Cookie Policy

Information pursuant to the TDDDG and GDPR

Last updated: 22.09.2026

1. General Information

This Cookie Policy provides information about how cookies and similar technologies are used when you visit www.otelx.de.

Cookies are small data files that may be stored on your computer, smartphone, tablet or other device when you visit a website. Cookies may enable the website to operate securely and correctly, manage sessions, remember language preferences and complete booking processes.

The use of cookies and similar technologies is governed in particular by Section 25 of the German Telecommunications and Digital Services Data Protection Act (TDDDG) and, where personal data is processed, by the European Union General Data Protection Regulation (GDPR).

2. Controller

The organisation responsible for data processing in connection with the use of cookies is:

Otovia GmbH

Trading name: OtelX

Holzener Str. 83

58708 Menden

Germany

Managing Director: XXXXXX

Telephone: +49 163 0198812

Email:[email protected]

Reservations:[email protected]

Website:https://www.otelx.de

3. What Are Cookies and Similar Technologies?

Cookies are small text files stored on your device through your browser when you visit a website.

In addition to cookies, local storage, session storage, pixels, tags, scripts and similar technical methods may be used. Unless otherwise stated, the term “cookies” in this policy also includes these similar technologies.

These technologies may be used to:

• Enable the website to operate technically,
• Establish a secure connection and session,
• Process bookings,
• Remember language and privacy preferences,
• Prevent fraud and misuse,
• Protect the website against cyberattacks,
• Record users’ cookie preferences.

Cookies do not directly damage your device and are not, by themselves, viruses or malware.

4. Legal Basis

The use of cookies is assessed in two stages:

4.1. Storing information on or accessing information from a device

The primary legal basis for storing information on a user’s device or accessing information already stored on that device is Section 25 TDDDG.

Cookies that are strictly necessary to provide a digital service expressly requested by the user may be used without separate consent pursuant to Section 25(2) TDDDG.

Cookies that are not technically necessary may only be used after the user has given prior consent pursuant to Section 25(1) TDDDG.

4.2. Processing personal data

Where personal data is processed through cookies, the following legal bases may apply:

• For technically necessary cookies, Article 6(1)(f) GDPR, based on our legitimate interest in operating the website securely and functionally,
• For processing necessary to complete a booking or provide a requested service, Article 6(1)(b) GDPR,
• For cookies that are not technically necessary, the user’s consent under Article 6(1)(a) GDPR,
• Where processing is required to comply with a legal obligation, Article 6(1)(c) GDPR.

5. Categories of Cookies We Use

5.1. Technically necessary cookies

Technically necessary cookies are required for the website and the functions expressly requested by the user to operate.

These cookies may be used to:

• Establish a secure connection,
• Maintain a user session,
• Complete booking steps,
• Temporarily store search and booking information,
• Remember language preferences,
• Record cookie preferences,
• Operate forms and security functions,
• Prevent malicious traffic and cyberattacks,
• Balance server loads,
• Direct user requests to the correct server.

Technically necessary cookies do not require separate consent. Their use on the user’s device is based on Section 25(2) TDDDG. Related personal data processing is based, depending on the circumstances, on Article 6(1)(b) or Article 6(1)(f) GDPR.

If these cookies are blocked through browser settings, certain essential website functions, including bookings, sessions, payments or security features, may not operate correctly.

5.2. Preference and functionality cookies

Cookies may be used to remember a user’s language, display or similar preferences.

Where a preference cookie is strictly necessary to provide a function expressly requested by the user, it may be used under Section 25(2) TDDDG.

Functionality cookies that are not strictly necessary are only enabled after the user has given prior consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.

5.3. Statistics and analytics cookies

OtelX does not currently use Google Analytics or a similar user tracking and analytics service.

If statistics or analytics cookies are introduced in the future, they will not be stored on the user’s device and the relevant services will not be activated unless the user has given consent. In that case, this Cookie Policy will be updated and prior consent will be obtained under Section 25(1) TDDDG and Article 6(1)(a) GDPR.

5.4. Marketing and advertising cookies

OtelX does not currently use Meta Pixel, TikTok Pixel or similar advertising, retargeting or marketing tracking technologies.

If marketing or advertising technologies are introduced in the future, they will only be activated after the user has given prior and explicit consent. Refusing consent will not prevent the user from accessing the website’s essential functions.

6. Cloudflare

We may use Cloudflare services to maintain the security, performance and availability of our website and to identify and prevent malicious traffic, bots, fraud attempts and cyberattacks.

Cloudflare may process the following information:

• IP address,
• Date and time of access,
• Requested page or file,
• Browser and device information,
• Operating system information,
• Connection and security logs,
• Information concerning suspicious traffic and security events.

Cookies used by Cloudflare may be used under Section 25(2) TDDDG to the extent that they are strictly necessary for the secure operation of the website and the prevention of malicious traffic. The legal basis for the related processing of personal data is our legitimate interest in protecting our website and its users under Article 6(1)(f) GDPR.

Data processing carried out by Cloudflare for its own purposes may be subject to Cloudflare’s own privacy terms.

7. Booking Systems and XML/API Connections

The third-party travel services offered on our website, including hotels, flights, transfers, car rentals, package holidays, tours and activities, may be provided through XML, API or similar technical connections.

Technically necessary cookies or comparable temporary records may be used to maintain the session and booking steps when a user searches for or begins booking a travel service.

Their use is based on Section 25(2) TDDDG to the extent that they are strictly necessary to provide the search or booking service expressly requested by the user. Where personal data is processed, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR.

Booking systems may only be activated when a user searches for or selects a travel service or starts the booking process.

8. PayPal and Stripe

Our website may offer payment through PayPal and Stripe.

When the user selects the relevant payment method, technical content provided by PayPal or Stripe may be loaded, and the selected provider may use cookies or similar technologies to process the payment.

These technologies may be used to:

• Create a payment session,
• Process the payment securely,
• Prevent fraud and misuse,
• Associate the payment status with the booking,
• Comply with legal and regulatory obligations.

The payment service is only activated when the user selects the relevant payment method. Technologies strictly necessary to process the payment may be used under Section 25(2) TDDDG and Article 6(1)(b) GDPR.

PayPal and Stripe may act as independent controllers for certain processing activities. Further information about the cookies used and processing carried out by these providers is available in their respective privacy and cookie policies.

OtelX does not see or store full card numbers, card security codes, PayPal passwords or online banking login details.

9. Cookie Retention Periods

Cookie retention periods vary according to the purpose and technical characteristics of the cookie.

Session cookies

Session cookies are temporary. They are generally deleted when the browser is closed or the session ends.

Persistent cookies

Persistent cookies may remain on the user’s device until their specified retention period expires or the user deletes them earlier.

Cookies are not retained for longer than necessary for their respective purposes. The specific retention period for each cookie is displayed in the cookie settings section of the website. If retention periods change due to technical configurations or a change of provider, the relevant information will be updated.

10. Consent Management

Cookies that are not technically necessary are not enabled until the user has given prior consent.

The cookie preference interface provides users with the following options:

• Accept all optional cookies,
• Continue with technically necessary cookies only,
• Select cookie categories individually,
• Withdraw or change consent previously given.

Refusing or withdrawing consent does not prevent the use of the website’s essential services. However, certain optional functions selected by the user may no longer be available.

Consent is obtained through a freely given, specific, informed and unambiguous action. Pre-ticked boxes are not used. Silence, scrolling the page or continuing to browse the website is not regarded as consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

11. Changing Cookie Preferences

You may view, change or withdraw your cookie preferences at any time using the “Cookie Settings” link located in the footer of the website.

You may also use your browser settings to:

• View cookies,
• Delete existing cookies,
• Prevent new cookies from being stored,
• Allow or block cookies from specific websites.

Blocking technically necessary cookies through your browser may prevent booking, session, payment, language or security functions from operating correctly.

12. Third-Party Content

Third-party services may be activated on our website in connection with payment, booking or another user request.

Third-party content is not loaded without the user’s consent unless it is technically necessary to provide the service or has been expressly requested by the user.

Third-party providers may use their own cookies and process the data they collect under their own responsibility. In such cases, the privacy and cookie policies of the relevant provider apply.

Further information about which third-party services are actually used and the circumstances in which they are activated is available in our Privacy and Personal Data Protection Notice.

13. Transfers Outside the European Economic Area

The use of Cloudflare, PayPal, Stripe or other technical service providers may result in data being processed in countries outside the European Economic Area.

Where such a transfer takes place, the following safeguards may be used where applicable:

• Adequacy decisions adopted by the European Commission,
• The European Commission’s Standard Contractual Clauses,
• The EU–US Data Privacy Framework,
• Supplementary technical and organisational security measures.

Further information about international data transfers is available in our Privacy and Personal Data Protection Notice.

14. Your Rights Concerning Personal Data

Where your personal data is processed through cookies, you may have the following rights under the GDPR:

• The right to access your data and obtain information about its processing,
• The right to request correction of inaccurate or incomplete data,
• The right to request deletion where the legal requirements are met,
• The right to request restriction of processing,
• The right to data portability, where applicable,
• The right to object to processing based on legitimate interests,
• The right to withdraw consent with effect for the future,
• The right to lodge a complaint with a competent data protection authority.

You may exercise these rights by contacting us at [email protected].

15. Competent Data Protection Authority

The competent data protection supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen – LDI NRW

Kavalleriestraße 2–4

40213 Düsseldorf

Germany

Postal address:

Postfach 20 04 44

40102 Düsseldorf

Germany

Telephone: +49 211 38424-0

Email:[email protected]

Website:https://www.ldi.nrw.de

16. Data Security

Appropriate technical and organisational security measures are implemented to protect data processed through cookies and similar technologies against unauthorised access, loss, alteration and unlawful use.

These measures may include encrypted connections, access controls, security logs, software updates and limitations on access rights.

17. Amendments to This Cookie Policy

This Cookie Policy may be updated if the technologies used, service providers or legal requirements change.

The current version will be published at https://www.otelx.de. Where there is a material change in cookie use or a new consent-based service is introduced, users will be asked to provide consent again where necessary.

18. Contact

If you have questions about the use of cookies or the protection of your personal data, you may contact us:

Otovia GmbH

Trading name: OtelX

Holzener Str. 83

58708 Menden

Germany

Telephone: +49 163 0198812

Email:[email protected]

Reservations:[email protected]

Website:https://www.otelx.de

19. Scope

This Cookie Policy applies to https://www.otelx.de and all associated subpages under this domain.

Last updated: 22.09.2026