Effective date: August 13, 2026
Personal information controller: Crosshub Co., Ltd.
Service: Travel Pass
Crosshub Co., Ltd. (the "Company") lawfully processes personal information necessary for Travel Pass account registration and service provision. Where separate consent is required for personal information under applicable laws, including the Personal Information Protection Act, the Company obtains separate consent during use of the relevant service.
This page explains the personal information processed by Travel Pass and the processing and consent matters involved in the eKYC process.
This webpage does not itself obtain consent to personal information processing.
Where actual consent is required, the Company provides a separate consent procedure during account registration, eKYC, or use of the relevant service in the Travel Pass app.
1. Personal Information Processing for Account Registration
The Company processes personal information necessary for Travel Pass account registration and member services.
Personal information objectively necessary for account registration and member management is processed to the extent necessary for entering into and performing the service agreement pursuant to Article 15(1)4 of the Personal Information Protection Act, and separate consent to collect and use that information is not obtained.
Purpose of Processing
| Category | Details |
|---|---|
| Account registration | Confirm intent to register and create a member account |
| Member identification | Identify service users and prevent duplicate registration |
| Authentication | Email verification, sign-in, and account management |
| Member management | Maintain and manage membership status and process account withdrawal |
| Security | Prevent fraudulent registration, account theft, and unauthorized use |
Personal Information Processed
| Category | Information processed |
|---|---|
| Standard account registration | Name, date of birth, email address, one-way hashed password value, and internal service member identifier |
| Google sign-up/sign-in | Google user identifier, email address, and name |
| Apple sign-up/sign-in | Apple user identifier, email address, and name where provided by Apple |
The Company generally does not persistently store Google or Apple access tokens and refresh tokens on its servers.
Legal Basis for Processing
The information is processed as personal information necessary for entering into and performing the service agreement pursuant to Article 15(1)4 of the Personal Information Protection Act.
Retention and Use Period
Basic member information is processed until account withdrawal.
Google and Apple account-linkage information is processed until account withdrawal or unlinking of the relevant social account.
However, where personal information must be retained for a specified period under applicable laws, it is retained separately for that statutory period and then destroyed.
If Personal Information Cannot Be Provided
The above personal information is necessary to create a Travel Pass member account and provide member services.
If the information is not provided, it may be difficult to register for Travel Pass or use related member services.
2. Personal Information Processing for eKYC
The Company may operate an electronic know-your-customer (eKYC) process to provide services that require identity verification, including registered prepaid cards.
During eKYC, personal information may be processed to verify the user's identity document or electronic passport and to confirm that the actual user is the person shown on the identity document.
This section explains the processing of general personal information during eKYC.
Unique identifying information such as passport numbers and alien registration numbers, and biometric information technically generated to authenticate or identify a specific individual, are processed through the separate consent procedures set out below.
Purpose of Processing
| Category | Details |
|---|---|
| Identity verification | Verify the user's actual identity |
| Identity-document verification | Verify the authenticity and validity of identity documents, including passports and residence cards |
| Same-person verification | Confirm that the person on the identity document and the actual user are the same person |
| Card services | Identity verification for use of registered prepaid cards |
| Authentication management | Manage eKYC authentication status, assurance level, and verification results |
| Prevention of unauthorized use | Prevent forgery or alteration of identity documents, identity theft, duplicate authentication, and fraudulent authentication |
Personal Information That May Be Processed When a Passport Is Used
- Original passport image
- Name
- Date of birth
- Gender
- Nationality
- Passport expiration date
- Passport issuing country
- Document type
- Information needed for identity verification that is shown in the MRZ
- Facial image in the passport
- eKYC transaction identifier
- Passport or electronic-passport verification result
Passport numbers are processed under separate consent to process unique identifying information.
If an original passport image or MRZ contains a passport number, processing of that unique identifying information is also subject to separate consent to process unique identifying information.
Personal Information That May Be Processed When a Korean Residence Card or Similar Document Is Used
- Name
- Date of birth
- Gender
- Nationality
- Domestic residence-report number
- Sojourn status
- Period of stay
- Identification photograph
- Date of issue
- Identity-document verification result
If an alien registration number is processed, it is processed under separate consent to process unique identifying information.
Personal Information That May Be Processed During Face Authentication and Liveness Checks
- Facial image captured by the user
- Facial video or consecutive frames
- Facial image included in a passport or identity document
- Face-match result
- Liveness verification result
- Face Match verification result
- Final eKYC verification result
- Verification date and time
- Authentication assurance level
- Verification validity period
Facial-feature information technically generated from facial images to authenticate or identify a specific individual is processed under separate consent to process sensitive information.
Processing and Storage Principles
The Company generally does not retain the following original information for a long period in its own general service database.
| Information | Company's storage principle |
|---|---|
| Original passport or identity-document image | Not retained long term |
| Original facial image in a passport or identity document | Not retained long term |
| Facial image captured by the user | Not retained long term |
| Facial video or consecutive frames | Not retained long term |
| Facial-feature information | Generally not stored |
Where the information above is temporarily processed during identity verification, the Company generally destroys it without delay once the purpose of processing is achieved.
Where necessary to provide the service, the Company may retain the minimum verification results, including whether eKYC succeeded or failed, liveness result, Face Match result, verification date and time, authentication assurance level, verification validity period, and authentication-document type.
Retention and Use Period
eKYC verification results may be processed until the member relationship or the service relationship for a registered card requiring identity verification ends.
However, where a separate statutory retention obligation applies, the information is retained for that period.
Details regarding processing and destruction of original identity-document and facial information are available in the Travel Pass Privacy Policy.
If eKYC Information Cannot Be Processed
If personal information necessary for eKYC cannot be processed, the user cannot use certain Travel Pass services that require identity verification, including registered prepaid cards.
3. Consent Notice for Processing Unique Identifying Information
In the course of Travel Pass eKYC and providing services that require identity verification, the Company may process the following unique identifying information.
Where processing of unique identifying information is required, the Company obtains separate consent in the Travel Pass app's eKYC process, distinct from other personal information processing.
Purpose of Processing
- Verify the user's identity
- Verify the authenticity and validity of a passport or identity document
- Confirm whether the person is the same individual
- Prevent duplicate or fraudulent authentication
- Prevent identity theft
- Verify identity for use of registered prepaid cards
Unique Identifying Information Processed
- Passport number
- Alien registration number
Although a domestic residence-report number is not included in the unique identifying information specified by the Enforcement Decree of the Personal Information Protection Act, the Company classifies it as important personal information and applies enhanced safeguards.
Processing and Storage Principles
The Company processes unique identifying information only to the minimum extent necessary to provide the service.
If a passport number or alien registration number must be stored, the Company encrypts it securely using safeguards required by applicable laws.
The Company generally does not retain the full plain-text value of unique identifying information for an extended period where it is not necessary to provide the service.
Retention and Use Period
Passport numbers and alien registration numbers are processed for the period necessary to perform eKYC identity verification and provide the relevant service and are generally destroyed without delay once the purpose of processing is achieved.
However, the Company may retain them for the period required or permitted by applicable laws.
If additional retention or provision of unique identifying information is necessary for actual service provision by a partner card issuer or financial institution, the Company will review applicable laws and contractual arrangements and separately provide the required information before that processing occurs.
Relationship with Third-Party Provision
This consent to process unique identifying information is consent for Crosshub Co., Ltd. to process unique identifying information in the Travel Pass service.
It does not include consent to provide a passport number or alien registration number to a card issuer, bank, financial institution, or other third party.
If separate consent is required to provide unique identifying information to a third party, the Company will separately provide information on the recipient, purpose, items provided, retention and use period, and consequences of refusing consent, and obtain the required consent before the actual provision occurs.
Right to Refuse Consent and Consequences
Users have the right to refuse consent to the processing of unique identifying information.
However, if the user does not complete eKYC that requires processing of unique identifying information, the user cannot use certain Travel Pass services that require identity verification, including issuance or registration of a registered prepaid card.
How Actual Consent Is Obtained
Where this consent is required, the Travel Pass app will separately explain the processing of unique identifying information during eKYC and process that information only after obtaining the user's explicit consent.
4. Consent Notice for Processing Sensitive Information
The Company may use biometric technology during Travel Pass eKYC to confirm that the person on an identity document is the actual user and to prevent fraudulent authentication using photographs or videos.
When processing biometric information that is technically generated to authenticate or identify a specific individual, the Company obtains separate consent in the Travel Pass app's eKYC process, distinct from other personal information processing.
Purpose of Processing
- Confirm that the person on a passport or identity document and the actual user are the same person
- Prevent facial forgery or alteration and fraudulent authentication using photographs or videos
- Verify that the subject is a live person through liveness detection
- Verify identity through Face Match
- Perform electronic identity verification for use of registered prepaid cards
Sensitive Information Processed
The Company may process the following biometric information generated through specified technical means for the purpose of authenticating or identifying a specific individual.
- Facial-feature information
- Facial landmarks
- Biometric facial-feature information technically generated for facial authentication, such as a face feature vector or embedding
Information processed together during eKYC, including original facial images or videos captured by the user, facial images in passports or identity documents, and final liveness and Face Match results, is described in the Personal Information Processing for eKYC notice in Section 2.
Processing and Storage Principles
During eKYC, necessary biometric facial-feature information may be technically generated from the user's facial image and compared with facial information on the identity document.
The Company generally does not retain biometric information, such as facial-feature information, feature vectors, or embeddings, for a long period in its own general service database.
Where necessary, the Company may retain only the following minimum verification results.
| Verification result | Whether stored |
|---|---|
| Liveness success or failure | Stored where necessary |
| Face Match success or failure | Stored where necessary |
| Final eKYC verification result | Stored where necessary |
| Verification date and time | Stored where necessary |
| Authentication assurance level | Stored where necessary |
| Verification validity period | Stored where necessary |
| Facial-feature values or embeddings | Generally not stored |
Retention and Use Period
Sensitive information, including facial-feature information, is processed for the period necessary to perform the eKYC identity-verification procedure and is generally destroyed without delay once the identity-verification purpose is achieved.
Minimum result information necessary for service operations, such as whether eKYC verification was completed, the verification date and time, and authentication assurance level, may be processed separately for the period specified in the Travel Pass Privacy Policy.
Right to Refuse Consent and Consequences
Users have the right to refuse consent to the processing of sensitive information.
However, if the user does not consent to eKYC requiring processing of biometric information, such as facial authentication and liveness detection, the user cannot complete identity verification and cannot use certain Travel Pass services that require identity verification, including issuance or registration of a registered prepaid card.
How Actual Consent Is Obtained
Where this consent is required, the Travel Pass app will separately explain the processing of sensitive information during eKYC and process that information only after obtaining the user's explicit consent.
5. Additional Information on Personal Information Processing
For details concerning purposes of personal information processing, retention periods, destruction, processing by entrusted parties, third-party provision, cross-border transfers, data-subject rights, and safeguards, please refer to the Travel Pass Privacy Policy.
If the actual services and contractual relationships with partner card issuers, financial institutions, eKYC providers, PGs, or other partners are finalized and the method of personal information processing changes, the Company will update the relevant notices and Privacy Policy before the changed processing begins.
Where separate consent is required under applicable laws, the Company will separately provide the user with the necessary information and obtain consent during use of the relevant service.
6. Privacy Enquiries
Personal information controller: Crosshub Co., Ltd.
Chief Privacy Officer: Jaeseol Kim, Representative Director
Travel Pass Customer Support: +82-2-780-9930
Email: contact@travelpass.cards
Personal Information Processing and eKYC Consent Notice version: v1.0