BEAUTRIP.

Privacy Policy

Data controller
㈜케이플랫폼
Effective
17 August 2026

㈜케이플랫폼 (the "Company") establishes and discloses this Privacy Policy under Article 30 of the Personal Information Protection Act of Korea, to protect the personal data of data subjects and to handle related concerns. This policy applies to BEAUTRIP (the "Platform"), operated by the Company.

Article 1 Purposes of Processing

  1. Bookings and orders — intermediating bookings for partner services such as clinics and spas, selling package products, issuing booking confirmations (QR codes), and providing booking history.
  2. Pharmacy product sales — accepting orders for health functional foods and cosmetics, delivery, and handling returns and refunds.
  3. Partner and agency applications — receiving partnership applications from clinics, businesses and agencies, verifying eligibility, and concluding and performing contracts.
  4. Local Friend matching — matching and settling requests for interpretation and accompaniment support.
  5. Customer enquiries — receiving enquiries, establishing the facts, and notifying the outcome.
  6. Service improvement and statistics — analysing usage, processed in a form that cannot identify individuals.

Article 2 How Personal Data Is Collected

  1. Entered directly by the user into forms on the Platform (bookings, applications, enquiries).
  2. Generated automatically during use of the service (access logs, cookies).
  3. The Company does not obtain personal data from third parties without the user's consent.
  4. 🔴 The Company does not require Korean mobile phone identity verification. It does not collect resident registration numbers, and no field exists in which such a number could be stored.

Article 3 Personal Data Collected

  1. [Currently collected] The following items are actually collected and stored.
  2. Bookings (guest, no account) — name, email, nationality, number of people, preferred language, and special requests (optional). A phone number is optional and is accepted only in international format.
  3. ⚠️ The special requests field may contain health-related information such as allergies. This constitutes sensitive data under the Personal Information Protection Act. It is passed only to the relevant partner for the safety of the procedure and is not used for any other purpose. Entering it is optional.
  4. Clinic and business partnership applications — business name, representative's name, business registration number, contact details (phone and email), business address, opening hours, services offered, languages supported, and a record of consent to use materials (name of the person consenting and the time of consent).
  5. Agency partnership applications — company name, representative's name, contact person's name, email, phone number, country, business registration number, primary customer nationalities, annual volume band, and packages of interest.
  6. Administrator accounts — email and display name (Company staff only).
  7. Collected automatically — IP address, access time, browser and device information, and cookies. This is the minimum required to provide the service and maintain security.
  8. [Designed but not currently collected] Member sign-in, payment, subscription delivery and Local Friend registration are not yet enabled, so the following are not collected. This policy will be amended, with prior notice, when those features are enabled.
  9. Member details (social account identifier, preferred language), payment records, delivery addresses, and a Local Friend's visa type, university details and profile photograph.

Article 4 Retention and Use Periods

  1. The Company processes and retains personal data within the period required by law or the period consented to by the data subject.
  2. Records of bookings and payments — 5 years (Act on Consumer Protection in Electronic Commerce)
  3. Records of payment and supply of goods — 5 years (same Act)
  4. Records of contracts and withdrawal of subscription — 5 years (same Act)
  5. Records of consumer complaints and dispute resolution — 3 years (same Act)
  6. Member details — destroyed immediately on withdrawal. Transaction records subject to the statutory retention above are stored separately for the required period.
  7. Clinic and agency partnership applications — 3 years after the contract ends. Applications that do not result in a contract are destroyed without delay once assessment is complete.
  8. Consent forms for the use of materials — until consent is withdrawn. On withdrawal we destroy the record immediately and stop displaying the material.
  9. Access logs — 3 months (Protection of Communications Secrets Act)
  10. Translation sessions — duration in seconds only. See Article 5.
  11. Location data — deleted immediately when an interpretation request ends. See Article 6.

Article 5 Voice Data and Translation Records

  1. 🔴 The Company does not store audio files.
  2. 🔴 The Company does not store speech recognition (STT) text. It is discarded immediately after translation.
  3. 🔴 The Company does not record calls.
  4. For the Travel Assistant, the only records kept are the duration in seconds, source language, target language and amount charged. These are used to calculate fees.
  5. This is not merely a policy statement. The translation session table in the database has no column capable of holding audio or text. There is nowhere to store it even if one tried.
  6. Phrase cards in the Travel Assistant are processed on the user's device and are not sent to the server.
  7. Where speech recognition or translation connects to an external service, data is transmitted only within the scope of that purpose; those providers are listed in Article 8.

Article 6 Location Data

  1. 🔴 The Company does not track users' locations on an ongoing basis.
  2. Location data is collected only at the moment the user taps [Request interpretation help]. If the button is not tapped, no location is collected.
  3. It is used solely to find Local Friends near the point of request.
  4. 🔴 When the request ends, the coordinates are deleted immediately. Only a district-level label remains, for statistics. This is enforced by a database trigger, so deletion does not depend on the application behaving correctly.
  5. Where the emergency screen sends a location to 119, the coordinates are composed into a text message on the user's device and are not sent to the Company's servers. The user decides whether to send it.
  6. Users may refuse or withdraw location permission at any time in their browser settings. If refused, alternatives such as the 1330 tourist helpline are offered.

Article 7 Provision to Third Parties

  1. The Company processes personal data only within the purposes set out in Article 1, and provides it to third parties only with the data subject's consent or where specifically permitted by law.
  2. To fulfil a booking — the minimum information needed to fulfil the booking (name, date and time, number of people, preferred language, special requests) is provided to the clinic, spa or other partner booked. Use beyond that purpose is prohibited by contract.
  3. To match a Local Friend — the meeting place, time and preferred language are provided to the matched Local Friend. 🔴 Phone numbers are not disclosed to either party; contact is made through a privacy relay number.
  4. The Company does not sell personal data or provide it to third parties for advertising purposes.

Article 8 Transfer of Personal Data Abroad

  1. 🔴 The Company transfers personal data abroad as set out below in order to provide the service. Under Article 28-8 of the Personal Information Protection Act, the recipient, country, items, purpose and retention period are disclosed below.
  2. Transfers are made by transmission over the network when the service is used.
  3. Data subjects may refuse transfer abroad. However, these providers are essential infrastructure for the service, so refusal may limit use of the Platform. Please notify the Data Protection Officer if you wish to refuse.
  4. 🔴 Entries marked "not currently used" relate to features that are not yet enabled, so no transfer is actually taking place. This policy will be amended, with prior notice, when those features are enabled.
RecipientCountryItems transferredPurposeRetention
Supabase, Inc.United StatesAll items listed in Article 3Database storage and administrator authenticationSame as the periods in Article 4
Vercel Inc.United StatesIP address, access time, browser and device informationWeb hosting and service delivery3 months
Resend, Inc.United StatesRecipient email, name, booking or application detailsSending booking confirmations and application notificationsDestroyed promptly after sending (delivery log 30 days)
DeepL SEGermanySentences the user submits for translationMachine translationNot currently used (discarded immediately once enabled; not stored)
Google LLCUnited StatesAudio submitted for recognition, notification tokens, map query coordinatesSpeech recognition and synthesis, push notifications, mapsNot currently used (discarded on processing once enabled)

Article 9 Outsourcing of Processing

  1. The Company outsources personal data processing to the providers listed in Article 8 in order to deliver the service.
  2. Under Article 26 of the Personal Information Protection Act, outsourcing contracts specify the prohibition on use beyond the stated purpose, technical and administrative safeguards, restrictions on sub-processing, and liability for damages.
  3. Any change to the outsourced work or the processors will be disclosed through this policy.

Article 10 Rights of Data Subjects

  1. Data subjects may at any time request access, correction, deletion or suspension of processing of their personal data.
  2. Requests may be made to the Data Protection Officer by email or telephone, and the Company will act without delay.
  3. Requests for access, correction or deletion are acted upon and the outcome notified within 10 days of receipt.
  4. Data subject to a statutory retention obligation (Article 4) cannot be deleted on request; the reason will be explained.
  5. A statutory representative or an authorised agent may act on the data subject's behalf, on production of a letter of authority.
  6. The Company does not disadvantage data subjects for exercising these rights.

Article 11 Destruction of Personal Data

  1. Personal data is destroyed without delay once the retention period has elapsed or the processing purpose has been achieved.
  2. Where data must be retained under other legislation after the retention period, it is moved to a separate database or stored in a different location.
  3. Electronic files are deleted by means that make recovery impossible; paper documents are shredded or incinerated.
  4. 🔴 The Company does not store original document files, such as consent forms, on its servers. At present only the file name is recorded and the original is kept separately.

Article 12 Security Measures

  1. Access control — row level security is applied to every table in the database. The public key exposed in the browser cannot read a single row of booking, application or settlement data.
  2. Administrator access — the administrator area requires separate authentication and is limited to accounts on the registered administrator list.
  3. Encryption in transit — all communication is encrypted with HTTPS.
  4. No payment data stored — the Company does not store card numbers or other payment credentials.
  5. Minimal collection — not collecting is the most reliable protection, so no column exists for audio or STT text.
  6. Access logging — access to systems processing personal data is logged and protected against alteration.

Article 13 Cookies

  1. The Company uses cookies to maintain sign-in state and language preference.
  2. Session cookies are used for administrator authentication and are limited to the administrator area.
  3. Users may refuse cookies in their browser settings. Some functions, such as retaining the language preference, may then be limited.
  4. The Company does not use third-party tracking cookies for advertising.

Article 14 Children Under 14

  1. The Company does not collect personal data from children under the age of 14.
  2. Where a child under 14 needs to use the service, please book in the name of a statutory representative with that representative's consent.
  3. If the Company becomes aware that personal data of a child under 14 has been collected without the consent of a statutory representative, it destroys the data without delay.

Article 15 Data Protection Officer

  1. The Company designates the following Data Protection Officer, who has overall responsibility for personal data processing and for handling complaints and remedies from data subjects.
  2. Data Protection Officer — Yu Eunjeong (Representative, ㈜케이플랫폼)
  3. Contact — thenatureheal@gmail.com · 070-4130-5526 (weekdays 09:00–17:00 KST)
  4. The 070 number may not be reachable from outside Korea. Email reaches the same person.
  5. Data subjects may direct any privacy enquiry arising from use of the service to the Data Protection Officer, and the Company will respond and act without delay.

Article 16 Remedies for Infringement

  1. Data subjects may apply to the following bodies for dispute resolution or advice regarding infringement of personal data.
  2. Privacy Center, Korea Internet & Security Agency — privacy.kisa.or.kr · 118
  3. Personal Information Dispute Mediation Committee — kopico.go.kr · 1833-6972
  4. Cybercrime Investigation Division, Supreme Prosecutors' Office — spo.go.kr · 1301
  5. National Office of Investigation, Korean National Police Agency — ecrm.police.go.kr · 182
  6. A person whose rights or interests are infringed by a disposition or omission of the head of a public institution in relation to a request under Articles 35, 36 or 37 of the Personal Information Protection Act may seek administrative appeal under the Administrative Appeals Act.

Article 17 Changes to This Policy

  1. This policy applies from the effective date.
  2. Where content is added, deleted or amended due to changes in law, policy or security technology, the change is announced on the Platform at least 7 days before it takes effect.
  3. 🔴 Where a change materially affects the rights of data subjects — such as adding collected items, changing the purpose of use, or adding a recipient of transfers abroad — it is announced at least 30 days in advance and separate consent is obtained where required.
  4. When member sign-in, payment, subscription delivery or Local Friend registration are enabled, the items collected will increase; this policy will be amended and notice given in advance.

Data Protection Officer: 유은정 · thenatureheal@gmail.com · 070-4130-5526 (weekdays 09:00–17:00 KST). The 070 number may not be reachable from outside Korea, so please use email. Complaints about personal data may also be raised with the Korea Internet & Security Agency Privacy Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).