개인정보 처리방침

1. Purpose and Scope

This Privacy Policy explains how ISTRAVEL (“ISTRAVEL,” “we,” “our” or “us”) collects, uses, discloses, retains and protects personal information in connection with istraveler.com, inquiry forms, email, KakaoTalk and our travel consultation and booking services.

ISTRAVEL is an independently operated travel advisory brand. Travel bookings made through ISTRAVEL are processed through Fora Travel Inc., a travel agency registered with the Travel Industry Council of Ontario (“TICO”).

ISTRAVEL (Affiliate of Fora Travel Inc.)
TICO Registration No. 50027942
Registered Address: 1235 Bay Street, Suite 700, Toronto, ON M5R 3K4

Where applicable, ISTRAVEL’s handling of personal information is governed by Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), Canada’s Anti-Spam Legislation (“CASL”), the Travel Industry Act, 2002, Ontario Regulation 26/05 and other applicable laws.

This Policy applies to personal information under ISTRAVEL’s control. Fora Travel Inc., hotels, cruise lines, airlines, payment processors and other independent third parties may separately process personal information under their own privacy policies.

2. Meaning of Personal Information

“Personal information” means information about an identifiable individual, whether the individual can be identified from that information alone or in combination with other information.

Personal information may include names and contact details, travel itineraries, dates of birth, citizenship, passport information, payment-related information, family relationships, health, dietary or accessibility requests and online identifiers.

Information that has been anonymized so that it cannot reasonably be linked to an identifiable individual may not be treated as personal information under this Policy unless otherwise required by applicable law.

3. Personal Information We Collect

ISTRAVEL may collect the following personal information, depending on the services requested and the nature of the booking.

• Name and full legal name as shown on travel documents;
• Email address;
• Telephone number or KakaoTalk contact information;
• City, province or state and country of residence;
• Mailing or billing address; and
• Preferred method of communication.

• Date of birth and age as of the applicable sailing or check-in date;
• Gender or title where required by a Supplier;
• Citizenship, nationality and residency status;
• Passport type, passport number, issuing country and expiry date;
• NEXUS, Known Traveller Number and hotel, airline or cruise membership numbers;
• Flight, hotel, cruise, transportation and other itinerary details;
• Room, cabin, bedding, dining and other preferences;
• Travel companions, family relationships and guardianship information for minors;
• Birthdays, anniversaries and other special-occasion information; and
• Other information required by a Supplier to complete a booking.

• Payment authorization status;
• Cardholder name;
• Limited payment information, such as card type and the last digits of the card number;
• Payment amount, currency, date and status;
• Deposit, outstanding balance, refund and transaction records; and
• Invoices and booking confirmations.

Complete card numbers, expiry dates and security codes may be collected and processed through a secure payment system designated by Fora. ISTRAVEL does not request or directly retain complete payment card information through ordinary email, KakaoTalk or ordinary documents.

Where requested by the customer or necessary to provide travel services, ISTRAVEL may collect sensitive information such as:

• Mobility assistance and accessibility requirements;
• Wheelchair or medical-equipment information;
• Allergies and dietary restrictions;
• Pregnancy or other health information that may affect travel;
• Information required by a Supplier to process a special request; and
• Information reasonably necessary in an emergency.

ISTRAVEL collects and discloses such information only to the extent reasonably necessary to process the relevant request.

• Information submitted through inquiry forms;
• Email and KakaoTalk correspondence;
• Booking instructions, special requests and customer-service records;
• Amendment, cancellation, refund, complaint and dispute records; and
• Documents and attachments provided by the customer.

• IP address;
• Browser and device type;
• Operating system;
• Date and time of access;
• Pages visited and referral or exit pages;
• Website usage and interaction information;
• Information collected through cookies, analytics and similar technologies; and
• Security and diagnostic logs.

4. How We Collect Personal Information

ISTRAVEL may collect personal information:

• When a customer completes a website inquiry form;
• When a customer communicates with us through email or KakaoTalk;
• When a customer completes a booking or payment form;
• When a customer provides passport information or other travel documents;
• When a customer submits a special or accessibility request;
• When Fora or a Supplier provides booking status or change information;
• Through cookies and analytics technologies used on the website; and
• When a customer provides information on behalf of a travel companion.

A customer who provides another person’s personal information confirms that they have the appropriate authority to provide it and, where required, have informed that individual or their legal representative and obtained any necessary consent.

5. How We Use Personal Information

ISTRAVEL may use personal information to:

• Respond to inquiries and understand the customer’s travel requirements;
• Research and recommend suitable hotels, cruises and other travel services;
• Prepare quotations and process bookings, payment authorizations, invoices and confirmations;
• Communicate traveller information to Fora and applicable Suppliers;
• Process room, cabin, dining, celebration, health, dietary, accessibility and other special requests;
• Provide reminders regarding final payments, online check-in, itinerary changes and departure preparation;
• Process booking amendments, cancellations, refunds, customer-support matters and disputes;
• Fulfil legal disclosure obligations concerning travel documents and booking conditions;
• Maintain accurate booking, payment, invoicing and customer-service records;
• Prevent and investigate fraud, unauthorized transactions, security incidents and misuse of services;
• Operate, maintain, protect and improve the website;
• Comply with legal and regulatory obligations and establish, exercise or defend legal claims; and
• Send newsletters and marketing information where the customer has separately consented.

If ISTRAVEL wishes to use personal information for a new purpose that is not reasonably consistent with the original purposes, the customer will be notified and consent will be obtained where required.

6. Consent and Withdrawal of Consent

ISTRAVEL may obtain express or implied consent depending on the sensitivity of the information, the purpose of collection and the customer’s reasonable expectations.

Express consent may be requested for sensitive or material processing, including passport information, health or accessibility information, payment information or a disclosure to a third party that the customer would not reasonably expect.

Merely visiting the website or reading this Privacy Policy does not constitute blanket consent to all processing of personal information. Required consent may be obtained through an inquiry form, booking form, payment form, email, electronic signature or another appropriate method.

A customer may withdraw consent at any time, subject to legal, regulatory and contractual restrictions. Withdrawal may be limited or may affect the services where:

• The information is required to process or maintain a booking;
• A Supplier requires the information to provide the travel services;
• Transaction, tax, accounting, TICO or other regulatory records must be retained;
• The information is required in connection with a refund, insurance claim, dispute or legal claim; or
• Collection, use or retention is otherwise permitted or required by law.

If a customer does not consent to or withdraws consent for the processing of information necessary for a booking, ISTRAVEL may be unable to make, maintain or administer the booking.

Marketing consent is managed separately from consent required to provide travel consultation and booking services. Customers may withdraw marketing consent at any time by using the unsubscribe function in a marketing email or contacting hello@istraveler.com.

7. Disclosure of Personal Information

ISTRAVEL may disclose personal information to the following recipients to the extent reasonably necessary to provide and administer travel services:

• Fora Travel Inc.;
• Hotels, resorts and other accommodation providers;
• Cruise lines;
• Airlines, rail companies and other transportation providers;
• Tour, excursion, ground transportation and destination-management providers;
• Travel insurers or insurance intermediaries where requested or authorized by the customer;
• Payment processors and card networks;
• Website hosting, inquiry-form, email, customer-management, cloud-storage and business-automation providers;
• Travel companions or representatives authorized by the customer;
• Legal, accounting, insurance and other professional advisors; and
• Government authorities, regulators, courts or law-enforcement bodies authorized by law.

Because of the nature of travel bookings, some Suppliers may process personal information as independent organizations under their own privacy policies after receiving it.

ISTRAVEL does not sell or rent personal information. Personal information is not disclosed for an unrelated third party’s independent marketing purposes unless the customer separately consents.

Where permitted by law, personal information may be transferred as part of a business reorganization, transfer, merger or succession, subject to appropriate confidentiality and privacy protections.

8. International Transfers and Processing

Because of the international nature of travel services, personal information may be transferred to, stored in or processed by Fora, Suppliers and service providers located outside the customer’s province, country of residence or Canada.

For example, when a booking or special request is submitted to an overseas hotel, cruise line, airline or local operator, traveller information may be processed in the relevant destination country.

Information processed in another country may be subject to that country’s laws and may be accessible to foreign government or law-enforcement authorities in response to a lawful request.

ISTRAVEL applies reasonable safeguards to personal information under its control and uses contractual or other reasonable measures to require service providers to handle the information appropriately.

Where an international transfer is not necessary to fulfil a booking or is made for a purpose that the customer would not reasonably expect, ISTRAVEL will provide separate notice and obtain any consent required by applicable law.

9. Protection of Payment Information

ISTRAVEL does not request complete card numbers, card expiry dates or card security codes through ordinary email, KakaoTalk or a general inquiry form.

Payment information must be submitted through a secure payment system designated or approved by Fora. Complete payment card information may be processed directly by that payment system, payment processor or Supplier rather than by ISTRAVEL.

Customers should enter payment information only into an authorized payment form and should not send complete card information by email or KakaoTalk.

If a customer sends complete card information through an unauthorized method, ISTRAVEL may take reasonable steps to securely delete it and redirect the customer to an authorized payment method.

10. Cookies and Analytics Technologies

ISTRAVEL’s website may use cookies and similar technologies to:

• Provide essential website functionality and security;
• Remember user preferences;
• Analyze website visits and usage patterns;
• Diagnose errors and improve performance; and
• Measure content and marketing performance.

Essential cookies may be required for the operation and security of the website. Non-essential analytics or marketing cookies that require consent will, where applicable, be used according to the user’s choices.

Customers may block or delete cookies through their browser settings or an available cookie-management tool. Disabling certain cookies may prevent parts of the website from functioning properly.

ISTRAVEL may update this Policy or provide a separate cookie notice if the cookies, analytics tools or marketing technologies used on the website change.

11. Marketing Communications

ISTRAVEL sends newsletters, promotions and other commercial electronic messages only where the customer has consented or where otherwise permitted by applicable law.

Marketing messages will identify the sender and include a method of unsubscribing. Customers may unsubscribe at any time, and unsubscribe requests will be implemented within the period required by applicable law.

Operational communications necessary to administer an existing inquiry or booking—including booking confirmations, payment notices, itinerary changes, final-payment reminders, online check-in and departure information—are not marketing messages and may continue after a customer unsubscribes from marketing.

Declining or withdrawing marketing consent will not adversely affect the customer’s ability to receive travel consultation or booking services.

12. Personal Information of Minors

ISTRAVEL’s website and services are not designed for independent use by minors. However, when arranging family travel, ISTRAVEL may collect a child’s personal information from a parent, legal guardian or authorized adult.

This information may include the child’s name, date of birth, citizenship, passport information, family relationship, dietary, health or accessibility requests and other booking information required by a Supplier.

A person who provides a minor’s personal information confirms that they have the appropriate authority to provide the information and authorize its use for the travel booking.

If ISTRAVEL learns that it collected personal information directly from a minor without appropriate authorization, it will take reasonable steps to delete the information unless retention is required by law.

13. Retention and Disposal

ISTRAVEL retains personal information only for as long as reasonably necessary to:

• Administer travel inquiries and bookings;
• Maintain transaction, payment and invoicing records;
• Address customer service, refund, insurance or dispute matters;
• Comply with tax, accounting, TICO and other legal or regulatory requirements; and
• Prevent fraud and establish, exercise or defend legal claims.

Retention periods may vary according to the type and sensitivity of the information, booking status, statutory requirements and the reasonable likelihood of a dispute.

When personal information is no longer required, it will be securely deleted, destroyed or anonymized using reasonable methods. Copies may temporarily remain in third-party backup systems or legally retained records until the applicable deletion cycle expires.

Information that is the subject of an access, correction or privacy challenge may be retained for as long as necessary to allow the individual to exhaust the applicable procedures and available recourse.

14. Security Safeguards

ISTRAVEL uses reasonable administrative, technical and physical safeguards appropriate to the volume, format and sensitivity of the personal information.

These safeguards may include:

• Restricting access to individuals with a business need to know;
• Password, multi-factor authentication and account-security measures;
• Secure payment systems designated or approved by Fora;
• Encryption during transmission or storage;
• System updates and security reviews;
• Limiting the amount of personal information collected;
• Privacy and security requirements for service providers;
• Secure deletion of information that is no longer required; and
• Privacy breach and security-incident response procedures.

No transmission or storage system using the internet, email, messaging services or electronic storage can be guaranteed to be completely secure.

Customers should not send passport copies, complete card information or sensitive health information through ordinary email or KakaoTalk and should use a secure method designated by ISTRAVEL where one is available.

15. Privacy Breach Response

If personal information is lost or is subject to suspected or confirmed unauthorized access, use, disclosure, copying or modification, ISTRAVEL will investigate, mitigate the effects and take reasonable steps to reduce the risk of recurrence.

A breach of security safeguards that creates a “real risk of significant harm” under PIPEDA will be reported to the Office of the Privacy Commissioner of Canada, and affected individuals will be notified, in the manner and within the time required by law.

Relevant financial institutions, Suppliers or other third parties may also be notified where doing so may reduce or mitigate the risk of harm.

ISTRAVEL maintains records of breaches of security safeguards subject to PIPEDA for the period required by law. The current minimum retention period for such records is 24 months after the date on which the breach is determined to have occurred.

16. Accuracy of Personal Information

Customers must provide accurate and current traveller information. Errors in legal names, dates of birth, citizenship, passport information or contact details may result in amendment costs, denial of boarding or other adverse consequences.

Customers should notify ISTRAVEL as soon as reasonably possible if information changes or an error is identified.

ISTRAVEL takes reasonable steps to maintain personal information that is accurate, complete and current to the extent necessary for the purposes for which it is used.

If corrected information has already been disclosed to a Supplier, ISTRAVEL may communicate the correction to the relevant Supplier where reasonably possible. Supplier fees or restrictions may apply to changes made to an existing booking.

17. Individual Privacy Rights

Subject to applicable law and permitted exceptions, an individual may request to:

• Confirm whether ISTRAVEL holds personal information about them;
• Access personal information held by ISTRAVEL;
• Receive an account of how the information has been used or disclosed;
• Correct inaccurate or incomplete personal information;
• Delete personal information that is no longer required;
• Withdraw consent;
• Unsubscribe from marketing communications; and
• Challenge or complain about ISTRAVEL’s privacy practices.

ISTRAVEL may request reasonable information to verify the requester’s identity before processing a request.

Access may be restricted where disclosure is prohibited by law or would reveal another person’s information, legally privileged information, confidential commercial information or information relating to an investigation.

If an access or deletion request is refused in whole or in part, ISTRAVEL will explain the reason to the extent permitted by law.

Even where deletion is requested, ISTRAVEL may be unable to delete information required for legal or regulatory retention obligations, an active booking, transaction records, a dispute, fraud prevention or a legal claim.

Privacy requests may be submitted to hello@istraveler.com.

18. Privacy Questions and Complaints

Questions, requests or complaints concerning personal information should first be submitted to ISTRAVEL’s Privacy Officer.

Privacy Officer
ISTRAVEL
1235 Bay Street, Suite 700
Toronto, ON M5R 3K4
Email: hello@istraveler.com

ISTRAVEL will review privacy requests and complaints fairly and make reasonable efforts to respond within an appropriate period.

If an individual is not satisfied with ISTRAVEL’s response, they may contact or submit a complaint to:

Office of the Privacy Commissioner of Canada
Website: priv.gc.ca

Matters concerning TICO registration or travel-industry requirements may also be directed to TICO. However, TICO may not be the primary regulator responsible for general privacy complaints.

19. Third-Party Websites and Services

ISTRAVEL’s website may contain links to Fora, hotels, cruise lines, insurers, payment providers, social media platforms and other external websites.

ISTRAVEL does not control an independent third party’s website, security safeguards or privacy practices. Customers should review the relevant third party’s privacy policy before providing personal information through an external website.

The inclusion of an external link does not mean that ISTRAVEL guarantees or endorses the third party’s privacy or security practices.

20. Changes to This Policy

ISTRAVEL may amend this Policy to reflect changes in its services, technologies, Suppliers or legal requirements.

The revised Policy will be posted on the website with a new “Last Updated” date.

If a material change significantly affects individual rights or how personal information is used, ISTRAVEL will provide additional notice by email, website notice or another appropriate method and will obtain new consent where required by law.

A change to this Policy will not retroactively expand the purposes for which previously collected personal information may be used where doing so is not permitted by applicable law.

21. Language

This Policy may be provided in Korean and English for the customer’s convenience. The two versions are intended to convey the same meaning.

If there is a material inconsistency between the translations, the English version will prevail to the extent permitted by applicable law.

This language provision does not limit any notice actually provided to the customer, any non-waivable right under applicable law or the requirements for meaningful consent.