GDPR
GDPR
PRIVACY NOTICE
Under the General Data Protection Regulation (GDPR)
Last updated: 22 September 2026
1. Data Controller and Contact Details
The company responsible for processing personal data in connection with the Otelx website and the activities described in this notice is:
Otovia GmbH
Holzener Str. 83
58708 Menden
Germany
Telephone: +49 163 0198812
Email:[email protected]
Reservations and customer enquiries:[email protected]
Website:www.otelx.de
You can contact us using these details if you have questions about how we handle your personal data or wish to exercise your data protection rights.
2. General Information on Data Protection
We process personal data in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the German Telecommunications and Digital Services Data Protection Act (TDDDG), and other applicable legal requirements.
Personal data means any information relating to an identified or identifiable individual. This may include names, contact details, dates of birth, booking and travel information, payment records, IP addresses and, where necessary, information from identity or travel documents.
This notice explains which data we process, why we process it, who may receive it, and the rights available to you.
3. Our Role as a Travel Intermediary
Otovia GmbH operates a travel agency under the Otelx brand and acts as an intermediary for travel services. We do not operate as a tour organiser that creates and provides its own package holidays in its own name.
Package holidays, accommodation, flights, transfers, rental cars, excursions, activities and other travel services displayed on our website are provided by the respective tour operators or independent service providers. Otovia GmbH facilitates access to these services and assists with booking arrangements.
External booking platforms, distribution systems, and XML or API connections may be used to search for services, display prices and availability, and complete reservations.
The provider responsible for the relevant travel service will be identified before the booking is completed or in the corresponding booking and contractual documents.
4. Categories of Personal Data
Depending on your enquiry and the travel service requested, we may process:
- First and last name
- Title and gender, where required for the booking
- Date of birth and age
- Residential and billing address
- Nationality
- Telephone and mobile number
- Email address
- Customer and booking reference numbers
- Travel dates and destinations
- Accommodation, flight, transfer and other service details
- Number of accompanying travellers and their necessary details
- Passport or identity document information, where required
- Necessary visa and entry information
- Customer correspondence and communication records
- Invoice, payment and transaction information
- Changes, cancellations, refunds and complaint records
- IP address
- Browser, device and operating system information
- Technical access and system logs
- Cookie preferences and consent records
Processing is limited to the information needed for the relevant purpose.
5. Purposes and Legal Bases for Processing
5.1. Handling Travel Enquiries
We process your information to answer questions about travel options, prices and availability, prepare quotations, and take steps at your request before entering into a contract.
The legal basis is Article 6(1)(b) GDPR.
5.2. Booking and Arranging Travel Services
Personal data is processed to prepare and manage reservations for accommodation, flights, transfers, rental cars, package holidays and other tourism services.
This may involve sending necessary details to providers, issuing booking confirmations, and handling amendments, cancellations and refunds.
The legal basis is Article 6(1)(b) GDPR.
5.3. Compliance with Legal Obligations
Where processing is necessary to meet tax, commercial, accounting or other legal obligations, the legal basis is Article 6(1)(c) GDPR.
5.4. Legitimate Interests
Provided that your interests, fundamental rights and freedoms do not override our interests, we may process personal data for:
- Protecting our website and IT systems
- Preventing fraud and misuse
- Establishing, exercising or defending legal claims
- Improving customer service
- Identifying technical faults and system errors
- Maintaining a reliable and stable website
- Improving business processes
The legal basis is Article 6(1)(f) GDPR.
5.5. Consent-Based Processing
Where your consent is required, processing takes place on the basis of Article 6(1)(a) GDPR.
Where special categories of personal data are processed with your explicit consent, Article 9(2)(a) GDPR also applies.
You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
6. When Providing Information Is Necessary
Information marked as required is needed to handle your enquiry or complete your booking.
Without this information, we may be unable to prepare a quotation, make a reservation or arrange the requested travel service.
Providing information that is not marked as required is voluntary.
7. Information About Other Travellers
If you book on behalf of other people, we may also process the information about those travellers that is necessary for the reservation.
Please inform them that their information is being shared with Otovia GmbH and that this privacy notice applies to the relevant processing.
Only provide another person’s information if you are authorised to do so.
8. Information About Children and Other Minors
Family and group reservations may require the processing of personal data relating to children or other travellers under the age of legal adulthood.
Such information is processed only to the extent necessary to handle the enquiry, complete the reservation or provide the relevant service.
The booking must be made by an adult who is authorised to make it.
9. Passport, Identity and Entry Information
Certain travel services may require information from passports, identity cards, visas or other entry documents.
This information is shared with tour operators, transport companies, other service providers or competent authorities only where necessary to complete the booking, provide the service or meet legal obligations.
10. Special Categories of Personal Data
In some cases, arranging travel that meets your needs may require information about health conditions, reduced mobility, assistance requirements, allergies or special meal requests.
Such information may directly or indirectly reveal details about your health or religious beliefs.
We process this information where it is necessary for the requested service and you have given explicit consent. The legal basis is Article 9(2)(a) GDPR.
Please do not send health information or other special categories of personal data that are unnecessary for your booking or the service requested.
11. Recipients of Personal Data
To handle travel enquiries, manage bookings and facilitate the provision of booked services, necessary information may be shared with:
- Tour operators
- Hotels and other accommodation providers
- Airlines and other transport companies
- Transfer providers
- Car rental companies
- Excursion and activity providers
- Booking and distribution systems
- XML, API and other technology providers
- PayPal, Stripe and other parties involved in payment processing
- Banks, card networks and payment acquirers
- Hosting, cloud, communication and IT service providers
- Tax advisers, legal advisers and other professional advisers
- Courts and public authorities, where legally required
Disclosure is limited to what is necessary to handle your request, perform the contract, meet legal obligations or protect legitimate interests.
12. Tourmax Agency Management System
We use the Tourmax system for the technical management of our travel agency. The system is provided by:
WOX Teknoloji Yazılım Anonim Şirketi
10032 Sok. No: 2, İTOB OSB
Menderes/İzmir
Türkiye
Our customers’ booking, traveller, passport, identity and payment information is not transferred to the Tourmax system.
However, technical use of the system may involve processing:
- IP address
- Connection date and time
- Browser and device information
- Operating system information
- Technical connection and error logs
This processing supports the secure, orderly and reliable management of our agency. The legal basis is Article 6(1)(f) GDPR.
Technical data may be processed on servers in Türkiye or Europe. Transfers to Türkiye must meet the requirements of Articles 44 onwards of the GDPR.
13. Paximum and Other Travel Providers
When a travel service is booked, the information necessary to complete the reservation is transmitted through the relevant technical connection to the tour operator, service provider or booking platform.
Paximum may be among the providers used for this purpose.
Depending on the service booked, the information transferred may include:
- First and last name
- Date of birth
- Contact details
- Nationality
- Travel and booking information
- Necessary details of accompanying travellers
- Passport or identity information, where required
- Special requests relating to the booking
- Booking reference and booking status
Information is transferred only to the extent necessary to handle your request, conclude the contract being arranged or provide the travel service.
The legal basis is Article 6(1)(b) GDPR.
The relevant provider will be identified before the booking is completed or in the corresponding booking and contractual documents.
Where a recipient is outside the European Economic Area, the requirements of Articles 44 onwards of the GDPR apply. Article 49(1)(b) GDPR may apply where the transfer is necessary to perform the travel contract requested by you and the relevant legal conditions are satisfied.
14. Payments Through PayPal and Stripe
We use PayPal and Stripe for online payment processing.
Even where a payment interface appears within the Otelx website, the card or account information needed for payment is transmitted directly to the payment provider you select.
Otovia GmbH does not view or store:
- Full credit or debit card numbers
- Card security codes
- PayPal account passwords
- Online banking login credentials
We may receive information relating to the payment, including:
- Name of the person making the payment
- Email and billing address
- Booking reference
- Payment amount and currency
- Payment method
- Transaction reference and payment status
- Payment date and time
- Refund and payment dispute information
Processing necessary to complete the payment and manage the booking is based on Article 6(1)(b) GDPR.
Processing to prevent fraud, unauthorised transactions and payment losses may, where applicable, be based on Article 6(1)(f) GDPR.
14.1. PayPal
The provider of PayPal services in the European Economic Area is:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
22–24 Boulevard Royal
L-2449 Luxembourg
PayPal may process account, payment, transaction, device and security information under its own responsibility as a data controller.
Further information:
https://www.paypal.com/de/legalhub/paypal/privacy-full
14.2. Stripe
Services provided by the Stripe group are used for card payments and other payment methods supported by Stripe. Relevant European entities include:
Stripe Payments Europe, Limited
Stripe Technology Europe, Limited
1 Grand Canal Street Lower
Grand Canal Dock
Dublin
Ireland
Stripe may process contact, payment, transaction, device and security information.
Automated risk assessment tools, such as Stripe Radar, may be used to protect payments. These tools evaluate technical and transaction-related indicators to identify potentially fraudulent or unauthorised payments.
Further information:
Payments made through PayPal or Stripe are also subject to the relevant provider’s privacy information.
15. Communicating With Us
15.1. Contact Form
Information submitted through our contact form is used to review and respond to your enquiry.
For booking or contract-related enquiries, the legal basis is Article 6(1)(b) GDPR. For other enquiries, Article 6(1)(f) GDPR applies where appropriate.
15.2. Email and Telephone
When you contact us by email or telephone, we process the information you provide to handle your enquiry and communicate with you as necessary.
Telephone calls are not recorded without your prior explicit consent.
Email:[email protected]
Telephone: +49 163 0198812
15.3. WhatsApp Business
You may choose to communicate with us through WhatsApp Business.
This may involve processing:
- Telephone number
- WhatsApp profile name
- Communication date and time
- Contents of messages and files sent
- Information relating to the handling of your enquiry
For booking and contract-related enquiries, the legal basis is Article 6(1)(b) GDPR. For general enquiries, Article 6(1)(f) GDPR applies where appropriate.
The service provider for users in the European Economic Area is:
WhatsApp Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
WhatsApp may process device, connection and communication metadata for its own purposes and share information within the Meta group. Processing may take place in the United States or other countries.
Further information:
https://www.whatsapp.com/legal/privacy-policy-eea
Using WhatsApp is voluntary. You can contact us by email or telephone instead.
Please do not send full card numbers, card security codes, PayPal passwords or online banking credentials through WhatsApp.
16. Advertising and Direct Marketing
We do not use customer telephone numbers or email addresses to send advertising emails, promotional text messages or WhatsApp advertising campaigns.
Contact information is used for:
- Answering questions and enquiries
- Managing reservations
- Providing booking-related information
- Delivering customer support
- Meeting legal obligations
If we introduce promotional communications in the future, these will be based on separate, demonstrable consent.
17. Travel Insurance
Otovia GmbH does not currently sell travel insurance or act as an intermediary for insurance contracts.
We therefore do not transfer personal data to insurance companies for the purpose of arranging travel insurance.
18. Technical Access and Server Logs
When you access our website, technical information may be processed automatically, including:
- IP address
- Access date and time
- Page viewed or file requested
- Address of the referring page
- Browser type and version
- Operating system and device information
- Volume of data transferred
- HTTP status code
This information is used to operate the website, investigate technical problems and prevent security threats.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is maintaining a secure and stable website.
19. Hosting and IT Infrastructure
Our website is operated using professional hosting and IT services.
These services may involve processing IP addresses, server logs, browser and device information, and technical communication data.
The purpose is to provide secure, fast and reliable access to the website. The legal basis is Article 6(1)(f) GDPR.
Where a hosting provider processes personal data solely on our behalf, the requirements for processing under Article 28 GDPR apply.
20. Cloudflare
We use Cloudflare to support the performance, availability and security of our website.
Provider:
Cloudflare, Inc.
101 Townsend Street
San Francisco, CA 94107
United States
Cloudflare may process:
- IP address
- Browser and device information
- Pages accessed
- Access date and time
- Technical security and error logs
The service helps deliver content more quickly, block malicious traffic and attacks, and identify technical problems.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is providing a secure and functional website.
Cloudflare services may involve processing data in the United States or other countries. Transfers to the United States may rely on the EU–US Data Privacy Framework where the recipient is appropriately certified and the transfer falls within its scope. Where necessary, appropriate safeguards such as the European Commission’s Standard Contractual Clauses may be used.
Further information:
https://www.cloudflare.com/privacypolicy/
21. Cookies and Similar Technologies
Our website may use cookies and similar technologies to provide functions and manage user preferences.
21.1. Technically Necessary Cookies
Cookies may be necessary for the website to function, complete booking steps, provide security features or deliver services you have expressly requested.
Whether cookies for language or currency preferences are necessary depends on the specific function and the service requested.
Section 25(2) TDDDG applies to storing information on, or accessing information from, your device where its legal conditions are met.
Where personal data is also processed, Article 6(1)(b) or Article 6(1)(f) GDPR may apply, depending on the purpose.
21.2. Cookies Requiring Consent
Cookies that are not technically necessary, including those used for analytics, advertising or optional additional functions, are used only with your prior consent.
The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR.
You can change your choices or withdraw consent through the cookie settings with effect for the future.
Rejecting optional cookies does not prevent you from using the website’s basic functions.
22. Transfers Outside the European Economic Area
The international nature of travel services may make it necessary to transfer personal data to hotels, tour operators, transport companies, transfer providers or other service providers outside the European Economic Area.
Such transfers may be necessary to prepare a journey you have requested or perform the corresponding contract.
The applicable transfer mechanism depends on the circumstances. Mechanisms available under the GDPR include:
- A European Commission adequacy decision under Article 45 GDPR
- Appropriate safeguards under Article 46 GDPR, such as Standard Contractual Clauses
- Exceptions for specific situations under Article 49 GDPR, where their conditions are met
Article 49(1)(b) GDPR may apply to transfers necessary to perform the contract requested by you, provided the legal requirements are satisfied. This exception is not a general basis for unrestricted, routine international transfers.
Some countries may not offer a level of data protection equivalent to that in the European Union. Public authorities may have different powers to access information, and opportunities to enforce your rights may be more limited.
You may request information about relevant transfers and, where applicable, a copy of the safeguards by contacting [email protected].
23. Retention and Deletion
We retain personal data for as long as it is needed for the relevant processing purpose.
After an enquiry or booking has been completed, data is deleted or anonymised unless ongoing contractual matters, legal retention duties, legal disputes or other lawful reasons require continued storage.
Retention periods for business and tax documents depend on the document type. Applicable German legislation may provide, in particular, for:
- Generally eight years for invoices and accounting vouchers
- Ten years for certain books, records and annual financial statement documents
- Six years for commercial and business correspondence
The start of these periods and any extensions are determined by applicable law.
Technical logs are retained only for as long as required for security, troubleshooting or the necessary investigation of incidents.
24. Data Security
We implement technical and organisational measures appropriate to the nature of the data and the risks of processing, in accordance with Article 32 GDPR.
Depending on the system concerned, these measures may include:
- Encrypted data transmission using SSL/TLS
- Restricted user permissions and access rights
- Password and access policies
- Firewalls
- Regular security updates
- Data backups
- Logging of security-related access
- Confidentiality and access procedures
These measures are intended to reduce risks to personal data. However, absolute security cannot be guaranteed when information is transmitted over the internet.
25. Automated Decisions and Profiling
Otovia GmbH does not make decisions about customers based solely on automated processing that produce legal effects or similarly significantly affect them.
Stripe and other payment providers may use their own automated risk assessment systems for payment security and fraud prevention.
Information about these activities and the associated rights is available in the relevant payment provider’s privacy information.
26. Your Data Protection Rights
Subject to the applicable legal conditions and exceptions, you have the following rights:
- Access to your personal data and related information: Article 15 GDPR
- Correction of inaccurate data and completion of incomplete data: Article 16 GDPR
- Erasure of personal data: Article 17 GDPR
- Restriction of processing: Article 18 GDPR
- Data portability: Article 20 GDPR
- Objection to processing: Article 21 GDPR
- Withdrawal of consent: Article 7(3) GDPR
- Complaint to a supervisory authority: Article 77 GDPR
To exercise your rights, please contact:
Otovia GmbH
Email:[email protected]
Where necessary, we may request proportionate information to verify your identity and prevent personal data from being disclosed to unauthorised persons.
27. Objections to Processing Based on Legitimate Interests
Where your personal data is processed under Article 6(1)(f) GDPR, you may object under Article 21 GDPR on grounds relating to your particular situation. This also applies to profiling based on that legal ground.
Following an objection, we will stop processing the relevant data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
You may object at any time, without giving reasons, to the processing of your data for direct marketing. Your data will then no longer be processed for that purpose.
Please send objections to [email protected].
28. Complaints to a Supervisory Authority
If you believe that the processing of your personal data violates data protection law, you may lodge a complaint with a data protection supervisory authority.
The authority responsible for the German federal state in which our company is based is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postal address:
Postfach 20 04 44
40102 Düsseldorf
Germany
Telephone: +49 211 38424-0
Email:[email protected]
Website:https://www.ldi.nrw.de/
Under the applicable legal conditions, you may also contact a supervisory authority, particularly in the EU Member State of your habitual residence, place of work or the place of the alleged infringement.
29. Changes to This Privacy Notice
We may update this notice when legal requirements, our services, service providers or technical systems change.
The current version is published at www.otelx.de. Where changes require additional information or renewed consent, we will meet the relevant legal requirements.