Handys Co., Ltd. (hereinafter the "Company") strives to comply with the Personal Information Protection Act and relevant laws to protect users' freedom and rights. Pursuant to Article 30 of the Personal Information Protection Act, the Company establishes and discloses the following Privacy Policy to guide users on procedures and standards for processing personal information and to promptly and smoothly handle related grievances.
Personal Data Collection
Name, email, phone number, etc.
Processing Purpose
Service provision, etc.
Third-Party Disclosure
Provided after obtaining user consent
Entrusted Processing
Payment, messaging services, etc.
User Rights & Obligations
Access, rectify, delete, suspend, etc.
※ See the full Privacy Policy for details
Table of Contents
The Company processes users' personal information as follows. Additional personal information may be collected for individual service users, and separate consent will be obtained at the time of collection. Users may request withdrawal of consent at any time; however, in such cases, part or all of the service may become unavailable.
1) Non-Members
| Category | Classification | Collection Items | Purpose | Retention Period |
|---|---|---|---|---|
| Reservation & Service Use | Required | Name, email, phone number, booking password, bank account and account holder name (for cash refund requests), date of birth, customer consultation content and personal information necessary for consultation | Provision of room and facility reservation/inquiry/use services, identity verification and age confirmation, handling of complaints and announcements | Retained until the period required by applicable law (e.g., 5 years for purchases, 3 months for IP addresses) |
| Customer Support | Required | Name, phone number, email | Customer Q&A and service improvement | Deleted 30 days after consultation for complaint history management and settlement/refund processing (retained until the period required by applicable law if necessary) |
2) The following cases allow collection and use of personal information without user consent:
1) The Company may additionally use and provide personal information without the data subject's consent, taking into account the Personal Information Protection Act and relevant laws.
2) To additionally use and provide personal information without the data subject's consent, the Company considered the following:
3) When additionally using or providing personal information pursuant to 1) above, it will be added to and notified in the third-party consent section.
The Company processes users' personal information within the scope specified in the processing purposes, and provides personal information to third parties only with the user's consent or where required by law.
The Company provides personal information with user consent in the following cases for smooth service provision.
| Recipient | Purpose | Items | Retention Period |
|---|---|---|---|
| Breakfast Service [Acescom Co., Ltd.] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Breakfast Service [Doson Company] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Breakfast Service [Goldenridge] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Breakfast Service [Fresh Food] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Breakfast Service [Hwalgi People] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Breakfast Service [Costa Food] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Amenity Service [The Fim Company] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Amenity Service [Epic Co., Ltd.] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Amenity Service [Chestertons Co., Ltd.] | Provision of reserved products/services and fulfillment of contract (verification of user and reservation information), handling of complaints, consumer dispute resolution | Reservation holder information (name, phone number) or booking information (check-in date, check-out date) | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| Osiria Switzen Matie Management | Monthly parking permit verification, refund processing for unregistered free parking permits | (Regular) Room in use, stay schedule, vehicle number; (for refund) phone number included | Regular data destroyed within 10 days of submission; refund data confirmed and immediately destroyed on the same day |
| Channel Corporation | Customer support | Name, phone number, email, reservation information, device information of consulting customer | Until purpose achieved. If retention is required by applicable law, retained until that point, then immediately destroyed. |
| StayPass Membership Partners | Employee authentication verification and management, service provision, handling of complaints, consumer dispute resolution | Corporate authentication email | Until termination of partnership or withdrawal of consent. If retention is required by applicable law, retained until that point, then immediately destroyed. |
The Company entrusts some personal information processing tasks to overseas businesses as follows.
| Trustee | Entrusted Tasks | Country | Personal Data Transferred | Transfer Method | Retention Period |
|---|---|---|---|---|---|
| Airbridge | Analysis of user service usage records | USA | User ID, visit date/time, service usage records, device and app version information, etc. | Information transmitted via network upon service access | Until contract termination |
| Google LLC (Google Ads/Google Analytics) | Analysis of user service usage records, provision of customized advertisements and performance measurement | USA | ADID/IDFA, access IP, device information (OS/app/browser version, etc.), service usage records (visits, clicks, conversions, etc.), (if applicable) member identifier (internal ID or hashed email, etc.) | Information transmitted via network upon service access | Until contract termination |
Users may refuse cross-border transfer of personal information through the Company's Data Protection Officer and department. However, if refused, services that necessarily involve cross-border transfer may be restricted.
The Company entrusts personal information processing tasks as follows for smooth personal information operations.
| Trustee | Entrusted Tasks | Personal Data | Retention Period |
|---|---|---|---|
| PayPal | Electronic payment processing and handling (credit cards, etc.), refund processing | Name, phone number, email, payment-related information (payment method, transaction amount, transaction date/time, order number) | Until purpose achieved or contract termination |
| Channel Corporation | SMS/MMS message delivery and notification service / Data storage and infrastructure provision / Customer support | Name, phone number, email |
The Company specifies in contracts matters relating to prohibition of processing personal information beyond entrusted tasks, technical/administrative protective measures, restrictions on re-entrustment, supervision of trustees, and liability including damages.
If the content of entrusted tasks or trustees change, the Company will promptly disclose this through this Privacy Policy.
The Company destroys personal information without delay when it becomes unnecessary due to the expiration of the retention period or achievement of the processing purpose.
If personal information must continue to be retained under other laws despite the expiration of the consented retention period or achievement of the processing purpose, it will be transferred to a separate database (DB) or stored in a different location.
1) Destruction Procedure
The Company selects personal information for which a reason for destruction has arisen and destroys it after receiving approval from the Personal Data Protection Officer.
2) Destruction Method
Electronic files are destroyed so that records cannot be reproduced; paper documents are shredded or incinerated.
3) Cases Retained Under Internal Policy
| Reason for Retention | Retention Period |
|---|---|
| Disputes, litigation, etc. between the Company and users where the legally prescribed retention period has passed | Retained until dispute resolution, then destroyed |
| Cases where the Company has obtained individual user consent | Retained until the consented period, then destroyed |
| Remaining settlements | Retained until settlement completion, then destroyed |
4) Cases Retained Under Applicable Laws
| Retained Information | Legal Basis | Retention Period |
|---|---|---|
| Records of contracts or withdrawal of subscription | E-Commerce Consumer Protection Act Article 6 | 5years |
| Records of payment and supply of goods | E-Commerce Consumer Protection Act Article 6 | 5years |
| Records of consumer complaints or disputes | E-Commerce Consumer Protection Act Article 6 | 3years |
| Records of labeling/advertising | E-Commerce Consumer Protection Act Article 6 | 6months |
| Website and app visit records | Protection of Communications Secrets Act Article 15-2 | 3months |
※ However, regardless of the retention period specified for each piece of collected information, if necessary to comply with legal obligations or if an investigation is ongoing, the information shall be retained until the investigation ends.
※ Personal information items may be automatically generated and collected during use of internet services (IP addresses, cookies, MAC addresses, service usage records, visit records, misuse records, etc.).
a. Purpose of Cookie Use
Used to identify visit and usage patterns for each service and website visited by the user and security connection status, to provide optimized information.
b. Installation, Operation, and Opt-Out of Cookies
PC (Web Browser)
Mobile — Android
Mobile — iOS
If cookie storage is refused, personalized service use may be difficult.
c. Collection of Advertising Identifiers (ADID/IDFA) on Mobile Apps
The Company may collect advertising identifiers (ADID/IDFA) from mobile app users for customized services and advertising performance measurement.
Methods to opt out are as follows. (Note: Some personalized features may be unavailable after opting out.)
d. Collection/Use of Behavioral Information and Opt-Out Methods
The Company processes behavioral information by identifying individuals using cookies to provide optimized customized services, benefits, and online targeted advertising during service use.
| Collection Items | Collection Method | Purpose | Retention Period |
|---|---|---|---|
| Visit/usage records (visit date/time, content used, click history, etc.), advertising identifiers (ADID/IDFA), access IP, device information (OS, app/browser version, etc.), member identification values (internal ID or hashed email, etc.) | Automatically collected during app/web use; through external analytics/advertising tools such as Google Ads/Google Analytics (by Google LLC), Naver Analytics (by NAVER Corp.) | Providing interest-based targeted advertising, advertising effectiveness analysis, service quality improvement | Retained until purpose achieved or until user withdraws consent; immediately deleted upon withdrawal |
Third-Party Provision of Behavioral Information
The Company provides behavioral information to third parties as follows.
| Collection Tool | Collection Items | Purpose | Retention Period |
|---|---|---|---|
| Google LLC (Google Ads/Analytics) | ADID/IDFA, access IP, device information (OS/version), service usage records, hash value | Interest-based targeted advertising and statistical analysis | Until purpose achieved (processed in the US) |
※ Information transmitted to Google LLC is processed in the United States. See Section 4 for cross-border transfer details.
Collection of Behavioral Information from Third-Party Operated Web/Apps
| Collection Items | Collection Method | Purpose | Retention Period |
|---|---|---|---|
| ADID/IDFA, page visit/view/click history, device information, hashed member identification value | Automatically collected when Google/Naver SDK/scripts run | Interest-based advertising, service analytics and optimization | Destroyed upon purpose achievement or withdrawal of consent |
Rights to Opt Out of Behavioral Information Collection
Users may refuse targeted advertising based on behavioral information at any time, which does not restrict service use. (However, some personalized features may be limited.)
Mobile (Android)
- Android: Settings > Privacy > Advertising > Disable ad personalization
- Google account: Settings > Google > Advertising > Deselect personalized ads
Mobile (iOS)
- iOS 14.5 and above: Settings > Privacy & Security > Tracking > Disable "Allow Apps to Request to Track"
- Older versions: Settings > Privacy > Advertising > Limit Ad Tracking
Web Browser (Chrome)
- Chrome > Settings > Privacy and security > Cookies and other site data > Block third-party cookies
Specific Platform - Google Analytics
- Install 'Google Analytics Opt-out Browser Add-On' in browser (blocks data transmission entirely.)
Specific Platform - Google Ads
- My Ad Center > Turn off (OFF) personalized ads
If you need to inquire about access to your personal information, please contact us at the following:
| help@handys.co.kr |
The Company does not, in principle, collect personal information of children under the age of 14 who require the consent of a legal representative. If it is necessary to collect such information in exceptional cases, the Company will ensure the legal rights of legal representatives (right to access, correct, delete, and suspend processing of the child's personal information).
The Company takes the following measures to ensure the safety of personal information:
The Company designates a Data Protection Officer and department to take overall responsibility for personal data processing, handle complaints, receive and process access requests, and provide remedies for damages.
| Data Protection Officer | IT Manager | Department (Access Requests, etc.) |
|---|---|---|
| Nine (Park Geon), Team Lead | Team Lead Park Geon | |
| Squad | Squad | Squad |
| 070-8655-2349 | 070-8655-2349 | 070-8655-2349 |
| nine.park@handys.co.kr | nine.park@handys.co.kr | help@handys.co.kr |
For more detailed consultation regarding personal data infringement, you may contact the following national agencies:
The Company may change this Privacy Policy in accordance with changes in policy or applicable laws. The Company will notify users of any changes in advance through notices.
Notice Date: 2026 04 20, 2026
Effective Date: 2026 04 20, 2026
© 2026 ㈜핸디즈 (Handys Co., Ltd.). All rights reserved.