Privacy Policy

This Policy explains what personal information e-MTB Ta collects when you browse and book, why we use it, who we share it with and the rights you have.

Effective date: 2026-10-28

This is a translation provided for convenience. If there is any inconsistency between this version and the Korean version, the Korean version prevails to the extent permitted by law.

1. Scope

e-MTB Ta (the "Company", "we", "us") processes personal information in accordance with the Personal Information Protection Act of Korea and other applicable data protection laws, including the EU and UK General Data Protection Regulation where they apply. This Policy applies to the e-MTB Ta website and related services.

2. Information We Collect

When you make a reservation:

  • Booker details: name, email address, phone number, nationality and preferred contact method.
  • Rider and rental details: number of riders, bike sizes and models, rental dates, Branch and any note you enter.
  • Payment details: payment ID, transaction ID, amount, currency and payment status. Card numbers are entered directly with the payment provider and are not stored by us.

When you contact us:

  • Name, email address, phone number (optional), enquiry topic and message.

Collected automatically when you use the Service:

  • IP address, browser and device type, access time and request logs, used for security, fraud prevention and rate limiting.
  • Anonymous usage events (for example, which course cards are viewed or clicked and GPX downloads) linked to a random browser identifier rather than to your name or email.
  • Settings saved in your browser's local storage, such as language, currency, theme and an in-progress booking draft.

3. How We Use Your Information

  • To process reservations, take payments, issue refunds and send confirmation and service emails.
  • To let the Branch prepare and hand over your bikes and contact you about your rental.
  • To respond to enquiries and handle complaints or disputes.
  • To keep the Service secure, prevent fraud and abuse, and comply with legal obligations.
  • To understand which destinations and courses are popular and improve the Service, using aggregated or pseudonymised data.

Where the GDPR applies, our legal bases are performance of a contract, compliance with legal obligations, our legitimate interests in operating and securing the Service, and your consent where we ask for it.

4. Retention

We keep personal information only for as long as needed for the purposes above and then delete it, except where the law requires us to keep it longer:

  • Records of contracts, cancellations and payments: 5 years (Act on Consumer Protection in Electronic Commerce).
  • Records of consumer complaints and dispute handling: 3 years (same Act).
  • Website access logs: 3 months (Protection of Communications Secrets Act).
  • Unpaid reservation holds that expire are cancelled automatically; any associated contact details are kept only as long as needed for the records above.

5. Sharing with Third Parties

We share your information with third parties only as described below, with your consent, or where required by law:

  • Recipient: the Branch providing your rental (which may be a partner located outside Korea). Purpose: preparing, handing over and recovering the bikes and contacting you. Items: booker name, phone number, email, rider and rental details. Retention: until the rental ends and any related settlement is complete, or as required by local law.

We may also disclose information when required by a court order or by a request from a competent authority made in accordance with law.

6. Service Providers (Processors)

We entrust certain processing to service providers, who may only use the information to provide their services to us:

  • PortOne and the payment gateways and card companies connected through it: payment processing and refunds.
  • Google LLC (Gmail): sending reservation confirmation, cancellation, day-before reminder, reservation lookup and enquiry acknowledgement emails, and notification emails to administrators.
  • PingCAP (TiDB Cloud): database storage and operation.
  • Amazon Web Services: running the servers, file storage, logs and website delivery (CloudFront).

We will update this list if we add or change providers.

7. International Transfers

To provide the Service, we transfer personal information to the cloud and email delivery service providers below, which store and process it outside Korea (Article 28-8 of the Korean Personal Information Protection Act).

  • Recipient: PingCAP (TiDB Cloud). Country: Japan (AWS Tokyo region). Purpose: storing the Service database. Contact: legal@pingcap.com; privacy policy: https://www.pingcap.com/privacy-policy/
  • Recipient: Amazon Web Services, Inc. Country: Japan (Tokyo region); web pages are delivered through CloudFront edge servers worldwide. Purpose: running the servers, file storage, logs and website delivery. Contact: aws-korea-privacy@amazon.com; privacy notice: https://aws.amazon.com/privacy/
  • Recipient: Google LLC (Gmail). Country: the United States and other countries where Google operates data centers. Purpose: sending emails related to reservations and enquiries. Contact: googlekrsupport@google.com; privacy policy: https://policies.google.com/privacy
  • Items transferred: booker details (name, email address, phone number, nationality, preferred contact method), rider and rental details, payment details (payment ID, transaction ID, amount, currency, payment status), information you enter when contacting us (name, email address, phone number, topic, message) and information collected automatically (IP address, browser and device type, access time, request logs, anonymous usage events). Settings kept only in your browser's local storage are not transferred. Only the information needed to send emails is transferred to Google LLC: the recipient's email address and name, reservation details (Reservation Code, Branch, bike, rental period, amount) and the content of enquiries.
  • When and how: at the time you use the Service, over the network using encrypted (TLS) connections. Information is sent to Google LLC in the same way at the time each email is sent.
  • Retention: the same as Section 4 (Retention); the information is deleted when that period ends or when the service contract ends.
  • How to refuse and its effect: you can refuse by telling us at support@emtbta.com or by not making a reservation or enquiry. Because these transfers are necessary to provide the Service, if you refuse you will not be able to use the Service, including reservations, payments and enquiries.

In addition, if your rental takes place at a Branch outside Korea, your reservation details are provided to that Branch as described in Section 5.

8. Deletion

When the retention period ends or the purpose has been achieved, we delete electronic records using methods that prevent recovery and shred or incinerate any paper records.

9. Your Rights

You may request access to, correction or deletion of your personal information, ask us to restrict or stop processing, object to processing, and, where the GDPR applies, request data portability or withdraw consent at any time.

To exercise these rights, email support@emtbta.com from the address used for your reservation or include your Reservation Code so that we can verify your identity. We will respond without undue delay and within the period required by law. Some requests may be limited where we are legally required to keep the information.

10. Cookies and Local Storage

We use only cookies and browser storage that are necessary for the Service: storing your language, currency and theme settings, keeping your booking draft while you check out, and authentication cookies for administrator accounts. We do not currently use advertising or cross-site tracking cookies. You can clear stored data in your browser settings, but some features may then not work as expected.

11. Security

  • Encryption of data in transit (HTTPS).
  • Access to personal information limited to authorised staff, with access controls and logs.
  • Card details handled only by certified payment providers.
  • Rate limiting and monitoring to prevent abuse.

12. Children

Reservations must be made by an adult. We do not knowingly collect personal information directly from children under 14 (or under 16 where the GDPR applies). Information about a minor rider should be provided by their parent or legal guardian.

13. Privacy Officer and Complaints

For privacy questions or requests, contact our privacy officer at support@emtbta.com.

You may also contact the following bodies:

  • Personal Information Infringement Report Center (KISA): privacy.kisa.or.kr, +82 118
  • Personal Information Dispute Mediation Committee: kopico.go.kr, +82 1833-6972
  • If you are in the EU/EEA or UK, the data protection authority in your country of residence.

14. Changes to This Policy

If we change this Policy, we will post the updated version on the Service with its effective date at least 7 days in advance, or at least 30 days in advance for significant changes affecting your rights.