Zero One (the “Company”) values HanBuddy users’ personal information and complies with the Personal Information Protection Act and other applicable laws. This policy explains what information is processed and why, who receives or processes it, and users’ rights.
1. Personal Information Processed
The Company may process the following information when providing the Service.
Swipe sideways to see the full table.
| Category | Information | Collection method |
|---|---|---|
| Google login | Google account identifier, email, name, profile image | Received from Google when the user chooses Google login |
| Common profile | Nickname, nationality, date of birth, profile image | Entered during registration or profile editing |
| Tourist contact | Preferred contact method, contact identifier or phone number | Entered by the Tourist during registration or profile editing |
| Buddy application and operations | Phone number, application details, introduction, activity experience and qualification evidence, activity information and images, settlement information | Submitted by Buddies or generated during review and settlement |
| Bookings and activities | Booking number, activity, schedule, participant count, requests, cancellations, refunds, Buddy–Tourist messages, reviews | Generated through booking, activity and support use |
| Payment | Order number, amount, currency, discounts, payment method type, provider transaction identifier, authorization, cancellation and refund status | Received from payment providers such as Toss Payments and PayPal |
| Support and safety | Inquiry, reported person, submitted messages, photos, videos, receipts, attempted calls and results | Submitted by users or generated during dispute handling |
| Service use | Access time, IP address, browser and device information, cookies, usage, error and security logs | Automatically generated during use |
| Marketing (optional) | Email, nickname, marketing consent and withdrawal records | Optional user consent |
The Company does not directly store full card numbers, card passwords or payment account passwords. Sensitive information and resident registration numbers are not processed without legal grounds or separate explicit consent.
2. Purposes
Personal information is processed for:
- Registration, identity and age checks, login, account security and misuse prevention.
- Buddy eligibility review, activity listing, display, operation and settlement.
- Activity search, booking confirmation, payment, cancellation, refunds and communication between booking parties.
- Messages, notifications, translation, maps and address search.
- Inquiries, safety reports, dispute resolution, remedies and legal obligations.
- Failure analysis, security, quality improvement and statistics.
- Event and promotion information where the user gives optional consent.
3. Retention and Use Periods
Information is destroyed promptly when no longer needed, except records retained under applicable law:
Swipe sideways to see the full table.
| Record | Retention | Basis or purpose |
|---|---|---|
| Contracts and withdrawal | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Payments and supply of goods or services | 5 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Consumer complaints and disputes | 3 years | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Display and advertising | 6 months | Act on the Consumer Protection in Electronic Commerce, Etc. |
| Consent and acceptance of terms | Until applicable transaction and dispute retention periods end, even after account closure or consent withdrawal | Evidence of consent and dispute handling |
Other profile and account information is normally processed until account closure; marketing information until consent withdrawal or closure. For ongoing bookings, settlements or disputes, only necessary information is stored separately until processing and statutory retention periods end.
4. Third-Party Disclosure
The Company does not disclose information without consent or legal grounds. Once a booking is confirmed, it provides the following necessary information to the booked activity’s Buddy within the Tourist’s consent:
Swipe sideways to see the full table.
| Recipient | Purpose | Information | Retention and use |
|---|---|---|---|
| Buddy providing the booked activity | Participant identification, preparation, schedule and location communication, safety and disputes | Tourist nickname, profile image, participant count, requests, preferred contact method and contact details | Until activity and dispute purposes are fulfilled. Buddies must promptly delete separately stored information. |
Nicknames and profile images are disclosed equally for Buddies and Tourists. Member-posted activities and reviews may also be displayed to Service users. Buddy phone numbers and other contact information submitted for application review are not disclosed or provided to Tourists or general users.
Tourists may refuse disclosure consent but cannot book because necessary activity communication would be impossible. Disclosure without consent may occur where legally permitted for urgent protection of life or body, lawful investigative requests or similar grounds.
5. Outsourced Processing
The Company may outsource the following functions and manages privacy protection, purpose limitations, safety, subcontracting and supervision through contracts.
Swipe sideways to see the full table.
| Processor | Function |
|---|---|
| Amazon Web Services, Inc. and affiliates | Servers, databases, file storage, security, systems operation and translation infrastructure |
| Toss Payments Co., Ltd. | Domestic payment authorization, cancellation, refunds and fraud prevention |
| Contracted PayPal entities | International payment authorization, cancellation, refunds and fraud prevention |
| Google LLC | Google login, maps and address search |
Changes to processors and functions are disclosed through this policy. Providers’ own privacy policies may also apply to information they independently process under their legal obligations.
6. International Transfers
Choosing Google login, maps or PayPal may result in the following transfers:
Swipe sideways to see the full table.
| Recipient and contact | Countries | Information | Purpose | Timing and method | Retention |
|---|---|---|---|---|---|
| Google LLC (Google Privacy Inquiry) | United States and countries hosting Google data centers | Login requests and responses, Google identifier, email, name, profile image, address queries and technical logs | Login, maps, address search and security | Encrypted network transmission when using the feature | Google policy and Section 3 retention periods |
| PayPal Pte. Ltd. (PayPal Privacy) | Singapore and countries where the PayPal group operates | Email, order number, amount, currency, payment method, transaction status, IP and device information | Authorization, cancellation, refunds, identity checks and fraud prevention | Encrypted network transmission when paying with PayPal | PayPal statutory retention and Section 3 periods |
Users may refuse international transfers. Refusal for Google login may prevent registration and login through currently available methods; refusal for PayPal prevents PayPal payments. Alternative domestic payment methods may be used where offered. Questions and refusal requests may be sent to contact@hanbuddy.kr.
7. Destruction
- Information is promptly destroyed when its retention period ends or purpose is fulfilled.
- Information legally required to be retained is kept separately and not used for other purposes.
- Electronic files are deleted using methods that make recovery difficult; paper records are shredded or incinerated.
8. Rights of Users and Legal Representatives
- Users may exercise statutory rights including access, correction, deletion, suspension of processing, consent withdrawal and data transmission requests.
- Requests may be made through profile or account settings or contact@hanbuddy.kr.
- After verifying identity or lawful representation, the Company responds within the statutory period and communicates results. Legal restrictions are explained with appeal instructions.
- Registration by people under 19 is not permitted. If minors’ information is collected in error, it is verified and promptly deleted.
9. Security Measures
The Company implements necessary technical and organizational measures, including minimal access privileges, authentication and access control, encryption in transit and storage, access-log retention and review, vulnerability management, backups and staff training.
10. Cookies and Similar Technologies
- Cookies and similar storage maintain login, language settings, security and Service improvement.
- Essential cookies are necessary for the Service. If analytics or advertising cookies are introduced, their purposes, providers and retention periods are separately disclosed and necessary consent obtained.
- Users may delete or block cookies in browser settings. Blocking essential cookies may prevent login and other features.
11. Automated Decisions
The Company currently does not make decisions significantly affecting users’ rights or obligations solely by automated means. If introduced, criteria, effects and ways to object or request explanations will be disclosed here.
12. Privacy Officer and Remedies
- Privacy officer: Kim Min-hyeong
- Department: HanBuddy Operations Team
- Email: contact@hanbuddy.kr
- Phone: +82 10-8297-0110
- Address: Room 404, 15-4 Jeonnong-ro 34-gil, Dongdaemun-gu, Seoul, Republic of Korea
Users may seek advice or mediation from authorities such as the Personal Information Infringement Report Center and Personal Information Dispute Mediation Committee.
13. Policy Changes
The Company publishes changes and effective dates through the Service. Changes materially affecting users’ rights are announced at least 30 days in advance; other changes at least 7 days in advance.