Effective date: August 13, 2026
Personal information controller: Crosshub Co., Ltd.
Service: Travel Pass
When the Company provides personal information to a business located outside Korea, or permits personal information to be accessed, processed by an entrusted overseas provider, or stored outside Korea in the course of providing Travel Pass, Crosshub Co., Ltd. (the "Company") complies with the requirements and procedures prescribed by applicable laws, including the Personal Information Protection Act.
The Company does not arbitrarily transfer personal information outside Korea where it is not necessary to provide a service. Where a cross-border transfer is necessary, the Company processes only the minimum personal information required to achieve the relevant purpose.
This page explains Travel Pass's principles and current status concerning cross-border transfer of personal information.
This webpage does not itself obtain consent to cross-border transfer of personal information.
Where a cross-border transfer requiring separate consent under applicable laws takes place, the Company will separately provide information on the transfer and obtain the user's consent during use of the relevant service.
1. Basic Principles for Cross-Border Transfers of Personal Information
The Company transfers personal information outside Korea only where there is a lawful basis recognized by the Personal Information Protection Act.
A cross-border transfer of personal information may include not only providing information to an overseas third party, but also overseas access to personal information, entrusting processing to an overseas business, or storing personal information outside Korea.
The Company may transfer personal information outside Korea in accordance with applicable laws in the following circumstances.
- The data subject has provided separate consent to the cross-border transfer
- A law, treaty or international agreement to which the Republic of Korea is a party, or another legal instrument contains a special provision concerning the cross-border transfer
- Overseas entrusted processing or storage is necessary to enter into and perform a contract with the data subject, and the information required by applicable laws has been disclosed in the privacy policy or otherwise notified to the data subject
- There is another basis for cross-border transfer recognized by applicable laws, such as a personal-information-protection certification or recognition for the recipient or destination country
- Another provision of the Personal Information Protection Act permits the cross-border transfer
2. Information Provided When a Cross-Border Transfer Occurs
When a cross-border transfer occurs, the Company discloses the following information through the Privacy Policy or this page as required by applicable laws or, where necessary, separately provides it to the user.
- Items of personal information transferred outside Korea
- Country to which personal information is transferred
- Time of transfer
- Method of transfer
- Name and contact information of the recipient
- Purpose of use by the recipient
- Retention and use period
- Legal basis for the cross-border transfer
- Method and procedure for the data subject to refuse the cross-border transfer, where applicable
- Effect on service use of refusing the cross-border transfer
Where personal information is transferred outside Korea based on separate consent, the Company provides the information prescribed by applicable laws in advance and obtains explicit consent.
3. Current Status of Cross-Border Transfers of Personal Information
As it prepares to provide the formal service, Travel Pass is reviewing the use of push notifications, overseas-card payments, overseas payment methods, cloud services, and other external services.
The Company does not arbitrarily list in its cross-border transfer status any business for which the actual cross-border transfer, recipient, destination country, personal information transferred, or legal basis has not been finalized.
When an actual cross-border transfer of personal information begins, the Company will reflect the actual processing status in the Privacy Policy and this page before the processing begins.
Key Services for Which Cross-Border Transfer Is Being Reviewed
- Services and push notifications
- Payments with overseas-issued credit and debit cards
- Overseas payment methods
- Cloud and SaaS services provided by overseas businesses
- Other services connected with overseas businesses
When an actual cross-border transfer takes place, the Company will disclose detailed status information in the following form.
| Category | Details |
|---|---|
| Recipient | Corporate name and contact information of the business that actually receives the personal information |
| Destination country | Country in which personal information is actually transferred, accessed, processed, or stored |
| Purpose of transfer | Purpose of providing the relevant service or performing the work |
| Items transferred | Personal information actually transferred outside Korea |
| Time of transfer | Point in time at which personal information is transferred |
| Method of transfer | Actual transfer method, such as encrypted network transmission |
| Retention and use period | Actual retention and use period of the recipient |
| Basis for cross-border transfer | Applicable cross-border transfer basis under the Personal Information Protection Act |
| How to refuse transfer | Method and procedure available to the user to refuse the cross-border transfer |
| Effect of refusal | Service restricted if the cross-border transfer is refused |
4. Push Notification Services
Travel Pass may use an external push notification service to provide users with service-related notices and push messages.
If a push token, app-instance identifier, or information necessary to deliver a notification is processed, accessed, or stored outside Korea, the Company reviews the relevant data-processing structure to determine whether it constitutes a cross-border transfer of personal information.
If an actual cross-border transfer occurs, the Company will add the following information to this page.
- Exact corporate name and contact information of the push-service provider
- Country in which personal information is processed
- Personal information transferred
- Purpose of transfer
- Time and method of transfer
- Retention and use period
- Applicable legal basis for cross-border transfer
- How to refuse the cross-border transfer and the consequences of refusal
Notifications essential to service provision and push notifications for advertising or marketing purposes are processed separately.
Push notifications for advertising or marketing purposes are provided in accordance with separate consent standards for receiving marketing information.
5. Cross-Border Transfers Related to Overseas Payments
Travel Pass may offer top-up functions using overseas-issued credit or debit cards or overseas payment methods.
Depending on the actual payment method and payment network used, personal information or transaction information may be processed by the following institutions during an overseas payment.
- Domestic and overseas PGs
- Overseas card issuers
- International card brands
- Overseas payment service providers
- Other institutions that actually process the payment
Based on the actual contractual relationship and data flow, the Company determines whether the relevant business is an entrusted processor of the Company's personal information, a third-party recipient of personal information, or an independent personal information controller.
If overseas entrusted processing or storage of personal information is necessary to enter into and perform a contract with the data subject, the Company may rely on a cross-border transfer basis permitted by applicable laws, such as disclosure or notice.
If, however, the arrangement involves third-party provision of personal information to an overseas business, the Company separately reviews the lawful basis applicable to that provision and obtains separate cross-border transfer consent from the user where required by applicable laws.
Once an actual overseas payment service is finalized and a cross-border transfer of personal information occurs, the Company will add the following to this page.
- Business that actually receives the personal information
- Country to which personal information is transferred
- Personal information transferred
- Purpose of the overseas payment and cross-border transfer
- Time and method of transfer
- Retention and use period
- Legal basis for cross-border transfer
- How to refuse the cross-border transfer and the consequences of refusal
The Company does not provide personal information to an overseas payment service provider that is not actually used by Travel Pass.
6. Google and Apple Streamlined Registration and Sign-In
Travel Pass may offer streamlined registration and sign-in using a Google or Apple account.
If the user directly provides authentication information to Google or Apple on that provider's authentication screen, and the provider supplies authentication results and information permitted by the user to Travel Pass at the user's request, the Company distinguishes the area in which the overseas business directly collects and processes personal information from the user and the area in which the Company transfers personal information outside Korea.
If the Company uses a function that separately provides, entrusts processing of, or stores Travel Pass member information held by the Company in Google or Apple's overseas systems, the Company reviews the data flow to determine whether a cross-border transfer occurs and reflects the required information on this page.
7. Overseas Cloud and SaaS Services
The Company may use cloud or SaaS services offered by overseas businesses in the course of operating the service.
The Company does not conclude that use of a service offered by an overseas business alone constitutes a cross-border transfer of personal information. Instead, based on the actual service settings and contract, it reviews the following.
- Actual location where personal information is stored
- Region in which personal information is stored
- Whether personal information can be accessed outside Korea
- Whether overseas customer support or operations personnel can access personal information
- Location where backup data is stored
- Sub-processors and regions in which sub-processing occurs
- Whether overseas access occurs during incident response or customer support
Even if personal information is stored in a Korea region, the Company separately reviews whether the arrangement constitutes a cross-border transfer if the information can be accessed or viewed outside Korea.
If an actual cross-border transfer is confirmed, the Company will add cross-border transfer information for that service to this page.
8. Consent to and Refusal of Cross-Border Transfers
Where the Company transfers personal information outside Korea based on the user's separate consent, the user has the right to refuse consent to that cross-border transfer.
If the user refuses the cross-border transfer, use of a particular service for which that cross-border transfer is essential may be restricted.
For example, if a cross-border transfer is necessary to use a particular overseas payment method, the user cannot use that payment method if the user does not consent to the cross-border transfer.
If another payment method or a Travel Pass service that does not require a cross-border transfer is available, the user may continue to use that service.
Where separate cross-border transfer consent is required, the Company will separately provide the user with the following information during use of the relevant service and obtain explicit consent.
- Personal information transferred
- Destination country
- Time and method of transfer
- Name and contact information of the recipient
- Purpose of transfer
- Retention and use period
- Method and procedure for refusing consent
- Consequences of refusing consent
This webpage does not itself obtain consent to cross-border transfer of personal information.
9. Onward Transfers Outside Korea
If a recipient of personal information outside Korea onward-transfers that information to another country or another overseas business, the provisions relating to cross-border transfer of personal information under applicable laws may also apply.
The Company reviews the actual onward-transfer structure and applies necessary personal information protection measures in accordance with applicable laws and contracts.
Where necessary, the Company provides information through the Privacy Policy or this page, including the following.
- Personal information onward-transferred
- Country to which the information is onward-transferred
- Business receiving the onward transfer
- Purpose of onward transfer
- Retention and use period
- Other matters necessary to protect the data subject's rights
10. Safeguards for Cross-Border Transfers of Personal Information
When transferring personal information outside Korea, the Company applies measures required under applicable laws to protect personal information and the rights of data subjects.
Key safeguards include the following.
- Securing the safety of personal information during transmission
- Managing access privileges to personal information
- Restricting processing of personal information beyond the intended purpose
- Managing retention periods and destruction of personal information
- Managing entrusted processing, sub-processing, and onward transfers
- Preventing and responding to personal information breaches
- Supporting data-subject rights
- Supporting enquiries and grievance handling concerning personal information
- Incorporating personal information protection obligations through contracts
- Other safeguards required under applicable laws
11. Changes to the Cross-Border Transfer Status
If the Company uses a new overseas service or business, or if any of the following elements of an existing cross-border transfer changes, the Company will update this page to reflect the actual status of personal information processing.
- Recipient of personal information
- Country to which personal information is transferred
- Purpose of cross-border transfer
- Personal information transferred
- Time or method of transfer
- Retention and use period
- Legal basis for cross-border transfer
- How to refuse the cross-border transfer and the consequences of refusal
If a principal matter concerning a cross-border transfer based on separate consent changes and new consent is required, the Company will notify the user of the changed information and obtain the required consent again in accordance with applicable laws.
The Company will reflect relevant information in the Privacy Policy and this page before an actual cross-border transfer of personal information begins.
12. Privacy Enquiries
Personal information controller: Crosshub Co., Ltd.
Chief Privacy Officer: Jaeseol Kim, Representative Director
Travel Pass Customer Support: +82-2-780-9930
Email: contact@travelpass.cards
Cross-Border Transfer of Personal Information Notice and Status Change History
| Version | Effective date | Main changes |
|---|---|---|
| v1.0 | August 13, 2026 | Initial establishment of the Travel Pass Notice and Status of Cross-Border Transfer of Personal Information |
Notice and Status of Cross-Border Transfer of Personal Information version: v1.0