Privacy Policy


Chapter 1. General Provisions
Article 1. What Privacy Policy Means for Our Users
This policy explains why and how Korean Air processes your personal information. Indeed, Personal Information Subjects are entitled to a number of rights – including a right to access, modify or erase their Personal Information or to restrict the processing of their Personal Information. You will find below relevant information, notably, on the Personal Information we process about you, the purposes and legal bases for the processing and your rights. You can access directly the section(s) of this Policy that are of the most interest to you.
Your Personal Information and your trust in our ability to protect your Personal Information are both key to our business. Korean Air pledges to do its best to protect the privacy and Personal Information of Personal Information Subjects and to prevent any illegal disclosure of Personal Information. Korean Air strictly complies with all domestic laws and regulations, including the Personal Information Protection Act.
Article 2. Definitions of terms
- What does “Personal Information” mean?
Personal Information means any information that can be linked directly or indirectly to identified or identifiable individuals.
- Who is the data controller?
Korean Air Lines Co., Ltd Open in new window whose head office is located 260, Haneul-gil, Gangseo-gu, Seoul (Gonghang-dong), Korea, acts as the data controller of the processing activities relating to the Personal Information referred to in this Policy. This means that Korean Air determines the purposes and means of the processing referred to in this Policy. Note that your Personal Information may also be processed as part of processing activities whose purposes and means are determined by other companies – such as, for example, other airlines operating flights you have booked with us, reservation system providers (sometimes known as a Global Distribution System or GDS), hotels or car rentals. In such circumstances, these companies act as data controllers and have their own privacy policy/statement. When your Personal Information is processed by other airline companies than Korean Air, you will find such other airline companies’ privacy statements on the following webpage: https://www.iatatravelcentre.com/privacy.htm Open in new window
- What is the scope of this Privacy Policy?
This Privacy Policy describes the processing and protection of Personal Information relating to Personal Information Subjects.
- passengers
- loyalty program (SKYPASS) members
- users of Korean Air’s website ‘koreanair.com’, mobile site ‘m.koreanair.com’ or mobile application
- users of Korean Air’s service center or branch offices.
Article 3. The rights of the subject of Personal Information
Do not hesitate to contact our Data Protection Officer (DPO) if you have any questions on this Privacy Policy by sending an email to privacy@koreanair.com or writing to 3 Place de l'Opéra 75002 Paris, France. This person has specially been designated to deal with your inquiries regarding Personal Information – in particular in respect of your rights. You will find further details on our DPO in Chapeter2 - Article 9
When you address inquiries or requests to exercise rights, please send us your personal information for us to identify you. The information you send will only be used as a verification of identity and we may ask you to send us your personal information via email if we cannot identify who you are.
- Full name
- Details of your request
- If you are applying on behalf of another person, signed authority from the individual is required.
- SKYPASS (Korean Air’s frequent flyer program) number, if you are a memberIn case, you cannot remember your SKYPASS number, following information would help us to identify your number:
- Date of birth
- Postal address
- Telephone number
- On-board details (flight number, date, route, etc.)
We would also like to inform you that Korean Air will not be able to erase some personal data due to following reasons in accordance with the article 17 of the EU GDPR
.EU GDPR: EU General Data Protection Regulation
- The processing of your personal data is necessary for compliance with a legal obligation.
- The processing of your personal data is necessary for the establishment, exercise or defense of legal claims.
Chapter 2. Collection and Use of Personal Information
-
Korean Air processes the following types of Personal Information within the minimal scope of what is necessary in order to provide its services. If you do not wish to provide us with this information, we will not be able to supply our services.
In addition, Korean Air may collect and process additional information intended to provide better services; such additional information is not collected unless Personal Information Subjects have provided their consent. In this case, there will be no negative consequences on the services provided even if a Personal Information Subject has declined to give consent.
At the time of the collection or processing of your Personal Information, Korean Air will expressly indicate what types of Personal Information are mandatory and what types are not, as well as the potential effects on you if you do not wish to provide us with your Personal Information.
- General and contact information;
name, CI information (for Korean nationals), date of birth, gender, contact number, email address, mailing address, SKYPASS account number, work information and flight information
- Travel-related information;
nationality, passport number, booking reference (known as Passenger Name Record – PNR), itinerary, emergency contact, seating preference, medical needs, and dietary requests.
Special categories of data or sensitive Personal Information:
In certain circumstances, you may want to provide us with travel-related information qualifying as special categories of data or sensitive Personal Information. This is the case, in particular, for health and religion-related data (for instance, when you ask for a wheelchair or a religious meal). There might be some borderline cases where the information you provide suggests your health condition or religion. We try to limit the circumstances where we process such sensitive Personal Information. If you want us to process your sensitive Personal Information, Korean Air will be subject to additional requirements, such as relying on a specific legal ground – for example, Korean Air may seek your explicit consent in compliance with data protection law.
- Payment-related information;
credit/debit card number(s), expiration date, approval number, bank name and bank account number
- Personal Information collected on our website;
in addition to the information listed in the general and contact information—identification (ID), password, access log, cookies and IP address, Location(APP)
- Information from the use of products or services such as online check-in and self-check-in;
regulatory passport information, reservation number, e-ticket number, frequent traveler number, telephone number and e-mail address
- Information from the use of products or services such as online check-in and self-check-in;
passport information, green card information, KTN(Known Traveler Number)
- Information from the use of products or services such as online check-in and self-check-in;
credit card information, Billing Address
- Personal Information collected on our chatbot;
Chat conversation contents, SKYPASS account number, User Key
- Information from the use of SNS login service;
SNS login account key(de-identified information)
- Information from the use of Kakao sync service;
account key(de-identified information), name, CI information (for Korean nationals), date of birth, gender, contact number, email address
- General and contact information;
-
When processing Personal Information Subject’s information, Korean Air mainly relies on the following legal bases.
- Consent of the Personal Information Subject
This legal basis is relevant when the Personal Information Subject has given consent to the processing of his/her personal data for one or more specific purposes.
- Direct marketing
Various items such as promotional items, mailing of various notifications such as newsletter, provision of customized services, etc. (see Article 6 on marketing activities below for further details).
- Special categories of Personal Information voluntarily provided by Personal Information Subject
You may voluntarily provide us with special categories of Personal Information (see Article 1 above).
When this is relevant, Korean Air will rely on a specific legal ground – for example, Korean Air may seek your explicit consent.
- Direct marketing
- Performance of a contract
This legal basis is relevant when the processing is necessary for the performance of a contract to which the Personal Information Subject is the party or in order to take steps at the request of the Personal Information Subject prior to entering into a contract:
- Service rendered and payment
Reservation, approval of financial transactions and financial services, verification of bank transactions and banking services, purchases and payments, collection of fees, delivering of airline tickets, and transportation (check-in, boarding, handling of baggage, etc.).
- Membership administration
Member verification for enrollment and membership service details, providing the benefits and services based on service contracts, protection from misuse by members and protection from unauthorized use.
- Service rendered and payment
- Compliance with legal obligations
This legal basis is relevant when the processing is necessary for compliance with a legal obligation to which Korean Air is subject, such as:
- Confirmation on the consent from a legal representative when collecting the information from minors under 14 years old
- Providing passenger information to border control and immigration
When such legal obligations are not imposed by European Union law or an EU Members State law, a processing based on legal obligation will be carried out if it is necessary for the purpose of the legitimate interests pursued by Korean Air or by a third party – provided that the need for complying with such obligation is not overridden by the interests or fundamental rights and freedoms of the Personal Information Subject.
- Legitimate interests of Korean Air
This legal basis is relevant when the processing is necessary for the purpose of the legitimate interests pursued by Korean Air or by a third party, such as:
- Pre-litigation and litigation
Record preservation for resolution of the future dispute, complaints and requested issue handling, delivering of notifications.
- General marketing and advertisement
Development and specialization of new services, service offering and advertisements according to the attributes of demographic research, product information by Korean Air and third parties, delivering advertising information and providing the participation opportunity in the events, statistics regarding the use of service.
For further details on this type of purposes, please refer to Article 6 on our marketing activities.
- Pre-litigation and litigation
- Consent of the Personal Information Subject
-
Korean Air may analyze your Personal Information to ensure that the information, notifications, promotions, and other services provided by Korean Air match your interests. Korean Air retains your boarding history and evaluates information on your recent visits to our website for analytics purposes to understand your interests and deliver personalized offers and other services.
- Use of the web analysis tools
Korean Air automatically collects website information (e.g. the number of visits, the number of pages visited, the activity on the website, error messages received) when you visit koreanair.com based on your cookie information. Korean Air also collects Personal Information (e.g. encrypted SKYPASS number, elite level status, gender) of the logged-in members using tags. Technologies such as cookies, tags, and scripts are used to analyze trends, administer the website, to track users’ movements around the website, and to gather demographic information.
- Personalized information and services
Korean Air may collect Personal Information (e.g. elite status, reservation, boarding history) and website behavior information (e.g. searched itinerary) for marketing purposes. Korean Air may use collected information to provide personalized offers about benefits and services tailored to your interests. By way of example, Korean Air may provide travel information such as weather, transportation, attractions, etc., based on the upcoming reservation details. When traveling with an infant, Korean Air may suggest relevant services such as special meal requests and inform baggage regulations related to an infant.
- Korean Air marketing offers / Opt-out
Korean Air may use your personal data in order to send personalized sales offers. When required by law, Personal Information will only be used for online prospection once your consent has been obtained.
You may withdraw your consent at any time simply by changing your profile information on your SKYPASS account or by following the instructions on how to “unsubscribe” contained in all emails sent by Korean Air. When you opt in to one or more of Korean Air’s promotional offers, you provide Korean Air with your consent to be added to our email list that will be used to contact you occasionally with promotional emails.
- Cookies
In a continued effort to improve the services offered on its website and to meet customer expectations, Korean Air may use “cookies.” These are text files used to identify customers’ devices when accessing Korean Air services.
By using the Korean Air website, mobile site or mobile application, customers acknowledge that they have read the information available concerning any operation that may electronically access information already stored in an electronic communication device (or mobile device) or store information in this device (cookie), as well as the means available to block these operations. Visitors acknowledge that their browser settings express consent to the transmission and use of cookies.
For more information on how Korean Air uses cookies, please see our Cookie Management Policy (see Article 7).
- Use of the web analysis tools
-
- Korean Air Cookie Management Policy
- What is a cookie?
A cookie is a small file of letters and numbers that is stored on the user's device (e.g. computer, phone), and used by Korean Air's website to send information to the browser of the user and allowing the browser to return information to the original website (e.g. choice of country, language or a date).
There are different types of cookies;
- Session cookies which disappear as soon as the user leaves the website;
- Permanent cookies which remain on the user's device until they expire or until the user deletes the cookies using the browser settings.
- What cookies are used on Korean Air's website?
Korean Air's website uses four types of cookies.
- Cookies necessary to use Korean Air's website
These cookies are essential as they enable you to fully experience Korean Air's website and to use the basic features and functionalities available on Korean Air's website, such as purchasing a ticket or accessing to your personal account. By disabling the use of such cookies, you will no longer be able to use those features and functionality resulting in a slower and less efficient user experience. The information collected through these cookies is only used for this purpose and is never shared or sold on to third parties.
- Cookies necessary to improve Korean Air's website
These cookies are used to collect anonymous information and enable Korean Air to understand how visitors use Korean Air's website and monitor any errors that users may be experiencing (e.g. the number of visits, the number of pages visited, the activity on the website, error messages received). These cookies are necessary to improve Korean Air's website and provide a better user experience. The information collected through these cookies is only used for this purpose and is never shared or sold on to third parties.
- Personalization cookies
These cookies are used to enable Korean Air's website to remember your choices and preferences and to provide you with a better and personalized user experience. By disabling the use of such cookies, you will not be able to be provided with a content adapted to your previous choices and preferences relating to Korean Air's website features.
- Marketing and advertising cookies
- Measurement cookies
These cookies are used to enable Korean Air to measure the effectiveness of its marketing campaigns. These cookies enable Korean Air to identify the number of sales and clicks resulting from its marketing campaigns. The data collected through these cookies is anonymous and it is used to measure site activity to improve visitor experience.
- Targeting cookies
These cookies are used to enable Korean Air to manage and improve the effectiveness of the delivery of advertising campaigns and to refine the targeting of these campaigns so that Korean Air can display the most relevant content for each user. The data collected through these cookies is anonymous and it is used to display information and offers that specifically interest each user.
- Retargeting cookies used on Korean Air's website
Korean Air uses channels such as Facebook and Google to display banners advertising on other selected websites. These cookies also help Korean Air to monitor and improve the effectiveness of its advertising campaigns and to refine the targeting of these campaigns so that Korean Air can display the most relevant content for each user. The data collected through these cookies is anonymous. The third parties do not collect any customer personal information and it is never shared with other third parties.
- Measurement cookies
- Other third-party's cookies
On certain pages of Korean Air's website, we may provide content relating to services such as services likely to be offered to you by Kayak, Google Flight Search, Skyscanner, etc. The use of cookies by these service providers is governed by these service providers’ terms and conditions which are available on their websites.
- Cookies necessary to use Korean Air's website
- What is a cookie?
- How to manage the use of cookies on Korean Air's website?
You can block cookies by activating the settings on your browser that enable you to refuse the settings of all or some cookies. Please note that certain areas of Korean Air's website can only be accessed by having cookies enabled and you should be aware that disabling cookies may prevent you from accessing some of our content and enjoying the full features and experience of Korean Air's website.
- Manage the use of cookies on Internet Explorer
- In the tools menu, select 'Internet options';
- Click the privacy tab;
- You will see a privacy settings slider which has six settings that allow you to control the number of cookies that will be placed: Block All Cookies, High, Medium High, Medium (default level), Low, and Accept All Cookies.
- Manage the use of cookies on Google Chrome
- In the settings menu, select "advanced settings" at the bottom of the page;
- Select the "content settings" tab in the privacy and security section;
- The top section of the page that then appears tells you about cookies and allows you manage the use of cookies. It also allows you to clear any cookies currently stored.
- Manage the use of cookies on Mozilla Firefox
- In the tools menu, select "Internet options'" (MAC users, go to the Firefox menu & select preferences);
- Select the privacy tab in the options box;
- From the drop down choose, 'use custom settings for history'. This will bring up the options for cookies and you can choose to enable or disable them by clicking the tick-box.
- Manage the use of cookies on Safari
- In the settings menu/Safari menu, select the 'preferences' option;
- Open the privacy tab;
- Select the option you want from the 'block cookies' section
- Manage the use of cookies on Internet Explorer
- Korean Air Cookie Management Policy
-
Korean Air directly collects Personal Information whenever you use the services provided by Korean Air or by other companies or agents acting on behalf of Korean Air, including traveling, using the website, mobile site or mobile application, or interacting with Korean Air via email, service centers, or branch offices in person.
Korean Air also indirectly collects your Personal Information whenever another entity – such as travel agents, reservation system providers (sometimes known as a Global Distribution System or GDS) or another airline company in the context of an interline booking – provides Korean Air with your Personal Information for the performance of services you have requested to such other entity.
-
- What are your rights under data protection law?
Any Personal Information Subject (and, in the case of children under 14, his/her legal representative) is entitled to (subject to specific local law provisions):
- object to a processing on grounds relating to his/her particular situation;
- access, modify, rectify or erase his/her Personal Information, or to restrict (in certain circumstances) the processing of such information, and/or to withdraw their consent at any time;
- request the portability of his/her data to another controller;
- lodge a complaint with a data protection authority (in particular in the EU Member State of his/her habitual residence, his/her place of work or of an alleged infringement of data protection law);
establish instructions in respect of the preservation, the deletion and the transmission of Personal Information after his/her death in accordance with the French data protection legislation (to the extent French data protection law is applicable to you).
Personal Information Subjects can exercise their rights through the internet website koreanair.com, or via paper form or telephone service. Korean Air will take any necessary measures after confirming identification of the requester.
- How to modify or withdraw consent at any time?
- If you are a registered user of Korean Air website, mobile site or mobile application, you may make changes or retraction of consent (cancellation of membership) by clicking ‘My Dashboard’ > ‘My Profile’ > ‘Edit Profile’ or ‘My Dashboard’ > “My Profile” > Withdrawal” after logging in.
- If you are not a registered user of Korean Air website, mobile site or mobile application, you may contact Korean Air service centers or send a letter or visit our branch offices in person. You may find the contact details of service centers or branch offices here. Open in new window
- How to file an inquiry or a complaint concerning your Personal Information?
- For Korean nationals: Who is the person in charge of protecting Personal Information within Korean Air?
Kenneth Chang, Executive Vice President and CMO, Korean Air.
- You may exercise your rights by contacting us through the following means:
- Service Center Open in new window
- ‘Voice of Customer’ Open in new window on Korean Air website
- Korean Air’s Data Protection Officer (DPO):
Email address: privacy@koreanair.com / Postal address: 3 Place de l'Opéra 75002 Paris, France
You may contact following services if you have something to report or if you need a consultation regarding the infringement of Personal Information
- Center for the infringement of Personal Information (http://privacy.kisa.or.kr Open in new window)
- High-tech and Financial Crimes Investigation Division, Supreme Prosecutors’ Office (http://www.spo.go.kr Open in new window)
- Electronic Cybercrime Report & Management system (https://ecrm.cyber.go.kr Open in new window)
When you address inquiries or requests to exercise rights, please send us your personal information for us to identify you. The information you send will only be used as a verification of identity and we may ask you to send us your personal information via email if we cannot identify who you are.
- Full name
- Details of your request
- If you are applying on behalf of another person, signed authority from the individual is required.
- SKYPASS (Korean Air’s frequent flyer program) number, if you are a memberIn case, you cannot remember your SKYPASS number, following information would help us to identify your number:
- Date of birth
- Postal address
- Telephone number
- On-board details (flight number, date, route, etc.)
We would also like to inform you that Korean Air will not be able to erase some personal data due to following reasons in accordance with the article 17 of the EU GDPR
.EU GDPR: EU General Data Protection Regulation
- The processing of your personal data is necessary for compliance with a legal obligation.
- The processing of your personal data is necessary for the establishment, exercise or defense of legal claims.
- For Korean nationals: Who is the person in charge of protecting Personal Information within Korean Air?
- How to keep your Personal Information up-to-date?
Korean Air recommends keeping Personal Information as up-to-date as possible.
- If you are a registered user of Korean Air website, mobile site or mobile application, you may update your Personal Information by clicking ‘My Dashboard’ > ‘My Profile’ > ‘Edit Profile’ after logging in.
- If you are not a registered user of Korean Air website, mobile site or mobile application, you may contact Korean Air service centers or send a letter or visit our branch offices in person to update your Personal Information. You may find the contact details of service centers or branch offices here. Open in new window
- What are your rights under data protection law?
-
To secure the safety of Personal Information from a loss, theft, leak, falsification, or damage, Korean Air employs the following technical, managerial, physical devises according to the Article 30 of the Korean Personal Information Protection Act and Article 32 of the GDPR:
- Password protected mode for personal data
Personal Information is stored and managed in password protected mode.
- Measures against hacking
Korean Air does its best to prevent customers' Personal Information from leakage or damage by hacking or computer virus. Also, using the access suspension system, unauthorized accesses from outside are controlled.
- Minimization of number of employees for managing Personal Information and training for them
Korean Air limits the number of employees working on the Personal Information to the person in charge, and assigns separate passwords for these, which are renewed regularly. Also, through frequent training, Korean Air reinforces the person in charge of protecting Personal Information to comply with this Privacy Policy.
- Operation of an organization exclusively for protecting Personal Information
Through an internal organization exclusively for Personal Information protection, Korean Air makes sure that the protection for Personal Information is implemented and the person in charge of it complies with the required policy. In the event that any issues are found, Korean Air takes care of them right away.
- Children’s Personal Information
Korean Air collects and uses Personal Information for children under 14 after receiving consents from the legal representative (guardian) of the child. The legal representative may retract from the consent he/she gave through the same manner, and request to access the Personal Information or make corrections. Upon the requests for the retraction of consent or correction of data, Korean Air will make necessary measures immediately after the requester’s identification is verified.
- Password protected mode for personal data
Chapter3. Provision and Deletion of Personal Information
-
Korean Air will immediately delete the Personal Information processed when it attains the purpose for the collection and use and in some cases anonymize it, when there is no longer a legal, business or customer need for it to be retained.
For more information, please refer to Data Retention Policy Open in new window
-
Korean Air only provides your Personal Information to processors and other third parties when there is lawful basis (such as consent from the Personal Information Subject).
However, in the event the provision of Personal Information arises in order to provide optimized quality services to the individual Personal Information Subject such as survey, promotions, and events hosted by partners, or sponsors, Korean Air will notify Personal Information Subjects of the purpose of the use, the contents of the information to provide, and retention and use period by the party via email or display this information on the website, and obtain the consent (for example, opt-in and mouse click) from the Personal Information Subject before proceeding.
You may find the complete list of recipients of Personal Information here. Open in new window
-
Korean Air provides personal information to third parties in the course of entrusting some parts of the affairs required for service provision.
Outsourced services details Category Outsourced work Outsourced company SKYPASS Thank-You card production BOTEM Order&Delivery service of KAL Store Cyber Sky Management and development of database server LG CNS, Hanjin Information Communication Inc. Website Outsourcing of data processing resources to provide server and database for web service LG CNS Development and maintenance of website Hanjin Information Communication Inc. Payment process for the Korean Air’s paid products and services such as airline tickets KICC (Korea Information Communication Corporation), KOVAN (Korea Value Added Network), KIS Information Communication, First data Korea, KSNET (KS Net), JTNET(JT Net), BluewalnutCorp.,Wellnet (Konbini), Alipay, Unionpay Authentication, I-PIN confirmation Seoul Credit Assessment Inc Delivery of event prizes or giveaways Hanjin Travel, Tscientific (Mobile coupon provider), Mercedes-Benz Korea SMS and Kakao Talk message transmission of notification Standard Networks Inc. (SMS), LG CNS (SMS, Kakao Talk message) Chat Service - Korean language service – Hanjin Information Systems & Telecommunication Co. Ltd.
- English language service – Concentrix
- Japanese language service – Hanjin International Japan
Chatbot Service MakeBot Live Chat and Email Reply Service related to booking a flight, ticketing, and FAQs on air travel Salesforce Service Center Reservation, ticketing, SKYPASS Customer services - Korean language service – Hanjin Information Systems & Telecommunication Co. Ltd.
- English language service – Concentrix
- Japanese language service – Hanjin International Japan
- European language service – Czech Slovakia Air Service
Payment process for the Korean Air’s paid products and services such as airline tickets KICC (Korea Information Communication Corporation), KOVAN (Korea Value Added Network), KIS Information Communication, First data Korea, KSNET (KS Net), JTNET(JT Net), Unionpay Providing information via SNS for ticket booking, ticketing, etc Salesforce Airport branch office Reservation, ticketing, check-in, boarding, passengers with reduced mobility, SKYPASS, lounge service, passenger security interview (U.S. bound flights) - Incheon/Gimpo – Unies, Air Korea, Manpower Korea
- Pusan – Air Korea, Manpower Korea
- Cheju – K-tec manpower
- Other regional airports in Korea – Air Korea
- Overseas airports –
Outsourced sales office Passenger sales including reservation, ticketing and SKYPASS for some overseas region Booking system Reservation, ticketing service for Korean Air flights Amadeus IT Group S.A Marketing system Outsourcing of marketing messaging duties Adobe, Ibank Customer Behavior Analytics on Korean air's website and app Quantum Metric Advertising Campaign planning/Creative production,
Media planning/execution/management,
Marketing/Advertising Survey,
Ad-hoc promotion planning/production/executionSM C&C, Director's Company Overseas Ground Handling Service Company
Overseas Ground Handling Service Company Details Region Ground Handling Company USA,Canada,Brazil DELTA AIRLINES HALLMARK SWISSPORT GLOBAL AVIATION SERVICES WORLDWIDE FLIGHT SERVICE Europe/Middle East AIR FRANCE KLM COBALT FRAPORT SHREMETYEVO HANDLING China AIR CHINA CHINA AIRLINES CHINA SOUTHERN AIRLINES INTERNATIONAL AIRPORT CO.LTD HONG KONG AIRPORT SERVICES LIMITED Japan Hanjin International Japan Southeast/SouthwestAsia MACROASIA AIRPORT SERVICES CORPORATION AERO DARAT MYANMAR NATIONAL AIRLINES PT GAPUM ANGKAS Singapore Airport Terminal Services Ltd. SCA THAI INTERNATIONAL AIRWAYS VIETNAM INT’L AIRPORT GROUND SERVICE Other Menzies Aviation Overseas Outsourced Sales Office Status
Overseas Outsourced Sales Office Status Details Country Agent Name Nepal Universal Tour Travel Pakistan Khyber INTL Bangladesh ABC-Air India ACUMEN OVERSEAS PVT. LTD. Sri Lanka Alpha Tours Greece Danae Airlines SA Egypt Emeco Travel UAE Abu Dhabi Travel Bureau
AL MOOSA Travel & TourismOman Bahwan Travel Agencies Kuwait Q'GO Travel and Tourism Agencies -
To fulfill the contract and to offer improved convenience to our customers, we outsource the processing of personal information overseas as follows:
Details of overseas outsourced personal information processing Company Personal Information Overseas Country Date and Method of Outsourcing Purpose of using Personal Information Period of Retention and Use AMADEUS IT GROUP, S.A (dataprotection@amadeus.com) - Membership Information: SKYPASS membership number, name, date of birth, gender, telephone number, company name, position, remaining mileage
- Flight Booking Information: SKYPASS membership number, name of passenger, date of birth, gender, phone number, email address
Germany - Membership Information: completion of registration
- Flight Booking Information: completion of reservation, dedicated network
- Membership Information: Retention of frequent flyers information
- Flight Booking Information: Retention of booking records in Korean Air's booking system
- Membership Information : until cancelation of membership or termination of consignment
- Flight Booking Information : five years after transfer (in accordance with the EU's CRS Code of Conduct)
Salesforce.com,Inc
(stevep@salesforce.com,
seyoon.oh@salesforce.comMember ID (No.), name, date of birth, contact info, email Japan As of November 18, 2019. Data is transmitted via dedicated network. Providing information via SNS for ticket booking, ticketing, etc Same as our policy on processing personal information Adobe
(askprivacy@adobe.com,
clientcare@adobe.com)e-mail, name Singapore As of December 16, 2019. Data is transmitted via dedicated network. Send e-mail Same as our policy on processing personal information Dynatrace
(privacy@dynatrace.com,
security@dynatrace.com)IP Address, User ID, Access page and behavior information Australia
(Sydney)Real-time transmission when user access page Customer satisfaction and performance management 35days AWS
(aws-korea-privacy@amazon.com)- Membership Information: SKYPASS membership number, name, date of birth, gender, telephone number, company name, position, remaining mileage
- Flight Booking Information: SKYPASS membership number, name of passenger, date of birth, gender, phone number, email address
The United States - Membership Information: Completion of registration
- Flight Booking Information: Completion of reservation, dedicated network
Disaster Recovery System Launches in the Eastern Region Data Center in case of AWS Seoul region data center shutdown Same as our policy on processing personal information -
- Processing and Transfer of Personal Information
The Personal Information we collect is processed in, or transferred to, the following jurisdictions:
- where our other establishments and business partners are located: Member States of the European Union;
- where our headquarters and IT servers are located: Korea;
- where our call centers are established: Korea, Malaysia, China, Japan;
- where our interline partners and relevant airport operators are established (please refer to your itinerary of travel and the privacy policy of the business partner mentioned therein)
- where our partners participating in SKYPASS and other customer programs (e.g. car hire providers and hotels) are located;
- subject to applicable laws, to the competent customs and immigration authorities of your country of destination
Please refer to the list of recipients in Article 12.
- The Purpose of Personal Data Transfers
The purposes of such personal data transfers are the following:
- the storage and further processing on Korean Air’s servers in Seoul;
- the handling of your queries by our call centers;
- the handling of your travel services requests;
- your acceptance by competent authorities of the country of destination
- Protection Mechanisms for Personal Information Trnasfer
When we transfer your Personal Information, we rely on protection mechanisms in compliance with data protection law in order to protect your Personal Information and achieve an adequate level of protection. In particular:
- Transfers on the basis of an adequacy decision by the European Commission:
including when this decision follows a specific agreement between the European Union and third countries on the processing and transfer of passengers’ data by airline companies to such countries. This is for example the case for the United States of America and Australia;
- Transfers subject to standard data protection clauses:
we have entered into data transfer agreements including the model clauses approved by the European Commission with recipients of your data (whether within Korean Air or with our external business partners) for countries without an adequacy resolution by the European Commission. You have the possibility of receiving or inspecting a copy of such data transfer agreements. As the case may be, please contact the DPO at privacy@koreanair.com or write to 3 Place de l'Opéra 75002 Paris, France.
- Transfers on the basis of an adequacy decision by the European Commission:
- Processing and Transfer of Personal Information
-
The deletion procedure and methods are as follows:
- Deletion procedure
The applicable information gets deleted after it is retained for a certain time period in accordance with the internal policy and for other reason for the protection of information by relevant law (see Article 8).
- Deletion method
Personal Information in paper format shall be purged using paper shredder or by burning them, and personal data stored in electronic format shall be purged using the technical method that makes the records unrecoverable.
- Deletion procedure
Supplementary Provision
-
You may find links to access the websites of other companies on our websites or in the material we provide to you (e.g. e-ticket, promotional email or events. We recommend that you read the privacy policies of these other websites, as the Korean Air’s Privacy Policy does not apply to Personal Information collected by them and Korean Air is not responsible for the use of your Personal Information on the external websites.
-
We may update this Privacy Policy from time to time – in particular in case of change of law, of guidance from competent authorities or of Korean Air’s internal policies. In that case, we will send you the updated Privacy Policy as well as the reason for the change and the scope via website, and, when relevant, via email.
-
Previous Internet Personal Information Handling Policy Previous SKYPASS Personal Information Handling Policy - Personal Information Handling Policy version number: V.3.1
- Personal Information Handling Policy Effective Date: 1 November 2000
- Personal Information Handling Policy Change history
- 29 July 2002: Children's Personal Information Handling Policy Change in Items
- 12 February 2004: Modification to the items of User's rights and their exercises for the requests of retraction of consent, viewing, or correction
- 20 June 2007: Modification to the purpose for the use of Personal Information and Personal Information items to collect (V.2.1)
- 16 February 2010: Modification to the name of 'Personal Information Protection Policy' resulting from the revision of Information Communication Act, Personal Information collecting, collection of Personal Information and its purpose for use, retention of Personal Information and its period for using, the rights of Users and legal representatives and their method of exercising the rights, installation of devises that collect Personal Information, operation and its refusal to use Additional items: Collecting method of Personal Information, Outsourcing the handling of Personal Information collected, Purging procedure for Personal Information (V.3.0)
- 20 August 2012: 'Change in the Personal Information items which are collected, and retention and use period of Personal Information according to the revision of the law regarding the promotion of information and communication network use and protection of information (V.3.1)
- Personal Information Handling Policy Version: V.1.2
- Personal Information Handling Policy Effective Date: 30 September 2011
- Personal Information Handling Policy Change history
- 18 July 2012: Due to addition of affiliated services, the companies providing Personal Information are added
- 18 February 2013: Collecting resident registration numbers due to the revision of the law regarding Information Communication Reflecting the constraints, Change of the companies providing Personal Information due to change of the affiliated
Privacy Policy - Korean Air's Privacy Policy version: V.3.2
- Korean Air's Passenger Service Personal Information Handling Policy implementing date: 1 November 2013
- Personal Information Handling Policy Change history
- 23 January 2014 (V.1.1) : Due to addition of affiliated services, the companies providing Personal Information are added.
- 10 July 2014 (V.1.2) : Due to addition of affiliated services, outsourced companies
- 6 August 2014 (V.1.3) : As collecting resident registration numbers is prohibited, types of Personal Information to be collected are changed.
- 27 February 2015 (V.1.4) : Due to addition of microsite services, and outsourced companies.
- 22 September 2016 (V.1.5) : Renamed from ‘Personal Information Handling Policy’ to ‘Privacy Policy’ and revised to abide by EU General Data Protection Regulation (GDPR) which enters into force on 25 May 2018.
- 25 May 2018 (V.1.6): As EU General Data Protection Regulation(GDPR) enters into force, Privacy Policy has been fully revised.
- 13 July 2018 (V.1.7): Business partners has been added and collected personal information has been changed.
- 15 November 2019 (V.1.8): List of overseas associated companies has been updated.
- 30 November 2020 (V.1.9): List of Recipients of Personal Information has been updated. The structure of Privacy Policy has been fully revised.
- 10 March 2021 (V.2.0): List of Recipients of Personal Information has been updated.
- 23 April 2021 (V.2.1): List of Recipients of Personal Information has been updated.
- 31 May 2021 (V.2.2): List of Recipients of Personal Information and "Type of Personal Information processed by Korean Air" has been updated.
- 10 June 2021 (V.2.3): List of Recipients of Personal Information has been updated.
- 1 July 2021 (V.2.4): List of Recipients of Personal Information has been updated.
- 21 July 2021 (V.2.5): List of Recipients of Personal Information has been updated.
- 3 September 2021 (V.2.6): "Type of Personal Information processed by Korean Air" has been updated.
- 13 September 2021 (V.2.7): List of Recipients of Personal Information has been updated.
- 17 September 2021 (V.2.8): Details of Outsourced Services has been updated. Structure of contents has been updated.
- 28 September 2021 (V.2.9): "Overseas Outsourced Sales Office Status" has been updated.
- 30 September 2021 (V.3.0): " Person in charge of protecting Personal Information within Korean Air" has been updated.
- 15 October 2021 (V.3.1): The words related to applicable laws of Privacy Policy are added.
- 13 January 2022 (V.3.2): List of Recipients of Personal Information has been updated.
This policy includes previous SKYPASS Personal Information handling Policy and Korean Air's Internet Personal Information.