Privacy Policy

Effective Date: July 28, 2026

PADATOUR INC. (주식회사파다투어)

PADATOUR INC. (주식회사파다투어; the “Company”) establishes and publishes this Privacy Policy pursuant to Article 30 of the Personal Information Protection Act in order to protect the personal information of data subjects and promptly address related grievances.

Article 1 (Purposes of Processing Personal Information)

The Company processes personal information for the following purposes and does not use the personal information it processes for any purpose other than those stated below.

1. Accepting reservations for travel services, entering into and performing contracts, and processing and settling payments
2. Processing necessary for the local operation of services provided directly by the Company, including local arrangements, operations management, and safety management
3. Responding to customer inquiries, handling complaints, resolving disputes, and delivering notices
4. Complying with legal obligations and protecting users
5. Providing marketing and event information only where the user has given prior consent

Article 2 (Categories of Personal Information Processed)

1. Required information: name, mobile phone number, email address, reservation information (product, date, and number of persons), and payment-related information
2. Optional information: name in English as shown on the passport, date of birth, emergency contact information, and requests
3. Sensitive information: for products requiring safety management, such as water leisure activities, information concerning health status (only where separate consent has been obtained)
4. Automatically collected information: access IP address, cookies, service usage records, and device information

Article 3 (Retention and Use Period of Personal Information)

1. The Company processes and retains personal information within the retention period prescribed by applicable law or the retention period consented to by the data subject.
2. The retention periods required under applicable laws are as follows.
   • a. Records concerning contracts or withdrawal of offers: 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
   • b. Records concerning payment and the supply of goods or services: 5 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
   • c. Records concerning consumer complaints or dispute resolution: 3 years (Act on the Consumer Protection in Electronic Commerce, Etc.)
   • d. Records concerning labels and advertisements: 6 months (Act on the Consumer Protection in Electronic Commerce, Etc.)

Article 4 (Provision of Personal Information to Third Parties)

The Company processes personal information only within the scope specified in Article 1 and provides it to a third party only where permitted under Articles 17 and 18 of the Personal Information Protection Act, including where the data subject has consented or where a special provision of law applies.

Article 5 (Entrustment of Personal Information Processing)

1. The Company may entrust the processing of personal information as follows to ensure the smooth provision of services.
   • a. Entrustee: [토스 페이먼츠] / Entrusted task: payment processing and settlement
   • b. Entrustee: [미야코 레진] / Entrusted task: [processing experience reservations and providing services]
   • [SOU 렌터카] / Entrusted task: [processing rental car reservations and providing vehicles]
   • [이시가키 GOGO 렌터카] / Entrusted task: [processing rental car reservations and providing vehicles]
   • [스시겐야] / Entrusted task: [processing restaurant reservations and providing services]
   • [은하수 투어] / Entrusted task: [processing tour reservations and providing services]
   • [PIPELINE 스쿠버] / Entrusted task: [processing scuba reservations and providing services]
   • [아이크루 시사] / Entrusted task: [processing Ishigaki boat tour reservations]
2. When entering into an entrustment agreement, the Company specifies in the agreement, in accordance with Article 26 of the Personal Information Protection Act, matters including the prohibition of processing personal information for purposes other than performing the entrusted tasks, measures to ensure security, and restrictions on sub-entrustment. The Company also supervises the entrustee to ensure that personal information is processed securely.

Article 6 (Cross-Border Transfer of Personal Information)

1. The Company transfers personal information overseas through entrustment of processing and storage as follows for reservation processing and the local operations management of services provided directly by the Company.
   • a. Recipients: 株式会社PADA (local operator located in Japan), 씨앤유투어, 노니투어, 셀룰리안 블루, 미야코레진, SOU 렌터카, 이시가키 GOGO 렌터카, 스시겐야, 은하수 투어, PIPELINE 스쿠버, 아이크루 시사
   • b. Destination country: Japan
   • c. Information transferred: name, contact information, email address, reservation information, and information necessary for safety management
   • d. Timing and method of transfer: transmitted through information and communications networks when the reservation is confirmed
   • e. Recipients’ purposes of use: reservation agency services and local operations management, including local arrangements and safety management
   • f. Retention and use period: until the purpose of the entrustment has been fulfilled or for the same period as the Company’s retention period
2. The cross-border transfer described in paragraph 1 constitutes the entrustment of personal information processing and storage necessary for the performance of a contract entered into with the data subject and for enhancing the convenience of the data subject under Article 28-8(1)3 of the Personal Information Protection Act. By disclosing the foregoing matters in this Privacy Policy, the Company substitutes such disclosure for separate consent.

Article 7 (Processing of Sensitive Information)

When a reservation is made for a product requiring safety management, such as a water leisure activity, the Company may process information concerning health status. In such cases, pursuant to Article 23 of the Personal Information Protection Act, the Company obtains the data subject’s separate consent for that information, distinguished from other personal information. Such sensitive information is processed solely for safety management purposes and is destroyed without delay once that purpose has been fulfilled.

Article 8 (Rights and Obligations of Data Subjects and How to Exercise Them)

1. A data subject may at any time request access to, correction or deletion of, or suspension of processing of personal information, or withdraw consent.
2. These rights may be exercised in writing or by email, and the Company will take action without delay.
3. Where the data subject is a child under 14 years of age, the child’s legal representative may exercise these rights.

Article 9 (Destruction of Personal Information)

1. When personal information becomes unnecessary, including upon expiration of the retention period or fulfillment of the purpose of processing, the Company destroys that personal information without delay.
2. Information in electronic file format is permanently deleted using a method that prevents recovery or restoration, and paper documents are shredded or incinerated.

Article 10 (Measures to Ensure the Security of Personal Information)

To ensure the security of personal information, the Company implements administrative measures (establishing an internal management plan and conducting regular training), technical measures (managing access rights, implementing access controls, encryption, and installing security programs), and physical measures (controlling access to locations where materials are stored).

Article 11 (Use of Cookies)

The Company may use cookies to provide customized services to users, and users may refuse the storage of cookies through their web browser settings. Further details are governed by the Company’s “Cookie Policy.”

Article 12 (Chief Privacy Officer)

The Company has designated the following Chief Privacy Officer to assume overall responsibility for personal information processing and to handle complaints and provide remedies for data subjects.

• Name/Title: 손정의 / Chief Executive Officer
• Contact: Telephone 010-3212-1220, Email support@padatour.com

Article 13 (Remedies for Infringement of Rights)

A data subject may apply for dispute resolution or consultation regarding a personal information infringement with the Personal Information Dispute Mediation Committee (1833-6972), the Personal Information Infringement Report Center (118), the Supreme Prosecutors’ Office (1301), or the National Police Agency (182).

Article 14 (Changes to this Privacy Policy)

This Privacy Policy takes effect on July 28, 2026. If any content is added, deleted, or amended, the Company will announce the changes on the website beginning 7 days before the effective date of the changes.