Effective date: August 13, 2026
Personal information controller: Crosshub Co., Ltd.
Service: Travel Pass
Crosshub Co., Ltd. (the "Company") processes users' personal information only within the scope of the purpose of collection and processing and does not provide it to a third party without the user's consent or another lawful basis recognized under applicable laws.
The Company may provide personal information to third parties where necessary to provide a service requested by the user, such as issuance of a registered prepaid card, linkage with financial services, or streamlined registration and sign-in for an external partner service.
This page explains the principles and current status of Travel Pass third-party provision of personal information.
This webpage does not itself obtain consent to third-party provision of personal information.
Where separate consent is required under applicable laws, the Company will separately provide the relevant information and obtain the user's consent during use of the relevant service, such as in the Travel Pass app, before personal information is actually provided.
1. Basic Principles for Third-Party Provision of Personal Information
The Company provides personal information to a third party only where there is a lawful basis, including the following.
- The user has consented to third-party provision of personal information
- Applicable laws require or permit provision of personal information
- Another applicable law, including the Personal Information Protection Act, permits third-party provision of personal information
Where separate consent from the user is required for third-party provision, the Company provides the following information before the actual provision.
- Recipient of the personal information
- Purpose of use by the recipient
- Items of personal information provided
- Recipient's retention and use period
- Right to refuse consent to provision
- Any disadvantage resulting from refusal of consent
The Company provides only the minimum personal information necessary to provide the relevant service.
2. Distinguishing Third-Party Provision from Entrusted Processing
Not every instance in which the Company entrusts a personal-information-related task to another business constitutes third-party provision of personal information.
Where the Company entrusts personal information processing under its management and supervision for the performance of the Company's work, it may be managed as entrusted processing of personal information under applicable laws.
In contrast, where an external business receives and processes personal information for its own service provision, performance of a contract, or inherent business purpose, the Company determines whether the arrangement constitutes third-party provision of personal information by reviewing the actual contractual relationship and purpose of processing.
The Company distinguishes and manages entrusted processing and third-party provision after reviewing the actual contractual relationship and personal information processing structure with card issuers, financial institutions, PGs, eKYC providers, and other partners.
Information concerning entrusted processing is available in the Travel Pass Privacy Policy.
3. Current Status of Third-Party Provision of Personal Information
Travel Pass is currently in the process of finalizing partnerships, contracts, and the scope of personal information linkage with card issuers, financial institutions, and external partner services.
There is currently no ongoing third-party provision of personal information to disclose on this page.
The Company does not arbitrarily list an entity whose contract or service structure has not been finalized as a recipient of personal information, and does not provide users' personal information before the procedures necessary for actual service provision have been finalized.
If third-party provision of personal information begins in the future, the Company will specifically disclose the following information on this page before the provision begins.
| Category | Information disclosed |
|---|---|
| Recipient | Exact corporate name of the business that actually receives the personal information |
| Purpose of provision | Actual purpose of use, such as card issuance, financial services, or streamlined registration and sign-in |
| Items provided | Personal information actually provided |
| Retention and use period | Actual retention and use period applied by the recipient |
| Basis for provision | User consent or a basis under applicable laws |
| Refusal of consent and consequences | Whether consent may be refused and services restricted if it is refused |
If third-party provision ends or the provision relationship changes, the Company will update this page to reflect the actual status of personal information processing.
4. Registered Prepaid Cards and Linkage with Financial Services
Travel Pass may provide personal information to a partner card issuer or financial institution in the future to provide issuance of registered prepaid cards and services linked with financial institutions.
The personal information actually provided will be limited to the minimum necessary to provide the relevant card or financial service.
The general scope of information that may be provided is as follows.
- Internal service member identifier
- Name
- Date of birth
- Nationality
- KYC completion status
- KYC authentication assurance level
- KYC verification date and time
- Authentication-document type
- Authentication-document issuing country
- Other minimum identity-verification results necessary to provide the service
Once the actual partner card issuer or financial institution is finalized, the Company will determine the following and reflect them on this page and any required consent screen before personal information is provided.
- Exact corporate name of the recipient
- Purpose of provision
- Personal information actually provided
- Retention and use period
- Legal basis for provision
- Consequences of refusing consent
5. Streamlined Registration and Sign-In for External Partner Services
At a user's request, Travel Pass may provide a function that lets the user register for or sign in to an external partner service using the Travel Pass account.
The Company provides personal information to that partner service only when the user requests connection to the actual partner service and completes the consent procedure required under applicable laws.
Information that may be provided in a general streamlined registration or sign-in process includes the following.
- Partner-specific user identifier
- Name
- Date of birth
- Email address
- KYC completion status
- KYC authentication assurance level
- KYC authentication date and time
- Authentication-document type
The personal information actually provided is determined to the minimum extent after reviewing the information requested by the relevant partner service and the necessity of providing the service.
6. Information Not Provided by Default During Streamlined Registration and Sign-In
The Company does not provide the following information by default during ordinary streamlined registration or sign-in for external partner services.
- Passport number
- Alien registration number
- Domestic residence-report number
- Original passport or identity-document image
- Facial image or video
- Biometric information such as facial-feature information
- Original liveness information
- Complete MRZ information
- Full card number
- CVC/CVV
- Detailed merchant transaction history for card use
If a partner service necessarily requires some of the information above, the Company separately verifies the necessity of the provision and the lawful basis for processing.
Where separate consent is required under applicable laws, the Company will notify the user of the relevant information and obtain the required consent before the actual provision.
7. Consent to Provide Personal Information for Each Partner Service
If user consent is required to provide personal information to an external partner service, the Company will specifically provide the following information when the user first connects the service or when provision of personal information is required.
Recipient of Personal Information
The Company provides the exact corporate name of the business operating the actual partner service.
Purpose of Provision
The purpose may include the following.
- Account registration using a Travel Pass account
- Sign-in using a Travel Pass account
- Identification of a partner-service user
- Confirmation that identity verification has been completed
- Provision of the partner service requested by the user
Items Provided
The Company specifically provides the personal information actually necessary to provide the relevant partner service.
Retention and Use Period
The Company provides the actual applicable retention and use period, such as until the relevant partner-service agreement ends or the user withdraws from that service.
If personal information must be retained for a specified period under applicable laws, the Company also provides the retention period required by those laws.
Right to Refuse Consent
Users have the right to refuse consent to third-party provision of personal information.
Refusing consent does not affect use of the basic Travel Pass service.
However, the user may not be able to use streamlined registration, sign-in, or another linked feature of the partner service that requires the provision of that personal information.
The Company does not arbitrarily provide additional personal information beyond the scope to which the user consented.
8. Provision of Additional Personal Information
If a partner service requests additional personal information beyond the information generally provided for streamlined registration or sign-in, such as nationality, passport issuing country, or passport expiration date, the Company does not automatically provide that information based on existing consent.
Where additional personal information must be provided, the Company verifies the following.
- Recipient of the additional information
- Purpose for which the additional information is necessary
- Additional personal information provided
- Retention and use period
- Lawful basis for the provision
- Consequences of refusing consent
Where new consent is required under applicable laws, the Company will provide the user with the relevant information and obtain the required consent before the actual provision.
9. Third-Party Provision of Unique Identifying Information
Unique identifying information, including passport numbers and alien registration numbers, is not provided during ordinary streamlined registration or sign-in for partner services.
However, if a card issuer, financial institution, or another entity necessarily requires unique identifying information under applicable laws or to provide an actual financial or card service, the Company reviews the necessity and legal basis for the provision.
If separate consent is required for third-party provision of unique identifying information, the Company provides the following information and obtains separate consent, distinct from consent to third-party provision of general personal information.
- Recipient of the unique identifying information
- Purpose of provision
- Unique identifying information provided
- Retention and use period
- Right to refuse consent
- Consequences of refusing consent
The Company provides only the minimum unique identifying information necessary to provide the relevant service.
Although a domestic residence-report number is not included in the unique identifying information specified by the Enforcement Decree of the Personal Information Protection Act, the Company classifies it as important personal information and applies enhanced safeguards.
10. Changes to and Withdrawal of Consent to Third-Party Provision
If a principal matter to which the user consented changes, such as the recipient, purpose of provision, items provided, or retention and use period, the Company will provide the user with the changed information and obtain new consent where necessary in accordance with applicable laws.
Where a user may withdraw consent to third-party provision of personal information, the Company provides a method to withdraw consent through the Travel Pass app, Customer Support, or another channel.
Personal information lawfully provided before withdrawal of consent may not be deleted immediately if the recipient has a statutory retention obligation or another lawful basis to retain it.
Where this applies, the Company will provide the user with information during the actual consent or consent-withdrawal process.
11. Third-Party Provision and Partners' Independent Services
After a user registers for or signs in to an external partner service through Travel Pass, the partner business's privacy policy and terms of use may apply where that partner independently processes personal information to provide its own service.
The Company clearly manages the scope and purpose of personal information provided by Travel Pass. If a partner business directly collects additional personal information for its own purposes, that partner business may bear responsibility for the processing of that personal information under applicable laws.
12. Management of the Third-Party Provision Status
The Company keeps this page current to reflect the actual status of personal information processing when a new partner service is added or an existing personal-information provision relationship changes or ends.
The Company reflects the relevant information on this page before actual provision of personal information occurs when any of the following changes take place.
- A new recipient of personal information is added
- The purpose of provision changes
- The items of personal information provided change
- The retention and use period changes
- An existing third-party provision relationship ends
For a change that requires separate consent under applicable laws, changing this page alone does not replace a user's existing consent; the Company carries out any required separate consent procedure.
13. Privacy Enquiries
Personal information controller: Crosshub Co., Ltd.
Chief Privacy Officer: Jaeseol Kim, Representative Director
Travel Pass Customer Support: +82-2-780-9930
Email: contact@travelpass.cards
Third-Party Provision of Personal Information Notice and Status Change History
| Version | Effective date | Main changes |
|---|---|---|
| v1.0 | August 13, 2026 | Initial establishment of the Travel Pass Notice and Status of Third-Party Provision of Personal Information |
Notice and Status of Third-Party Provision of Personal Information version: v1.0