Vacatio Inc. ("the Company") complies with the Personal Information Protection Act ("PIPA") and related laws of the Republic of Korea, and establishes and discloses this privacy policy to protect the personal data of people who use the VACATIO Samseong ("the Hotel") website (vacatiohotel.com) and the Hotel's accommodation services. This policy applies the Company's company-wide privacy policy (vacatio.us/privacy) to the Hotel; where the two differ, the terms more favourable to the data subject apply.
Article 1 (Categories, purposes and retention periods of personal data processed)
The Company processes the following personal data. No item is used for purposes other than those specified, and separate consent is obtained if a purpose changes. The Hotel website itself has no sign-up or input forms; bookings are made on the booking page operated by the Company (booking.vacatio.cloud).
Category
Items collected
Purpose
Legal basis
Retention period
Room bookings
(required) name, phone, email, booking details (dates, room, number of guests)
Concluding and performing bookings, confirming them and notifying changes or cancellations, customer support
PIPA Article 15(1)4
Until the purpose is achieved. However, under the Act on Consumer Protection in Electronic Commerce, records of contracts or withdrawal of subscription are kept for 5 years, records of payment and supply of goods for 5 years, and records of consumer complaints or dispute resolution for 3 years.
Payment
Payment approval data (payment-method data such as card numbers is collected and processed directly by the payment gateway NICE Payments and is not held by the Company)
Payment and settlement of fees
PIPA Article 15(1)4
5 years under the Act on Consumer Protection in Electronic Commerce
3 years after the purpose is achieved (consultation history management)
Automatically collected data
IP address, cookies (language setting), access logs, device/browser information
Operating the website, security and prevention of misuse
PIPA Article 15(1)4
Access logs are kept for at least 3 months under the Protection of Communications Secrets Act and then destroyed.
※ If you contact us through our KakaoTalk channel, Kakao Corp.'s privacy policy also applies to your use of the messenger.
Article 2 (Purposes of processing)
The Company processes personal data for the following purposes: (1) concluding and performing bookings and settling fees; (2) check-in, room assignment and guest service during the stay; (3) responding to enquiries and consultations; (4) operating and securing the website and preventing misuse; and (5) fulfilling legal obligations.
Article 3 (Personal data of children under 14)
As a rule, the Company does not collect personal data from children under the age of 14. Where collection is unavoidable, the consent of a legal representative is obtained.
Article 4 (Provision to third parties)
The Company does not provide personal data to third parties without the data subject's consent, except: (1) where specially provided by law; (2) where an investigative agency requests it in accordance with the procedures and methods prescribed by law; or (3) where the data subject has consented in advance.
If you book through an external channel (such as an online travel agency), the booking details that channel collects are passed to the Hotel to provide your stay, and that channel's privacy policy also applies.
Article 5 (Outsourcing of processing)
To provide the service smoothly, the Company outsources the following processing tasks. Outsourcing contracts include the matters required for safe management and supervision under PIPA Article 26, and any re-outsourcing by a processor requires the Company's prior approval.
Processor
Outsourced task
Amazon Web Services, Inc.
Operating cloud infrastructure such as the booking system, and data storage
NICE Payments Co., Ltd.
Payment processing and settlement
Vercel Inc.
Website hosting and deployment
Google LLC
Business email delivery and storage of enquiry data (Google Workspace)
To provide the service, the Company transfers personal data overseas as follows. The legal basis is PIPA Article 28-8(1)3 (outsourcing of processing and storage).
Recipient
Destination country
Items transferred
Method of transfer
Purpose
Retention period
Amazon Web Services, Inc. (aws-korea-privacy@amazon.com)
Overseas regions including the United States
Personal data collected in the course of booking and use
Transmitted and stored over the network when the service is used
Cloud infrastructure operation and backup
Until the outsourcing contract ends
Vercel Inc.
United States
Access data processed when the website is visited
Transmitted over the network when the website is used
Website hosting and deployment
Until the outsourcing contract ends
Google LLC
United States
Email and enquiry data
Transmitted and stored over the network when the service is used
Business email delivery and storage of enquiry data
Until the outsourcing contract ends
Data subjects may refuse the overseas transfer via the contact in Article 12; refusal may limit the use of the relevant service.
Article 7 (Destruction and separate storage)
(1) The Company destroys personal data without delay once the retention period expires or the purpose of processing is achieved.
(2) Data in electronic file form is permanently deleted in a manner that makes recovery or reproduction impossible, and printed materials are shredded or incinerated.
(3) Data that must be retained by law is stored and managed separately from other personal data and is not used for any purpose other than that retention.
Article 8 (Rights of data subjects and how to exercise them)
(1) Data subjects may at any time request access to, correction or deletion of, or suspension of the processing of their personal data, and may withdraw consent.
(2) Rights may be exercised in writing or by email (operation@vacatio.us), and the Company will act without delay (within 10 days).
(3) Rights may be exercised through a legal representative or an authorized agent, in which case a power of attorney must be submitted.
(4) Where there is a statutory ground to refuse a request, the Company notifies the data subject of the reason and how to object.
Article 9 (Installation, operation and refusal of cookies)
(1) The Hotel website uses a single cookie (NEXT_LOCALE) to remember the language you chose. It does not use cookies or collect behavioural data for visit analytics or personalised advertising.
(2) You may refuse cookie storage through your browser settings (e.g. Chrome — Settings > Privacy and security > Cookies). Refusing does not limit your use of the website; only your language choice will not be remembered.
Article 10 (Operation of visual data processing devices)
(1) The Hotel operates fixed visual data processing devices (CCTV) for facility safety and crime prevention. Details follow the CCTV operation and management policy posted on site.
(2) Mobile visual data processing devices, such as cameras mounted on the Hotel's autonomous service robots, are operated with an indication that filming is taking place, in accordance with PIPA Article 25-2.
Article 11 (Measures to ensure the security of personal data)
The Company establishes and implements an internal management plan, manages access rights and controls access, encrypts personal data, retains access logs and prevents their forgery or alteration, installs security programs, and applies physical access controls.
Article 12 (Data protection officer and department receiving access requests)
· Data protection officer — Ji Hyunjun (Chief Executive Officer).
· Department receiving and handling access requests — Operations Team · operation@vacatio.us.
Privacy enquiries, complaints and requests for remedy may be submitted to the contact above, and the Company will respond without delay.
Article 13 (Remedies for infringement of rights)
Reports and consultations regarding personal data infringement may be directed to the following organisations.
Organisation
Contact
Website
Personal Information Dispute Mediation Committee
1833-6972
www.kopico.go.kr
Privacy Infringement Report Center (KISA)
118 without an area code
privacy.kisa.or.kr
Supreme Prosecutors' Office
1301
www.spo.go.kr
Korean National Police Agency
182
ecrm.police.go.kr
Article 14 (Changes to this privacy policy)
(1) If content is added to, deleted from or modified in this policy, we will give notice in the website's notices 7 days before it takes effect (30 days in advance for significant changes such as items collected, purposes, or provision to third parties).
(2) This policy takes effect on 12 October 2026. Previous versions are available on request at operation@vacatio.us.