한화리조트

• ② Reservation and accommodation

• ③ Using on-site service

• ④ Other customers

• 2) For the mobile app service, the company can access and use the information and features of the customer's mobile communication device as follows. Required access items require explanation (information provision) and consent upon app installation or initial execution, and optional access items require separate consent upon initial use of the service. In the case of optional access items, the method of obtaining consent may differ depending on the OS version, but there is no restriction on the use of basic services even if the user refuses to give consent.

• 3) Personal information automatically collected
• Gender, date of birth, service use record, access log, cookie, access IP information, use suspension record, etc. may be automatically collected during online membership registration or identity verification (mobile phone based authentication). However, the collection of cookies may be rejected by the user's personal settings.
  
  (How to set cookies: Web browser tools > Internet options > privacy > advanced > select whether or not to accept cookies)
  
  ※ A cookie is a small amount of information that a website sends to the user's computer browser, which identifies the computer but does not personally identify the user.
• 4) Collection method
• - When the user consents to the collection of personal information and directly enters the information during the process of registering membership and using the service, the personal information is collected.
• - Personal information may be collected in writing at offline events, etc.
• - During the reservation and consultation process, personal information of the user may be collected through email, fax, telephone, chatbot service, etc.
• 5) Providing information on the effective period of personal information
• - To protect members' personal information, the company immediately deletes the personal information of website members who have not used the service for one year, in accordance with Article 39-6 (1) of the Personal Information Protection Act.
• - In this case, you will be notified of the deletion at the email address you registered, at least 30 days in advance.
• - If you want to use the service again, you can use it by registering as a new member.

After the purpose of collection and use of personal information is achieved, the company destroys the customer's personal information without delay. However, if it is necessary to retain it for a certain period of time for the following reasons such as confirmation of rights and obligations regarding transactions, etc. according to relevant laws and internal policies, it will be retained for the minimum period stipulated by the law.

• 1) Act on Consumer Protection in Electronic Commerce, etc.
  • - Records on contract or offer withdrawal, etc.: 5 years
  • - Records on payment, supply of goods, etc.: 5 years
  • - Records on handling of consumer complaints or disputes: 3 years
• 2) Protection of Communications Secrets Act
  • Website visit history: 3 months
• 3) Commercial Act
  • Slips or similar documents: 5 years
• 4) Civil Act
  • Statute of limitations for claims and property rights: 10 years

After the purpose of collecting and using personal information is achieved, the company destroys the personal information without delay according to the retention and use period. The method of destruction is as follows.

• 1) Personal information printed on paper: Shredding by a shredder
• 2) Personal information stored in electronic form: Permanent deletion using technical methods to prevent restoration
• 3) Storage media such as HDD, USB memory, etc.: Complete physical shredding

In principle, the company processes personal information within the purpose of collection and use, and does not use it beyond such purpose or provide it to a third party without prior consent from the customer, except in the following cases.

• 1) When the consent of the information subject is obtained
• 2) When there are special provisions in the law or when unavoidable to comply with legal obligations
• 3) When the information subject or his/her legal representative is unable to express an intent or his/her prior consent cannot be obtained due to unknown address, etc., and it is clearly deemed necessary for the immediate benefit of the life, body, or property of the information subject or a third party.

The company provides the following personal information for the purposes of better service, customer convenience, and member management. However, in the provision of personal information to third parties, prior consent is obtained from the customer.

• 1) The company entrusts the processing of personal information to third-party specialized contractors as follows for efficient conduct of business and smooth provision of service.

• 2) In order to provide more diverse and professional services to users, the company entrusts personal information processing to overseas contractors as follows.

The company collects and uses behavioral information in order to provide optimized and customized services and benefits to customers based on behavioral information such as website visit records, search records, and app usage records.

When collecting personal information of children under the age of 14, we obtain the consent of the legal representative. In order to obtain such consent, we may collect from the child the name and contact information of the legal representative. However, the legal representative’s personal information collected is used only for the purpose of obtaining consent to the collection of the child’s personal information, and if consent is not given within 5 days, the former is automatically destroyed.
- Online: Membership registration restricted for children under the age of 14
- Offline: Membership registration allowed with the consent of the legal representative

Members can access to or correct their registered personal information at any time. Online members can click ‘Change personal information’ or ‘Edit member information’ to go through the identity verification process and then directly access to or correct the same. Other customers can directly request the VOC, call center, etc. for the access, correction, or deletion. However, upon a customer’s request for (personal information) processing, the company may request him/her to prepare a personal information request form in accordance with the relevant processing procedure.

• 1) Right to request access to personal information
  • Customers may request access to their personal information processed by the company.
    The company allows the customer to access to personal information within 10 days upon receipt of a request from the customer. If there is a legitimate reason why he/she cannot access to the same, the company may notify the customer of the reason and postpone access, and when the reason ceases to exist, allows the customer to access to it without delay.
    In the following cases, the company may provide notice to the customer and restrict or prohibit him/her from accessing their personal information.
    
    • ① When access is prohibited or restricted by law
    • ② When there is a risk of harming the life or body of another person, or of unfairly infringing on the property or other interests of another person
• 2) Right to request correction/deletion of personal information
  • Customers may request correction/deletion of their personal information processed by the company. However, if the personal information is specified as subject to collection in the law, deletion cannot be requested.
    When a customer requests correction/deletion of personal information, the company takes necessary measures without delay and notifies the customer of the result, except when special procedures are stipulated in the law.
    If necessary, the company may request the customer to submit evidence necessary to verify the correction/deletion requirements.
    When a customer requests correction of an error in personal information, the personal information will not be used or provided to a third party until the correction is completed. In addition, if the customer's personal information has already been provided to a third party, the result of correction/deletion will be notified without delay to the third party so that it can be processed.
    When deleting personal information, the company take measures to prevent it from being recovered or reproduced.
• 3) Right to request suspension of personal information processing
  • Customers may request the company to suspend processing of their personal information.
    The company suspends all or part of the processing of personal information without delay when a customer requests it to suspend processing thereof. However, in the following cases, the customer's request to suspend processing may be rejected.
    • ① When there are special provisions in the law or when unavoidable to comply with legal obligations
    • ② When it is difficult to fulfill a contract with the information subject if personal information is not processed, and the information subject has not clearly stated an intent to terminate the contract
    • ③ When there is a risk of harming the life or body of another person, or of unfairly infringing on the property or other interests of another person
  • The company takes necessary measures, such as destroying personal information without delay, for personal information whose processing has been suspended at the request of the customer.
• 4) How to request access, correction/deletion, or suspension of processing, of personal information
  A customer who wishes to request access, correction/deletion, or suspension of processing, of personal information shall please fill out the "Personal Information Request Form" and send it to the privacy personnel by email or fax, and we will process it immediately.

The company implements the following technical, administrative, and physical measures necessary to ensure the safety of customer’s personal information so that the same will not be lost, stolen, leaked, falsified, or damaged.

• 1) Establishment and implementation of internal management plan for safe handling of personal information
• 2) Measures to control access to personal information and restrict the right of access thereto
• 3) Application of encryption technology that can safely store and transmit personal information or measures corresponding thereto
• 4) Storage of access records to respond to personal information infringement accidents and measures to prevent forgery/falsification
• 5) Installation and periodic renewal of security programs for personal information
• 6) Physical protective measures such as preparing facilities for safe storage of personal information or installing locking devices

The company operates a privacy (personal information protection) consultation channel for smooth communication with customers. If you have any questions, please contact us at the following contacts below and you will always receive sincere answers.

• 1) Call center: 1588-2299
• 2) Voice of Customer (VOC): File them through ‘Voice of Customer’ in the customer center menu on the website

If you otherwise require consultation on personal information infringement, you can contact the Personal Information Infringement Report Center of the Korea Internet & Security Agency or the Cyber Terror Response Center of the National Police Agency.

In order to protect customers' personal information and handle complaints related to personal information, the company has in place persons in charge of personal information protection as follows.

This current Privacy Policy was revised on May 09, 2023, and if the contents of the policy are changed (modified, added, or deleted) due to changes in relevant laws and the company's policy related to personal information protection, we will notify you in the Notice section of the bulletin board or a pop-up window.

• Date of announcement: May 09, 2023
• Effective date: May 16, 2023

▶ Privacy Policy v.40 (Previous version) (Enforcement date: March 29, 2023)