Privacy Policy
Last updated 2026-09-30
Preamble
Lecirt ("the Company") establishes and discloses this Privacy Policy in accordance with the Personal Information Protection Act of the Republic of Korea.
Article 1 (Personal Data Collected) — 1. For booking and tour delivery (required)
The Company does not collect or store full card numbers, expiry dates, or CVC codes. You enter these directly in the payment window and they are handled by the payment gateways (Korea PortOne Co., Ltd. and Eximbay). The Company receives only the payment result (the "Payment" items below) from the payment gateways.
| Category | Items |
|---|---|
| Booker | Name (in English), email address, mobile number or messenger ID (WhatsApp/LINE/WeChat), nationality |
| Traveler | Name (in English), gender, age category (adult/child/infant) |
| Booking | Product name, departure date, number of participants, pickup point, options selected, booking number |
| Payment | Transaction number, amount, currency, payment time, payment method type (for cards, the card brand and the last 4 digits of the card number) |
Article 1 — 2. For DMZ and other military area tours (required)
Passport numbers constitute unique identifying information under Article 24 of the Personal Information Protection Act and are collected under separate consent, distinct from other personal data.
Such data is stored in encrypted form and destroyed without delay once the clearance process concludes.
Travelers must enter passport details at the time of booking and must notify the Company by 3 days before departure (D-3) if the details change, for example due to passport renewal.
| Items | Basis |
|---|---|
| Passport number, date of birth, name and nationality as shown on passport | Advance visit clearance by the relevant military authority and the United Nations Command |
Article 1 — 3. Optional data
Dietary restrictions (vegetarian / halal / allergies), mobility limitations, pregnancy, other special notes
Purpose: traveler safety and adjustment of meal arrangements
Right to refuse: You may decline to provide optional data. Certain accommodations may then be unavailable, but your booking can still proceed.
Information relating to health, pregnancy, or disability constitutes sensitive data under Article 23 of the Act and is collected under separate consent.
Article 1 — 4. Automatically collected data
IP address, cookies, access logs, browser and device information, visit timestamps.
Article 1 — 5. Collection methods
Website booking forms; customer service email and messenger; and, for bookings made through OTA platforms (Klook, KKday, GetYourGuide, Trip.com, VELTRA, etc.), the minimum information transferred by that platform for tour delivery.
Article 2 (Purposes of Processing)
1. Conclusion and performance of the travel contract: booking confirmation, seat allocation, pickup arrangements, guide assignment, admissions and meal reservations
2. Payment and settlement: payment processing, refunds, payment dispute handling
3. Customer support: inquiries, complaints, emergency contact during tours
4. Safety management: emergency response in the event of an accident
5. Legal compliance: retention of e-commerce records, tax reporting
6. Marketing (with separate consent): new product announcements, promotions, review requests
Article 3 (Retention Periods)
Data is destroyed without delay once the applicable period expires. Electronic files are permanently deleted by irrecoverable means; printed materials are shredded or incinerated.
| Category | Retention period | Legal basis |
|---|---|---|
| Booking and traveler data | 3 months after tour completion | Purpose fulfilled |
| Passport data for DMZ / military area visits | Destroyed immediately after clearance concludes | Purpose fulfilled |
| Records of contracts and withdrawal of offer | 5 years | E-Commerce Act, Art. 6 |
| Records of payment and supply of services | 5 years | E-Commerce Act, Art. 6 |
| Records of consumer complaints and disputes | 3 years | E-Commerce Act, Art. 6 |
| Records of advertising and labeling | 6 months | E-Commerce Act, Art. 6 |
| Tax and transaction evidence | 5 years | Framework Act on National Taxes |
| Access logs (IP, etc.) | 3 months | Protection of Communications Secrets Act |
| Marketing consent records | Until consent is withdrawn | Data subject consent |
Article 4 (Provision to Third Parties)
The Company does not provide personal data to third parties, except as follows and only with the User's separate consent:
| Recipient | Purpose | Items | Retention |
|---|---|---|---|
| Ministry of National Defense units and the United Nations Command | Clearance for visits to the DMZ and areas near the Military Demarcation Line | Name (English), passport number, date of birth, nationality | Until the clearance process concludes |
| Tourist and experience facilities requiring advance reservation | Confirmation of admission or use | Name (English), number of participants, date of use | Day of visit |
Article 5 (Processing Entrusted to Service Providers)
The Company entrusts the following personal data processing operations to service providers in order to provide the Services.
| Processor | Entrusted work | Retention |
|---|---|---|
| Tour guides and tour leaders (Company employees or contracted freelancers) | Verification of the participant list on the day, pickup and guiding, emergency contact | Destroyed immediately upon tour completion |
| Chartered bus operators (specific operator names available on request) | Passenger transport and passenger list management | Statutory retention period |
| Korea PortOne Co., Ltd. and Eximbay | Payment and refund processing | Until the outsourcing contract ends |
| Amazon Web Services (Amazon SES) | Delivery of booking confirmations and notices | Until the outsourcing contract ends |
| Amazon Web Services (Seoul Region) | Data storage and server operations | Until the outsourcing contract ends |
The Company concludes data processing agreements with each processor, specifying prohibitions on use beyond the stated purpose, restrictions on sub-delegation, security measures, and liability for damages, and supervises compliance.
Data shared with guides is limited to name (English), number of participants, pickup point, contact details, and special notes. Passport numbers and payment details are not shared.
Article 6 (Transfer of Personal Data Overseas)
1. The Company stores personal data in Korea (Amazon Web Services, Seoul Region) and does not itself transfer it overseas.
2. However, where you pay or are refunded with a card issued outside Korea or with Alipay, WeChat Pay, or UnionPay, the payment details you enter directly in the payment window, together with the booker name and email address the Company passes with the payment request, are transmitted through the payment gateways (Korea PortOne Co., Ltd. and Eximbay) to the relevant card issuer, card network, or other payment institution outside Korea in order to authorize the payment and process refunds.
Article 7 (Your Rights)
1. You may at any time request access to, correction of, deletion of, or suspension of processing of your personal data, and withdraw consent. Deletion may be limited where retention is required by law.
2. Requests may be made in writing or by email to Lecirt.korea@gmail.com. The Company will act within 10 days of receiving the request.
3. Personal data of children under 14 is collected only with the consent of a legal guardian.
Article 8 (Security Measures)
1. Administrative: internal management plan, minimization of staff with access, regular training
2. Technical: access rights management, access control systems, encrypted storage of unique identifying information (passport numbers), password encryption, security software installation and updates
3. Physical: access control to server rooms and document storage
Article 9 (Cookies)
The Company uses cookies to improve usability. You may refuse cookies through your browser settings, though some features may then be unavailable.
Article 10 (Privacy Officer and Complaints)
Privacy Officer
Name: Jung Ji-ho · Title: Operations Manager · Email: Lecirt.korea@gmail.com
Reporting privacy violations (Korea)
Korea Internet & Security Agency Privacy Center — privacy.kisa.or.kr / 118
Personal Information Dispute Mediation Committee — www.kopico.go.kr / +82-1833-6972
Article 11 (Changes)
This Policy takes effect on August 1, 2026. Changes will be announced on the Site at least 7 days before taking effect.
The Policy as amended on September 30, 2026 takes effect on October 8, 2026.