1. Who is responsible
EASTORY (이스토리), 4F 402-245A (IVY Spa), 16 Sure-ro 116beon-gil, Wabu-eup, Namyangju-si, Gyeonggi-do, Republic of Korea, operates this website and is responsible for the personal information described here. Privacy contact: eastorykorea@gmail.com.
2. What we collect
When you book or send a booking request: name, email address, phone number (optional), the experience, date, start time, number of adults, children and infants, the language you used on the Site, any message you write to us, and — for products that require it, such as the DMZ — nationality and passport details collected by email before the tour.
When you pay with PayPal: PayPal processes your payment. We receive the PayPal order and transaction identifiers, the amount and the payment status. We never see or store your card number.
When you use the contact form: name, email address, topic and your message.
Automatically: a cookie that remembers your language choice (NEXT_LOCALE). Our hosting provider records technical data such as IP address, browser type and the pages requested in order to deliver the Site and protect it against abuse. We do not use advertising or tracking cookies.
3. Why we use it
- To confirm, prepare and operate your experience and to contact you about it (performance of a contract).
- To take payment and issue refunds (performance of a contract).
- To answer your enquiries (consent and legitimate interest).
- To meet legal obligations, such as keeping transaction records under Korean e-commerce law and submitting participant lists required for restricted areas such as the DMZ.
- To keep the Site secure and prevent fraud (legitimate interest).
We do not sell personal information, and we do not use it for marketing unless you have asked us to.
4. Who receives it
- PayPal (payments), under PayPal's own privacy policy.
- Supabase (database hosting in Seoul, Republic of Korea) and Vercel (website hosting and delivery), as processors acting on our instructions.
- Google (email), to send and receive booking correspondence.
- Guides and partner suppliers — only the information needed to run your experience (name, party size, language, special requirements; passport details where a venue requires them).
- Public authorities where the law requires it, for example military authorities for DMZ access.
Some of these providers are located outside Korea (United States). We use providers that offer contractual safeguards for international transfers.
5. How long we keep it
| Information | Retention |
|---|---|
| Booking and payment records | 5 years (Korean Act on Consumer Protection in Electronic Commerce) |
| Records of complaints and disputes | 3 years |
| Contact-form enquiries | 1 year after the last correspondence |
| Passport details for restricted areas | Deleted within 30 days after the tour |
| Language cookie | 1 year on your device |
6. Your rights
You may ask to see, correct or delete your personal information, to restrict its use, or to withdraw consent at any time by emailing eastorykorea@gmail.com. We respond within 10 business days. Deletion may be limited where the law requires us to keep records. If you are unhappy with our response you may contact the Personal Information Protection Commission of Korea (privacy.go.kr) or the supervisory authority in your country.
7. Security
Personal information is stored in access-controlled systems, transmitted over encrypted connections (HTTPS) and accessible only to staff who need it. Administrative access is password-protected.
8. Children
Bookings must be made by an adult aged 19 or over. We collect children's information (number and age bracket, and name where a venue requires it) only from the adult making the booking.
9. Changes
We may update this policy; the date at the top shows the current version. Material changes are announced on the Site.
10. Contact
Privacy officer, EASTORY (이스토리) · 4F 402-245A (IVY Spa), 16 Sure-ro 116beon-gil, Wabu-eup, Namyangju-si, Gyeonggi-do, Republic of Korea · eastorykorea@gmail.com