Privacy Policy for Guides
Version 2026-09-22 · Effective 2026-09-22
This English text is provided for convenience. It is a translation of the Korean original, which was prepared with legal review. If there is any conflict between the two, the Korean original prevails (Terms of Service, Article 4(3)).
ITble (CEO: Youngtae Kwon; the "Company") processes personal information lawfully and manages it securely in compliance with the Personal Information Protection Act (개인정보 보호법) and related laws. Accordingly, pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses the following Privacy Policy in order to inform data subjects of the procedures and standards for the processing and protection of personal information and to enable related grievances to be handled promptly and smoothly.
1. Purposes of Processing, Items Collected, and Retention and Use Periods
In accordance with the Personal Information Protection Act, the Company collects and uses personal information only to the minimum extent necessary to provide the Service.
The Company processes the following items of personal information without the consent of the data subject.
| Legal basis | Purpose of collection and use | Items collected | Retention and use period |
|---|---|---|---|
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Confirmation of intent to register as a member, member identification, account management, age verification | Kakao login: nickname, profile photo, e-mail (where provided by the user) / Entered in the app: name, profile photo | Until the purpose of processing is achieved or the member withdraws |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Partner membership registration, member identification and account management | Google and Apple login: e-mail, name | Until the purpose of processing is achieved or the member withdraws |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Verification and management of Partner identity and qualifications | Real name, nickname, date of birth, gender, phone number, profile photo, area of activity, languages used, years of experience, area of expertise, self-introduction, KakaoTalk ID (optional), photograph of identification document, NBI Clearance expiration date | Until the purpose of processing is achieved or the member withdraws |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Tour booking and brokerage, confirmation of itinerary and number of participants, coordination of pick-up and drop-off schedules, flight confirmation | Name of the person making the booking, pick-up and drop-off locations, flight information (where applicable), number of travelers, travel dates, requests (where entered by the user) | Up to 60 months after the end of the relevant tour. However, transaction records that must be retained under relevant laws may be stored for the statutory period. |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Provision of the Service, prevention of fraudulent use, verification of access and device environment | App push token (device and app identification information) | Until the purpose of processing is achieved or the member withdraws |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Booking-related 1:1 chat, provision of notifications, handling of booking and tour-related inquiries and disputes | In-app notification history, PickTalk chat history | Notification history: until the member withdraws / PickTalk chat history: 6 months after the message is sent or received |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Creation and management of reviews and star ratings, handling of reports and blocking of reviews and replies, handling of related inquiries and disputes | Review contents, star rating, attached photographs, review author identification information, date and time of creation, records of report and blocking actions (including, where a PickTalk chat message is reported, the contents of that one reported message) | Review author identification information: until the member withdraws (de-identified upon withdrawal) / Review contents, star rating and attached photographs: until deleted by the author. However, deleted or blinded reviews, and the contents of a message stored upon a PickTalk chat report, are retained for up to 3 years for dispute response (by analogy to Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce, records on consumer complaints or dispute handling). |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Payment of the Deposit, payment approval, cancellation and refund, and transaction verification | Payment approval number, payment amount, payment date and time, payment status, cancellation and refund details | 5 years (Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce) |
| Personal Information Protection Act Article 15(1)4 (conclusion and performance of a contract) | Partner operational management (records of contact, consultation and meetings) | Internal operational memos on each Partner written by administrators | Until the Partner member withdraws |
The Company processes the following items of personal information with the consent of the data subject.
| Legal basis | Purpose of collection and use | Items collected | Retention and use period |
|---|---|---|---|
| Personal Information Protection Act Article 23(1)1 (consent) | Verification of the Partner's identity and criminal record, confirmation and management of the Partner's eligibility and qualifications, user safety management through Partner identity verification | NBI Clearance document file and criminal-record-related information contained in that document | Until the earlier of the expiration of the validity period of the NBI Clearance and the achievement of the purpose of processing, such as the Partner's withdrawal |
| Personal Information Protection Act Article 15(1)1 (consent) | Provision and analysis of Service-related promotions, benefits, marketing and other advertising information | E-mail, identification information necessary for sending app push notifications | Until the purpose of processing is achieved, or until the member withdraws or withdraws consent |
| Personal Information Protection Act Article 15(1)1 (consent) | Provision of advertising information on travel-related products and services provided by the Company or its partner companies, such as hotels and travel insurance | E-mail, identification information necessary for sending app push notifications | Until the purpose of processing is achieved, or until the member withdraws or withdraws consent |
| Personal Information Protection Act Article 15(1)1 (consent) | Provision of customized advertising based on user interests analyzed from Service usage records and the like | Service usage records (search, browsing, click and booking history within the Service, etc.), device identifier (Device ID) | Until the purpose of processing is achieved, or until the member withdraws or withdraws consent |
Where any of the following grounds applies under relevant laws, the Company sets the retention and use period of personal information to the end of each such period.
| Relevant law | Item | Retention and use period |
|---|---|---|
| Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce | Records on contracts or withdrawal of subscription, etc. | 5 years |
| Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce | Records on payment and the supply of goods, etc. | 5 years |
| Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce | Records on consumer complaints or dispute handling | 3 years |
| Article 6 of the Enforcement Decree of the Act on Consumer Protection in Electronic Commerce | Records on labeling and advertising | 6 months |
| Article 41 of the Enforcement Decree of the Protection of Communications Secrets Act | Computer communications and internet log records and access location tracking data | 3 months |
2. Provision of Personal Information to Third Parties and Transfer Abroad
1) Provision of Personal Information to Third Parties
For the smooth provision of the Service, the Company provides personal information only to the minimum extent necessary, with the consent of the data subject pursuant to Article 17(1)1 of the Personal Information Protection Act, in the following case.
| Recipient | Purpose of provision | Items provided | Retention and use period |
|---|---|---|---|
| Partner | Confirmation and conduct of tour bookings, coordination of pick-up, drop-off and schedules, flight confirmation, 1:1 PickTalk communication, handling of booking and tour-related inquiries and disputes | Traveler's name, pick-up and drop-off locations, flight information (where applicable), number of travelers, travel dates, requests, profile photo, PickTalk chat messages (including automatic translations), review contents, star ratings, attached photographs and the masked name of the author | 5 years after the end or cancellation of the relevant tour (PickTalk chat messages: 6 months after the message is sent or received). However, where a related inquiry or dispute is in progress, until such inquiry or dispute is concluded. |
2) Transfer of Personal Information Abroad
In order to provide the personal information necessary for tour bookings and their conduct to local Partners in the Southeast Asia region with whom users have made bookings, the Company transfers personal information to the country where the relevant Partner is located after obtaining separate consent to the transfer abroad from the data subject pursuant to Article 28-8(1)1 of the Personal Information Protection Act.
| Transferee | Purpose of transfer | Items transferred | Timing and method of transfer | Retention and use period |
|---|---|---|---|---|
| Partner | Confirmation and conduct of tour bookings, coordination of pick-up, drop-off and schedules, flight confirmation, 1:1 PickTalk communication, handling of booking and tour-related inquiries and disputes | Traveler's name, pick-up and drop-off locations, flight information (where applicable), number of travelers, travel dates, requests, profile photo, PickTalk chat messages (including automatic translations), review contents, star ratings, attached photographs and the masked name of the author | At the time a booking is concluded between the user and the local Partner, and at such times as are necessary in the course of the booking and the tour / Network transmission or retrieval through the Service application | 5 years after the end or cancellation of the relevant tour (PickTalk chat messages: 6 months after the message is sent or received). However, where a related inquiry or dispute is in progress, until such inquiry or dispute is concluded. |
A data subject may refuse to consent to the transfer of personal information abroad at the booking stage. However, if the data subject does not consent to the transfer abroad, it will not be possible to book or conduct the relevant tour.
3. Entrustment of Personal Information Processing
In order to provide a better service, offer user convenience and otherwise carry out its business smoothly, the Company entrusts personal information processing tasks to specialized companies as follows.
(1) Domestic Entrustment
| Entrustee | Details of the entrusted work |
|---|---|
| Toss Payments Co., Ltd. | Payment of the brokerage fee (Deposit), payment approval, cancellation and refund, and transaction verification |
| Supabase, Inc. (data storage location: Seoul region, Republic of Korea, ap-northeast-2) | User authentication, operation of the database and file storage, execution of server functions — all items in Section 1 |
| Sendbird, Inc. (data storage location: Seoul region, Republic of Korea) | Provision of 1:1 PickTalk chat for each booking and delivery of messages — member and Partner identifiers, nickname, profile photo URL, chat room identification information, chat messages, time of sending and receiving |
(2) Overseas Entrustment
| Item | Details |
|---|---|
| Legal basis | Personal Information Protection Act Article 28-8(1) |
| Name of entrustee | Supabase (Supabase, Inc.) |
| Contact | privacy@supabase.io |
| Details of the entrusted work | Storage and protection of users' personal information data |
| Items of personal information transferred | All of the collection and use items specified in Section 1 (member account information, Partner identity and qualification information, booking and tour information, reviews and postings, etc. — information stored in the database and file storage. Data storage location: Seoul region, Republic of Korea) |
| Country to which personal information is transferred | United States |
| Timing of transfer of personal information | At the time of use of the Service |
| Method of transfer of personal information | Transmitted from time to time over the network |
| Retention and use period | Until termination of the entrustment agreement |
| Method and procedure for refusing the transfer of personal information, and the effect of refusal | You may refuse the transfer of your personal information by withdrawing your membership or by making a request to the customer center. However, because this transfer of personal information is essential for use of the Service, provision of the Service may be restricted if you refuse the transfer. |
| Item | Details |
|---|---|
| Legal basis | Personal Information Protection Act Article 28-8(1) |
| Name of entrustee | Vercel (Vercel Inc.) |
| Contact | privacy@vercel.com |
| Details of the entrusted work | Hosting and operation of the administrator web and related server functions, and processing of service logs |
| Items of personal information transferred | Among the user, booking and customer support information processed through the administrator web and the access and service logs, the information necessary to perform the relevant functions (Data processing location: Seoul region (icn1), Republic of Korea) |
| Country to which personal information is transferred | United States |
| Timing of transfer of personal information | At the time of use of the Service |
| Method of transfer of personal information | Transmitted from time to time over the network |
| Retention and use period | Until termination of the entrustment agreement |
| Method and procedure for refusing the transfer of personal information, and the effect of refusal | You may refuse the transfer of your personal information by withdrawing your membership or by making a request to the customer center. However, because this transfer of personal information is essential for use of the Service, provision of the Service may be restricted if you refuse the transfer. |
| Item | Details |
|---|---|
| Legal basis | Personal Information Protection Act Article 28-8(1) |
| Name of entrustee | Sendbird (Sendbird, Inc.) |
| Contact | privacy@sendbird.com |
| Details of the entrusted work | Provision of 1:1 PickTalk chat for each booking and delivery of messages - member and Partner identifiers, nickname, profile photo URL, chat room identification information, chat messages, time of sending and receiving |
| Items of personal information transferred | Member and Partner identifiers, chat room identification information, chat messages, time of sending and receiving, etc. |
| Country to which personal information is transferred | United States |
| Timing of transfer of personal information | At the time of use of the Service |
| Method of transfer of personal information | Transmitted from time to time over the network |
| Retention and use period | Until termination of the entrustment agreement |
| Method and procedure for refusing the transfer of personal information, and the effect of refusal | You may refuse the transfer of your personal information by withdrawing your membership or by making a request to the customer center. However, because this transfer of personal information is essential for use of the booking-related chat function, use of that function may be restricted if you refuse the transfer. |
| Item | Details |
|---|---|
| Legal basis | Personal Information Protection Act Article 28-8(1) |
| Name of entrustee | Google Cloud Korea LLC (Firebase Cloud Messaging) |
| Contact | https://support.google.com/policies/contact/general_privacy_form |
| Details of the entrusted work | Sending of app push notifications |
| Items of personal information transferred | Device and app identification information for sending app push notifications |
| Country to which personal information is transferred | United States |
| Timing of transfer of personal information | At the time of use of the Service |
| Method of transfer of personal information | Transmitted from time to time over the network |
| Retention and use period | Until termination of the entrustment agreement |
| Method and procedure for refusing the transfer of personal information, and the effect of refusal | You may refuse the transfer of your personal information by withdrawing your membership or by making a request to the customer center. However, because this transfer of personal information is essential for use of the notification function, use of that function may be restricted if you refuse the transfer. |
| Item | Details |
|---|---|
| Legal basis | Personal Information Protection Act Article 28-8(1) |
| Name of entrustee | Google Cloud Korea LLC (Google Cloud Translation) |
| Contact | https://support.google.com/policies/contact/general_privacy_form |
| Details of the entrusted work | Automatic translation of PickTalk messages |
| Items of personal information transferred | Contents of the PickTalk messages to be translated |
| Country to which personal information is transferred | United States |
| Timing of transfer of personal information | At the time of use of the Service |
| Method of transfer of personal information | Transmitted from time to time over the network |
| Retention and use period | Until termination of the entrustment agreement |
| Method and procedure for refusing the transfer of personal information, and the effect of refusal | You may refuse the transfer of your personal information by withdrawing your membership or by making a request to the customer center. However, because this transfer of personal information is essential for use of the translation function, use of that function may be restricted if you refuse the transfer. |
| Item | Details |
|---|---|
| Legal basis | Personal Information Protection Act Article 28-8(1) |
| Name of entrustee | Cloudflare, Inc. |
| Contact | privacyquestions@cloudflare.com |
| Details of the entrusted work | Delivery of image content (CDN) and operation of web DNS |
| Items of personal information transferred | Member and Partner profile photos, product photos, photographs attached to reviews |
| Country to which personal information is transferred | United States (global edge network) |
| Timing of transfer of personal information | At the time of use of the Service |
| Method of transfer of personal information | Transmitted from time to time over the network |
| Retention and use period | Until termination of the entrustment agreement |
| Method and procedure for refusing the transfer of personal information, and the effect of refusal | You may refuse the transfer of your personal information by withdrawing your membership or by making a request to the customer center. However, because this transfer of personal information is essential for use of the Service, provision of the Service may be restricted if you refuse the transfer. |
4. Procedure and Method of Destruction of Personal Information
When personal information becomes unnecessary, such as upon the lapse of the retention period or the achievement of the purpose of processing, the Company destroys such personal information without delay.
Where personal information must continue to be retained under other laws even though the retention period consented to by the data subject has lapsed or the purpose of processing has been achieved, the Company moves such personal information to a separate database (DB) or stores it in a different storage location and retains it for the period prescribed by such laws.
The procedure and method of destruction of personal information are as follows.
- Destruction procedure: The Company selects the personal information for which a ground for destruction has arisen and destroys it in accordance with its internal policy under the responsibility of the chief privacy officer.
- Destruction method: Personal information recorded and stored in the form of electronic files is destroyed using technical methods that make the records unrecoverable, and personal information printed on paper documents is destroyed by shredding with a shredder or by incineration or similar means.
5. Rights and Obligations of Data Subjects and Their Legal Representatives, and the Method of Exercising Them
A data subject may exercise the following rights.
- Request to access personal information: A user may request access to the personal information held by the Company. However, such access may be restricted where access is prohibited or restricted by law, where there is a risk of harm to another person's life or body, or where there is a risk of unjustly infringing another person's property or other interests.
- Request to correct or delete personal information: A user may request correction or deletion of the personal information held by the Company. However, where the personal information is specified as a subject of collection under other laws, deletion may not be requested.
- Request to withdraw consent to, or suspend, the processing of personal information: A user may request the Company to suspend the processing of the personal information held by the Company, or may withdraw consent to the processing of personal information. However, a request to withdraw consent to, or suspend, the processing of personal information may be refused where access is prohibited or restricted by law, where there is a risk of harm to another person's life or body, where there is a risk of unjustly infringing another person's property or other interests, or where it is difficult to perform the contract, such as where the service agreed with the data subject cannot be provided without processing the personal information, and the data subject has not clearly expressed an intention to terminate that contract.
A user may exercise these rights through an agent (a legal representative or a person duly authorized). In such case, a power of attorney evidencing the authority must be submitted in the manner designated by the Company (e-mail, fax, etc.).
6. Measures to Ensure the Security of Personal Information
The Company takes the following measures to ensure the security of personal information.
- Administrative measures: Minimization of the number of personnel with access to personal information, establishment of an internal management plan, regular employee training, etc.
- Technical measures: Management of access rights to personal information processing systems and the like, installation of access control systems, encryption of data in transit and at rest, etc.
- Physical measures: Storage of documents and auxiliary storage media containing personal information in locations equipped with locking devices
In the case of overseas entrustment, the services provided by the entrustees take the following security measures to protect users' personal information safely.
- Protection of data in transit: Encryption technology is used to protect users' information safely while it travels over the internet. This prevents the data from being intercepted or altered in transit.
- Protection of stored data: Users' personal information is stored in a secure manner, and all stored data is encrypted so that it is protected from unauthorized external access.
- Access rights management: Settings are in place so that only authorized users can access personal information through authentication procedures. This blocks access by unauthorized users.
- Secure server environment: Users' data is stored on secure servers, and various measures for data protection are continuously implemented.
7. Chief Privacy Officer
The Company designates a chief privacy officer as set out below in order to take overall responsibility for work relating to the processing of personal information and to handle data subjects' complaints and provide remedies for damage in connection with the processing of personal information.
Chief Privacy Officer
- Name: Hyeongryeol Kwon (권형렬)
- Position: Chief Privacy Officer
- Contact: guidepick@googlegroups.com
Department in Charge of Personal Information Protection
- Department name: GuidePick Operations Team
- Person in charge: Hyeongryeol Kwon (권형렬)
- Contact: guidepick@googlegroups.com
Users may direct to the chief privacy officer any inquiries, complaints, requests for remedies and other matters relating to the protection of personal information arising while using the Company's Service. The Company will respond to users' inquiries without delay.
In addition, the Company endeavors to guarantee data subjects' right to informational self-determination and to provide consultation and remedies for damage caused by infringement of personal information; where a report or consultation is required, please contact the chief privacy officer above.
8. Remedies for Infringement of Users' Rights and Interests
Users may inquire with the following organizations regarding remedies for damage, consultation and the like in relation to infringement of personal information. The organizations below are separate from the Company; please contact them if you are not satisfied with the Company's own handling of personal information complaints or remedies for damage, or if you require more detailed assistance.
Personal Information Dispute Mediation Committee
- Website: www.kopico.go.kr
- Telephone: 1833-6972 (no area code)
Privacy Infringement Report Center (operated by the Korea Internet & Security Agency)
- Responsibilities: Reporting of personal information infringement, application for consultation
- Website: privacy.kisa.or.kr
- Telephone: 118 (no area code)
Korean National Police Agency Cyber Crime Report System (ECRM)
- Website: ecrm.police.go.kr
- Telephone: 182 (no area code)
The Company endeavors to provide consultation and remedies for damage caused by infringement of personal information; where a report or consultation is required, please contact the chief privacy officer above.
9. Requests to Access Personal Information
A data subject may make a request to access personal information under the Personal Information Protection Act to the department below.
- Department name: GuidePick Operations Team
- Person in charge: Hyeongryeol Kwon (권형렬)
- Contact: guidepick@googlegroups.com
10. Changes to the Privacy Policy
Where the Company changes this Privacy Policy, it will disclose the details of the change and the date of implementation through notices within the Service or on web pages operated by the Company.
Addendum (Effective Date) — This Privacy Policy takes effect on September 22, 2026.