SBTM Privacy Policy
- General Privacy Collection
- Name, Phone, E-mail etc
- Collecting unique identification information
- Passport Number
- Purpose of Personal Information Processing
- Member management, Business trip reservation etc
- Personal information retention period
- Sign in, Information of reservation :
Delete when withdrawing from membership
- Delete personal information
- Collection and use of personal information
Delete when achieving the purpose
- Entrustment of personal information provision
-
[Providing personal information]
Jin Air, The Shilla,
Samsung Capital etc -
[Entrustment of personal information]
Hotel Shilla, AH Global,
KG inicis etc
- Transfer of personal information abroad
- Samsung Hospitality America Inc, Samsung Hospitality U.K inc etc
- Complaint Handling Department
-
[Manager of Personal Information Protection ]
- -affiliation: SBTM
- -hp: 02-6048-8669
- e-mail: sbtm.security@.samsung.com
SBTM's SRS service provides you with a booking experience where you can instantly reserve flights, hotels and rental cars that you are sure to need on your business travel to ensure greater convenience and time-saving. With respect to the delivery of the service, we work to protect your personal data we collect with your consent and ensure that proper measures are taken to protect your rights. We also have a privacy policy in place to ensure that you have full knowledge of where and how your personal data is used and what measures we take to keep it confidential. SRS service is available in Korea, America, Europe, Southeast Asia, Middle East, China and other regions and fully complies with all local privacy-related laws. Our privacy policy is subject to change for improvements. Any changes to it will be notified to you in an easy-to-understand manner. Our privacy policy includes the following provisions.
- Scope
- Scope of Collection and Use
- Retention and Destruction of Personal Data
- Disclosure and Sharing of Personal Data
- Use of Contractors and Cross-border Transfer of Personal Data
- Your Rights and How to Exercise Them
- Provisions on Children
- Automatic Processing of Personal Data
- Technical and Organizational Measures to Protect Personal Data
- frontPrivacy7.section1.msg10
- Feedback and Complaints
- Matters concerning the collection and use of behavioral information
- Notice of Privacy Policy
- Obligation to notify our privacy policy
2. Scope of Collection and Use
① We will collect your personal data to provide you with a comprehensive travel booking service including air, hotel and vehicle rental to the extent that you provide consent for such collection and use. None of your personal data you provide will be used for any other purpose than what is defined below. Any changes to the scope of use will be notified to you in advance for your consent.
| Category | Use | Scope of collection | Available in: |
|---|---|---|---|
| Becoming a member (required) |
Identification to classify a user | ID, password, company, branch (Branch Office), 부서(소속), position, Name(Korean, English), date of birth, nationality, email, 휴대폰 |
Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| Booking support (viewing reservations, changes, confirmation, ticket printing, cancellations) | Access log IP, access log ID, date of access, date and time of sign out | Korea, America, Europe, Southeast Asia, Southwest Asia, China | |
| Notification of booking, changes or cancellations | Number (mobile phone) | ||
| Korea | Korea, America, Europe, Southeast Asia, Southwest Asia, China | ||
| Sing in(선택 동의) | SBTM((주)호텔신라 자회사) 상품 및 사은/판촉 행사 안내 신라면세점((주)호텔신라 운영) 상품 및 사은/판촉 행사 안내 | Name, Phone number, e-mail | Korea |
| Identification, Service, Handling of complaints | employee number, gender, phone | Korea, America, Europe, Southeast Asia, Westesat Asia, China | |
| Travel booking (required) |
Flight reservations, ticket printing, changes or cancellations | Information collected when you sign up for the service, credit card number, expiry date, passport number, passport expiry date | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| Hotel reservations, changes or cancellations | Information collected when you sign up for the service, credit card number, expiry date | Korea, America, Europe, Southeast Asia, Southwest Asia, China | |
| Vehicle rental reservations, changes or cancellations | Information collected when you sign up for the service | Korea, America, Europe, Southeast Asia, Southwest Asia, China | |
| PICKUP & SENDING Reservations, changes or cancellations | Information collected when you “sign up for the service” | Southeast Asia | |
| Travel booking (optional) |
Accompanied flight reservation | Comp Name, Name, English Name, E-mail, Gender, Birthday | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| Mileage earning | Flight, hotel or vehicle rental mileage | Korea, America, Europe, Southeast Asia, Southwest Asia, China | |
| Room preferences | Smoking or non-smoking, bed size, preference to a room located higher up in the building | Korea, America, Europe, Southeast Asia, Southwest Asia, China | |
| TSA Information | Known Traveler Number, Global Entry Number |
Korea, America, Europe, Southeast Asia, Southwest Asia, China | |
| Visa Information | Country, Type of Visa, Expiration date of Visa, Remainder of period | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
② We collect your personal information when:
- You become a member through the SRS website, email, fax, phone or a written form or make a travel reservation
- You have a conversation with our customer support or leave a comment after traveling
- You allow cookies to be used during viewing or confirmation of your reservations as part of the SRS service
③ We do not collect any information on your gender, ethnic group, ideas or beliefs, religion, current or past membership in labor union or political party, political view, health, sex life or any other sensitive data that might materially infringe your privacy.
④ When we collect your personal data with your consent, we ensure that the following is clearly informed to you.
- Who is responsible for protecting your personal data and how to reach him/her
- Purpose of using and collecting your personal data and the legal basis
- Scope and type of personal data
- Who receives your personal data including third parties
- How long your personal data will be retained and how the period of retention is determined
- Your rights
- The fact that you have the right to refuse or withdraw consent
- Your right to file a complaint
- Detailed process of transferring your personal data across the border and how it will be protected
- The existence of automated decision-making including profiling, how such decision is made, how important it is, and what consequences it will entail
- Whether provision of your personal data is required by a law or any contract, what the consequences will be if you refuse to provide your personal data
3. Retention and Destruction of Personal Data
We ensure that all of your personal data collected with your consent when you "sign up for our service" or make a reservation for "travel purposes" is destroyed when you cease to be our member.
Your personal data will be isolated from others and securely retained if you have agreed to any privacy-related law applicable in the jurisdiction where you reside specifies, or a different term where your personal data should be retained.
[Provisions of Korean laws with respect to retention of personal data]
Act on the Consumer Protection in Electronic Commerce, etc
- Record on legally binding contracts or revoking of commitment: 5 years
- Record on payment or supply of goods or others: 5 years
- Consumer complaints or how they are handled: 3 years
Protection of Communications Secrets Act
- Website access log: 3 months
4. Disclosure and sharing of personal data
① If we disclose your personal data to a third party, we will inform you in advance of the following to seek your consent.
- Who will disclose your personal data
- For what purpose the party who receives your personal data uses it
- The scope of your personal data to be disclosed
- For how long the party who receives your personal data will use it
- The fact that you have the right to refuse or withdraw consent
② You might not be able to use the full service we offer if you do not agree to disclose your personal data when you make a reservation for your business travel.
③ Unless you otherwise agree or if we are required by applicable law, we will not use, or disclose to a third party, any of your personal data beyond the scope communicated to you in the Purpose of Collection and Use of your Personal Data.
④ Unless there is any risk of infringing your interest or a third party's, we may disclose your personal data if:
- We have obtained your consent;
- Any of the applicable laws permits;
- We determine that such disclosure is necessary for the benefit of your or a third party's life, health or property when no prior consent can be obtained from you because you or your legal representative is not available to give such consent or your whereabouts are unknown; or
| Category | Receiver | Purpose of use | Scope of personal data disclosed | Duration of retention | Available in: |
|---|---|---|---|---|---|
| Flight | List(Pop-up) | Booking a flight, checking whether departure is possible | Name (English), gender, date of birth, contact number (mobile), email, passport number, passport expiry data, nationality, mileage number, credit card number, credit card expiry data | To be destroyed when you cease to be a member | Korea |
| Hotel | List(Pop-up) | Booking a hotel room or viewing of reservation | Name (English), gender, date of birth, contact number (mobile), email, passport number, passport expiry data, nationality, mileage number, credit card number, credit card expiry date | To be destroyed when you cease to be a member | Korea |
| Car rental | List(Pop-up) | Booking a car or viewing of reservation | Name (English), contact number (mobile), pick-up location, return location, duration of rental, time of return, flight number (arrival), membership number | To be destroyed when you cease to be a member | Korea |
| GDS | List(Pop-up) | Book hotel/flight | Name (Korean), name (English), date of birth, gender, email, credit card number, credit card expiry data, passport number, passport expiry date | To be destroyed when you cease to be a member | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| List(Pop-up) | or a car | Name (Korean), name (English), date of birth, gender, email | To be destroyed when you cease to be a member | Korea, America, Europe, Southeast Asia, Southwest Asia, China | |
| Aggregator | List(Pop-up) | Booking a flight, hotel or a car | Name (Korean), name (English), date of birth, gender, email, credit card number, credit card expiry data, passport number, passport expiry date | Destroyed when you cease to be a member | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| Insurer | Samsung Fire & Marine Insurance | Offering of service, individual identification, confirmation of policy purchase intention, handling of complaints, notice | Information collected when you sign up for the service, credit card number, credit card expiry date, passport number, passport expiry date | To be destroyed when you cease to be a member | Korea |
| Employees of businesses using Knox Portal or Samsung's affiliates or subsidiaries | List (pop-up) | Retrieval of information on Samsung affiliates’ employees | Name, Company, Department, Position, Title | To be deleted upon opt-out | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| Traveler’s company agent (employee) | List (pop-up) | Retrieval of information on the traveler's company and designation of his/her agent | Name, Company, Department, Position, Title | To be deleted upon opt-out | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| P&S | Taseco | Vietnam Hanoi Pickup/Sending Car Resv/Confirm | Name(Korea/English), Dept, Phone, Meeting time, Hotel, Departure/Arrival Air Info, Department | When the purpose of use is achived | Vietnam, India |
| MICE | Contract Hotel(Hotel requested to stay) | Reservation | Comp Name, Department, Position, Gender, Name(Ko/En), E-mail, Aviation Information, Check-in/Check-out Information, Hotel Name, Room Type, Request, Tr No, Credit Info, Nation, Passport, Birthday, food allergy | When the purpose of use is achieved | Korea |
| private transportation | MOVV | Booking a private transportation | Name(Korea/English), company, email, Phone number | To be deleted upon opt-out | Korea |
5. Transfer of personal data overseas
- We may transfer your travel information to any of our overseas business entities, if necessary, to provide you with travel management services. We are fully committed to protecting your information and ensure that it is used under our strict control in accordance with our privacy policy.
| Personal data items to be transferred | Receiver (entity name, contact info for data manager) |
Transferred to | Transferred on | Transferred via | Purpose of transfer | Term of retention |
|---|---|---|---|---|---|---|
Name (Korean), Name(English), nationality, date of birth, address, company, department, title, gender, credit card expiry date, contact number (office), contact number (mobile), email, ID, password, credit card number, passport number, passport number |
Samsung Hospitality America Inc. ms1084.kim@samsung.com |
USA | For flight, hotel and car rental bookings | SRS System |
Offering of travel management service | Until opt-out |
| Samsung Hospitality U.K. Inc. / shuk.security@samsung.com |
UK | |||||
| Samsung Hospitality Europe GmbH / shuk.security@samsung.de |
Germany | |||||
| Samsung Hospitality Romania S.R.L. / shuk.security@samsung.com |
Romania | |||||
| Tianjin Samsung International Travel Service Co., Ltd / changkeun.oh@samsung.com |
China | |||||
| Samsung Hospitality Philippines Inc. / chardonnay.shin@samsung.com |
Philippines | |||||
| Samsung Hospitality Vietnam Co., Ltd. / hyungseok.kim@samsung.com |
Vietnam | |||||
| Samsung Hospitality India Pvt. Ltd. / mksw.kim@samsung.com |
India |
6. Use of Contractors and Cross-border Transfer of Personal Data
① We use independent professional contractors to deal with personal data collected to allow for better business operations.
② We ensure that provisions stipulating the purpose of the service employed, no subcontracting, restrictions in processing of personal data, liabilities on the contractor including damages in case of violation of its obligations, technical and administrative protection of personal data and other important aspects are clearly included in the agreement with such contractors. Any replacement of the contractors listed below will be notified to you or publicly communicated by means of updated privacy policy.
| Service contracted | Contractor | Scope of personal data | Available in: |
|---|---|---|---|
| Operation and management of data center where personal data is stored | Samsung SDS(Location: Seoul, Korea), Hotel Shilla | Your personal data when you "sign up for our service" or make "reservations for your business travel". | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| Visa application on your behalf | My Visa Korea | Name (Korean), name (English), date of birth, gender, email, company, department, contact number (office), contact number (mobile), Passport number, resident registration number, family relationship certificate, crime fact certificate | Korea, America, Europe, Southeast Asia, Southwest Asia, China |
| SRS Service Payment | KICC | Card No, Card Period | Korea |
| SRS Service Payment | KG Inicis | Card No, Card Period | Korea |
| SMS Send | Dow | Phone No | Korea |
| CCTV Management | S1 | CCTV Video | Korea |
7. Your Rights and How to Exercise Them
① Scope of your rights
A. Right to know how your personal data are processed
- You have the right to be informed by us of the purpose and scope of collection and use of your personal data. Therefore, we ensure that you will be informed of the purpose and scope of personal data collection and how such data will be used. We also establish and publish a privacy policy.
B. Right to refuse to give consent and withdraw given consent
- This means that you have substantial control over how your personal data can be processed. You have the right to refuse to give consent to processing your personal data and withdraw such consent after being given.
C. Right to know whether your personal data have been processed and access them
- You have the right to access your personal data provided to know how possess your personal data and how much and how they use, disclose and manage them. Such right to access also helps prevent your personal data from being collected, used or disclosed in an irresponsible manner.
D. Right to restrict processing of, correct or delete your personal data
- To prevent any damage resulting from processing of incorrect personal data, you have the right to allow any of your incomplete or incorrect personal data not to be processed, or to be corrected or deleted. You also have the right to allow us to delete your personal data when there is no more need for us to retain them - for example, we have fulfilled the purpose of processing your personal data - to avoid leakage or abuse of any of your personal data.
E. Right to have your personal data back
- You have the right to have your personal data provided to us returned in an organized and generally usable form and transfer the data to be received by another party for it to use.
② How to exercise your rights
A. You can make a request to us with respect to access to, or correction, transfer, deletion of, or restriction on processing of, your personal data that we use in the following manners:
- Visit the SRS system: Log in and click on My Page to exercise your rights as needed
- Delete information(WEB): After logging in from SRS system click on 『Service Inquiry > Membership Withdrawal』 to exercise your rights as needed
- Delete information(MOBILE): After logging in from SRS APP click on 『My > Membership Withdrawal』 to exercise your rights as needed
- Contact our personnel responsible for user privacy in writing, by phone or email
B. Upon your request, we will allow you to access your personal data under our custody within ten days.
C. We ensure that any of your personal data that you want to delete or impose restrictions on use of, will only be used during the term of use as agreed upon and will not be used or access for any other purpose.
D. You have the right to allow your personal data provided to be accessed, corrected, transferred, deleted, or only processed in a specific manner. Upon such request from you, we will take necessary measures.
E. Upon request from you to correct any of your personal data, none of such data will be used or disclosed until such correction is complete. If any of your incorrect personal data has been disclosed to a third party, a notification will be made to the party to correct it.
8. Provisions on Children
Personal data will only be collected from you if you are a member of any of our affiliates or any of our customers. No personal data will be collected from you if you are a child as defined by the applicable law where the SRS service is offered.
9. Automatic Processing of Personal Data
None of your personal data will be used to evaluate your job performance or identify your financial conditions, health, preferences, interest, credibility, behavior, location or movement.
10. Technical and Organizational Measures to Protect Personal Data
SDS's data center located in Sangam-dong, Seoul, and takes all reasonable measures to prevent any of your personal data from being lost, stolen, leaked, modified or impaired and protect the system and data from any cyber-attacks.
① SDS's data center is certified with ISO27001 (Information Security Management System) and has its activities to protect privacy inspected by a publicly credible, independent body on a regular basis.
② All your personal data is fully protected using such measures as conversion into virtual data or encryption so as to minimize any damage in the event of a breach.
③ To avoid any leakage of your personal data resulting from hacking or otherwise, professionals skilled in anti-hacking measures are available in the data center at all times. In addition, drills are conducted on a regular basis to be fully prepared for the onset of any compromise including DDoS attacks and advanced persistent threats (APT).
④ SDS's data center has dual servers - main and backup - in place to ensure that all the personal data under its custody are fully protected.
⑤ The data center grants different levels of privileges to those having access to personal data and monitors their actual access to it to minimize the possibility of leakage. The center also ensures that regular training is offered to uphold their obligations for privacy protection.
⑥ The center follows procedures for checking security by identifying any impact on personal data under their custody before the introduction of new technology requiring the use of personal data or material change to its existing system to avoid any breach.
⑦ The center applies design principles focusing on privacy such that any illegal access to, or unauthorized use or abuse of, personal data collected.
⑦
⑧
⑨
⑩
11. Installation and Use of Devices to Collect Personal Data and Refusal
* Example: You can either allow all cookies to be saved, choose to be asked whether to allow them before any cookie is to be saved, or disallow any cookie to be saved by changing the settings on your web browser.
- Google Chrome (https://support.google.com/chrome/answer/95647?hl=en-GB)
- Internet Explorer (https://support.microsoft.com/en-us/kb/260971)
- Mozilla Firefox (https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer)
- Safari (Desktop) (https://support.apple.com/kb/PH5042?locale=en_US)
- Safari (Mobile) (https://support.apple.com/en-us/HT201265)
- Android Browser (https://support.google.com/nexus/answer/54068?visit_id=0-636602363711055441-2350803723&hl=en&rd=1)
12. 행태정보의 수집·이용·제공 및 거부 등에 관한 사항
13. Feedback and Complaints
A. Korea
- Department: Support Group
- Contact number: +82-2-6048-8669
- Email: sbtm.security@samsung.com
- Privacy Infringement Reporting Center: 118 (no area code required), https://privacy.kisa.or.kr
- Department of Cyber Crime Investigation, Supreme Prosecutors' Office: 1301 (no area code required), https://www.spo.go.kr
- Police Cyber Bureau: 182, https://ecrm.police.go.kr
- Department: Samsung Hospitality UK
- Contact number: +44-1932-455-704
- Email: shuk.security@samsung.com
- The National Supervisory Authority for Personal Data Processing
- President: Mrs Ancu?a Gianina Opre
- B-dul Magheru 28-30
- Sector 1, BUCURE?TI
- Tel. +40 318 059 211
- Fax +40 318 059 602
- e-mail: anspdcp@dataprotection.ro
- Website: https://www.dataprotection.ro/
Supervising Authority in UK:
- The Information Commissioner’s Office
- Water Lane, Wycliffe House
- Wilmslow - Cheshire SK9 5AF
- Tel. +44 0303 123 1113
- Fax +44 01625 524510
- e-mail: international.team@ico.org.uk
- Website: https://ico.org.uk
Supervising Authority in Germany:
- Der Bundesbeauftragte fur den Datenschutz und die Informationsfreiheit
- Graurheindorfer Str. 153
- 53117 Bonn
- Tel. +49 228 997799 0
- e-mail: poststelle@bfdi.bund.de
- Website: https://www.bfdi.bund.de/
- Department: Samsung Hospitality China
- Contact number: 189-0212-9657
- Email: changkeun.oh@samsung.com
14. Notice of Privacy Policy
V.1.7
Privacy Policy Effective on: August 10, 2023