
| Overseas payments | Stripe and payment-processing-related businesses | Payment/ | United States and other service-processing countries / | Payment approval, cancellation/ |
| Cloud / | Amazon Web Services and contractual subprocessors | Member, reservation, transaction, and log information stored for service operations | Company-selected region and service-processing countries / | Hosting, backup, security, incident response / |
| Overseas messaging | Twilio and other actually integrated providers | Mobile phone number, verification code, or minimum information necessary for message transmission | Service-processing countries / | Overseas SMS and verification message transmission / |
The specific name and contact information of overseas recipients and other matters that must be individually specified under applicable law will be made available, according to the actual transfer structure, in this Privacy Policy, a separate notice/consent screen at the Product purchase stage, or the status of overseas transfers. Where separate consent is required for an overseas transfer, the data subject may refuse consent. However, where the overseas transfer is essential to perform the contract, such as reservation/Ticket Issuance for an overseas Product or overseas payment, refusal may restrict reservation, purchase, Ticket Issuance, or use of the related service. ※ Where an actual overseas transfer occurs, the Company will provide, to the extent required by applicable law, information including the legal name and contact information of the recipient, destination country, information transferred, timing and method, purpose, and retention period through this Privacy Policy, a separate notice/consent screen at the Product purchase stage, or the status of overseas transfers. The contractual data processor and actual processing country of an overseas Ticket Issuance system will be finally confirmed and reflected before operation.
Article 7 (Processing of Personal Information with Affiliates, Including TripFun USA Inc.)
The Company may cooperate with affiliates, including TripFun USA Inc., for global service operations such as overseas Product supply contracts, operational support, customer support, settlement, and technical support. Where an affiliate processes personal information, the Company classifies the processing as provision to a third party, outsourced processing, or overseas transfer according to the actual business structure, and clearly indicates the purpose, information processed, retention period, destination country, and required legal basis in this Policy or a separate notice/consent screen. The Company does not comprehensively share all Member information or transaction information merely because an entity is an affiliate.
Article 8 (Sensitive Information and Unique Identification Information)
As a general rule, the Company does not collect sensitive information such as health information or unique identification information such as resident registration numbers. However, where certain information is strictly necessary under applicable law or for performance of a Product, including safety management for a specific tour/activity or transportation, immigration, or facility-use conditions, the Company processes only the minimum necessary information based on separate consent or another lawful basis under applicable law. Passport information, copies of identification documents, and similar information are not required for all Products. For Products requiring such information, the Company separately provides notice of the purpose of collection, information collected, recipient, and retention period.
Article 9 (Destruction of Personal Information)
The Company destroys personal information without delay when it is no longer necessary due to expiration of the retention period, achievement of the processing purpose, or other reasons. Information that must be retained under applicable law is stored separately from other personal information or with restricted access.
1. Electronic files: securely deleted using a method that makes recovery or reproduction difficult.
2. Paper documents: destroyed by shredding, incineration, or another method that makes reproduction difficult.
Article 10 (Rights and Obligations of Data Subjects and Legal Representatives, and Methods of Exercise)
Data subjects may exercise rights, within the scope prescribed by applicable law, including access to, transmission, correction/deletion of, suspension of processing of, and withdrawal of consent to their personal information. Such rights may be exercised by the data subject or a lawful representative through the Company’s customer service center, email, or other methods provided by the Company, and the Company will process the request in accordance with applicable law. Deletion or suspension of processing may be restricted for transaction records subject to statutory retention obligations, information that another law expressly requires to be collected, and similar information. Users must securely manage their account and authentication information and provide accurate and up-to-date information necessary for reservation and Ticket Issuance.
Article 11 (Personal Information of Children Under 14)
As a general rule, the Company does not provide membership registration services to children under 14. If it does provide such services, it will establish procedures to verify the consent of a legal representative in accordance with applicable law. However, for family-oriented Products where information such as the name or age of a child who is an actual participant is necessary for the reservation, the Company may process the minimum information necessary to perform the Product through the purchaser or legal representative.
Article 12 (Measures to Ensure the Security of Personal Information)
The Company implements reasonable administrative, technical, and physical safeguards in accordance with applicable law to prevent the loss, theft, leakage, forgery, alteration, or damage of personal information.
1. Minimization of access rights to personal information and management of the granting, modification, and revocation of access rights
2. Secure storage of authentication information such as passwords and protection of data in transit
3. Retention and review of access logs and detection of abnormal access
4. Security programs, access controls, vulnerability assessments, and incident/security-breach response
5. Training for personnel handling personal information and operation of internal management procedures
6. Contractual safeguards and necessary management/supervision of processors and overseas recipients
Article 13 (Cookies and Similar Technologies)
The Company may use cookies or similar technologies to maintain login status, enhance security, analyze service use, and improve the user environment. Where cookies are used for advertising or personalized-service purposes, the Company provides the required notice or choices in accordance with applicable law and service settings. Users may allow or block the storage of cookies or delete stored cookies through the settings of the browser or device they use, including Chrome, Safari, and Edge. If essential cookies are blocked, certain functions such as login, reservation, or payment may not operate properly.
Article 14 (Automated Collection and Analytics Tools)
If the Company actually introduces web/app analytics tools, error-collection tools, advertising identifiers, or similar technologies, the Company will disclose the provider, information collected, purpose of use, retention period, and method of refusal in this Policy or a separate cookie/analytics notice. Analytics or advertising tools that are not used in Production will not be listed in this Policy without basis.
Article 15 (Chief Privacy Officer and Inquiries)
The Company designates a Chief Privacy Officer to oversee personal information processing and to handle inquiries, complaints, and requests for relief from data subjects.
| Category | Details |
|---|---|
| Personal Information Controller | TripFun Co., Ltd. |
| Chief Privacy Officer | Angie Lee |
| Inquiry Email | help@tripfun.net |
| Website | www.tripfun.net |
| Contact | help@tripfun.net / |
For reports or consultations regarding personal information infringement, data subjects may contact the Personal Information Infringement Report Center (118 without an area code), the Personal Information Dispute Mediation Committee, or other relevant authorities.
Article 16 (Changes to this Privacy Policy)
The Company may amend this Policy in response to changes in applicable laws, services, or personal information processing structures. Where there is a material change, the effective date and details of the amendment will be disclosed through a notice on the website or by separate notice. ADDENDUM
1. This Privacy Policy shall take effect on October 18, 2026.
2. If the actual Production integration provider, overseas transfer country/entity, contact information, or retention period is confirmed or changed after publication of this Policy, the Company will update this Policy without delay to reflect the actual processing status.