C&K Tour Ltd (hereinafter referred to as 'C&K Tour') strives to make the best efforts to protect the personal information of customers and ensure the rights of information subjects. C&K Tour establishes and complies with a 'Privacy Policy' based on the provisions of the 'Personal Information Protection Act' and the standards of the 'Act on Promotion of Information and Communication Network Utilization and Information Protection.' We will inform you of how customer's personal information is collected, used, and what measures are taken to protect personal information for privacy. In the event of amending this privacy policy, C&K Tour will provide prior notice through the website. 1. Purpose of Collection and Use of Personal Information (1) C&K Tour collects the minimum necessary information from customers for processing business such as reservation of travel products and providing travel-related services. All provided personal information will not be used for purposes other than the intended purpose without separate consent. (2) In case of changes in the collection items or purposes of personal information, C&K Tour will notify in advance and seek customer consent. (3) C&K Tour uses the collected personal information for the following purposes: a. Contract performance and fee settlement related to service provision b. Membership management for user identification, prevention of unauthorized use by fraudulent members, confirmation of intent to join, age verification, handling of complaints, delivery of notices, etc. 2. Items and Methods of Personal Information Collection (1) C&K Tour collects customer's personal information through legal procedures and standards based on relevant laws. Only the minimum information necessary for customer service is collected, and collection and use are restricted in accordance with the Information and Communication Network Act and the Personal Information Protection Act. (2) C&K Tour does not collect sensitive personal information that may infringe on the customer's rights (such as preferences, sexual information, etc.). However, for customers who require medical assistance for the important service of travel services or voluntarily provide information, the following information is collected: Collection items: Health status (including information on diseases/injuries that occur during the itinerary), information on foods that cannot be consumed/preferred (allergies, etc.). 3. Use and Retention Period of Personal Information (1) The use period of personal information is limited to the period of providing the service or the dispute processing period, and information will be destroyed without delay if the information subject requests deletion and agrees to withdraw from membership. However, in cases where it is necessary to retain in accordance with relevant laws, the information will be securely stored for a certain period. Record of contract or withdrawal: 5 years (Consumer Protection Act in E-commerce) Record of payment and supply of goods: 5 years (Consumer Protection Act in E-commerce) Record of consumer complaints or dispute resolution: 3 years (Consumer Protection Act in E-commerce) (2) Compliance with the Effective Period System for Personal Information C&K Tour adheres to the personal information effective period system and takes necessary measures, including destruction, to protect the personal information of users who have not used the service for one year. C&K Tour notifies users 30 days before the expiration of the one-year effective period, and if personal information needs to be retained after the expiration, it is clearly specified in accordance with related laws. 4. Matters regarding the Provision of Personal Information to Third Parties C&K Tour does not provide personal information beyond the scope notified in the 'Purpose of Collection and Use of Personal Information' unless customer consent or legal regulations are involved. However, personal information may be provided without customer consent in the following cases: When requested by investigative agencies for investigation purposes under related laws such as the Criminal Procedure Act, the Law on Real-Name Financial Transactions, and Confidentiality, and the Credit Information Use and Protection Act. When providing to research organizations for statistical research or academic research in a form that cannot identify specific individuals. 5. Outsourcing of Personal Information Processing by C&K Tour (1) C&K Tour outsources some tasks to specialized companies to provide convenient services to customers. (2) C&K Tour strictly manages and supervises outsourced tasks by clearly defining legal processing procedures, security instructions and obligations to maintain confidentiality of personal information, and restrictions on the use beyond the scope of business purposes, and responsibility for damage compensation in case of accidents. (3) If the content of the outsourced task or the entrusted company changes, it will be promptly disclosed through this privacy policy. (4) The current status of outsourcing personal information by C&K Tour is as follows: Reservation/payment of air tickets through C&K Tour website and mobile. Land agencies in Korea and abroad. Stripe: Credit card payment approval, automatic deposit service for sales history. Maintenance companies for websites and systems. 6. Information about Automatic Collection Devices for Personal Information C&K Tour uses 'cookies' to provide personalized services to users. A 'cookie' is a small amount of information sent by a website to a user's computer browser (Netscape, Internet Explorer, etc.). When a user logs in to a website, the server reads the contents of the cookie in the user's browser and provides services by finding additional information on the user's computer. This cookie information is used to provide users with useful and convenient customized services. Cookies are used for the following purposes: (1) When you register as a member, a cookie is set the first time you log in and deleted when you log out. The use of cookies in relation to member logins is to verify the current login status. (2) Cookies are used in user environment settings. Information about the user's selected search environment values is stored to provide the user with the desired environment settings. (3) Cookies are used to grasp information about user behavior, such as the difference in connection frequency between members and non-members or the frequency of repeated use, and are used for target marketing. (4) Cookies are used for various promotions such as events conducted by C&K Tour to confirm the frequency of customer participation. (5) Users can adjust their web browser options to accept all cookies, send a notification when cookies are set, or reject all cookies. The method is as follows: If you are using Internet Explorer: Click 'Internet Options' from the 'Tools' menu. Click on the 'Privacy' tab. Adjust the privacy level according to user preference. If you are using Chrome: Click 'Settings' from the [...] menu. After clicking 'Advanced', click 'Content settings' in the 'Privacy and security' category. Click 'Cookies'. Select the desired cookie settings. 7. Rights and Obligations of Data Subjects Individuals have the right to exercise the following personal information protection-related rights at any time with respect to C&K Tour: Request for Access to Personal Information: The right to inspect personal information, including the source of information collected from the data subject and others, the purpose of processing, and usage history. Correction Request in Case of Errors: The right to request correction when errors are identified. Request for Deletion of Personal Information: The right to request the deletion of personal information. Request for Suspension of Processing: The right to request the suspension of processing. The exercise of these rights can be done through written requests, phone calls, emails, facsimile (FAX), or other means. C&K Tour will promptly take necessary actions upon receiving such requests. Data subjects are obligated to ensure that C&K Tour processes personal information, both their own and others', in compliance with the Personal Information Protection Act and other relevant laws. 8. Method for Accessing and Correcting Personal Information To access or correct personal information, customers can log in to the C&K Tour website (cnktour.com), go to "My Page," and manage their information. Alternatively, customers can request access, correction, or deletion of personal information via email, phone, or by contacting C&K Tour's customer center and the personal information manager. C&K Tour will promptly handle requests after verifying the customer's identity. Until corrections are completed for member/customer correction requests, C&K Tour will not use or provide personal information. Method for Requesting Access, Correction, Deletion, or Suspension of Processing of Personal Information by C&K Tour Customers: Customers should submit a request for access, correction, deletion, or suspension of processing of personal information via email (info@cnktour.com). Contacting the C&K Tour customer service center will assist in completing the process promptly after confirming the customer's identity. 9. Withdrawal of Consent for the Collection/Use/Provision of Personal Information Customers have the right to withdraw their consent for the collection, use, and provision of personal information at any time. Consent withdrawal can be requested through the C&K Tour website (cnktour.com) by logging in and applying for consent withdrawal (membership withdrawal) through the My Page menu. Alternatively, customers can submit a written request via email or mail to C&K Tour's customer center and the personal information manager, and C&K Tour will promptly take action after confirming the customer's identity. 10. Protection of Personal Information for Children Under 14 Years Old For children under 14 years old, travel product/service contracts can be made through legal representatives (parents, legal guardians, custodians). Only the minimum necessary personal information for performing the service is collected. The legal representative of a child under 14 years old can request access or correction of the child's personal information and withdraw consent for the collection, use, provision, and outsourcing of personal information. Personal information of children under 14 years old will not be provided or shared with third parties without the consent of the legal representative. 11. Measures for Technical/Managerial Security to Ensure Personal Information Protection (1). Technical Measures Customer's personal information is protected by passwords, and important data is further secured using encryption or file lock functions (Lock). C&K Tour adopts security devices (SSL or SET) to securely transmit personal information over the network using encryption algorithms. C&K Tour takes measures to prevent damage from computer viruses by using regularly updated antivirus programs. Security measures, including intrusion prevention systems and vulnerability analysis systems, are implemented on each server to prepare for external intrusion such as hacking. (2). Managerial Measures C&K Tour limits access to customer's personal information to the minimum necessary personnel. Regular in-house training and external delegated training on security technology acquisition and compliance with personal information protection obligations are conducted. Security oaths from all employees are obtained at the time of employment to prevent information leakage by human error. Internal procedures are established to audit compliance with the personal information processing policy. Personal information and general data are stored separately on dedicated servers. C&K Tour is not responsible for individual mistakes or risks of the basic internet that may occur. In the event of a loss, leakage, alteration, or damage to personal information due to internal administrator errors or technical management accidents, C&K Tour will immediately notify you of the facts and take appropriate measures and compensation. 12. Management of Personal Information Destruction C&K Tour promptly destroys collected personal information after the purpose of use is achieved, following the information protection reasons under internal policies and other relevant laws. The destruction process and method are as follows: A. Destruction Process Personal information provided by customers for membership registration and travel service usage is stored for a certain period according to the purpose of use and retention period, and then it is deleted or destroyed in accordance with internal policies and other relevant laws. B. Destruction Method Personal information printed on paper: Shredded using a shredder. Personal information stored in electronic file format: Deleted in a way that cannot be reproduced by using an irreversible method. C. Destruction Timing In the case of membership registration information: When withdrawing from membership or being expelled from membership. In the case of payment information: On the completion date of the payment or when the statute of limitations for debt extinction has expired. In the case of information collected for surveys, events, etc.: When the survey, event, etc., ends. However, even if the purpose of collection or the provision purpose is achieved, personal information may be retained if there is a need to retain it under the provisions of commercial law and other laws. 13. Collection of Opinions on Personal Information If you have inquiries about the privacy policy or any other opinions, please contact the following email and fax reception points. Email: info@cnktour.com Phone: 403-561-4038 Address: 121 Candle Place Southwest, Calgary, AB If you need consultation for personal information infringement and reporting, you can contact the following external organizations: ○ Personal Information Dispute Mediation Committee Phone: 118 (without area code) URL: https://kopico.go.kr ○ Personal Information Infringement Report Center Phone: 118 (without area code) URL: http://privacy.kisa.or.kr ○ Cyber Crime Investigation Department, Supreme Prosecutors' Office Phone: 02-3480-3571 Email: cybercid@spo.go.kr ○ Cyber Safety Bureau, National Police Agency Phone: 182 (without area code) URL: http://cyberbureau.police.go.kr 14. Notification of Changes to the Privacy Policy If there are additions, deletions, or modifications to the contents of the privacy policy, they will be announced through the notice on the website before the revised content is reflected. Furthermore, to easily identify the revision status, a version number and revision date will be assigned to the privacy policy, and in the case of important matters, notifications will be sent to customers via email. Privacy Policy Version 1.0 Effective Date: December 01, 2023 Last Revised: December 01, 2023 15. Contact Information for the Personal Information Management Officer C&K Tour is committed to securely protecting customer's personal information and addressing complaints and inquiries related to personal information. If you have any questions regarding personal information or related matters, please contact the designated personal information management officer. We will provide sincere and prompt responses based on established standards. E-mail: info@cnktour.com