Privacy and Personal Data Protection Notice

GDPR – BDSG – TDDDG

1. General Information

Protecting your personal data is important to us. This Privacy and Personal Data Protection Notice explains how your personal data is processed when you visit www.otelx.de, contact us or book a travel service through OtelX.

Your personal data is processed in accordance with applicable data protection legislation, particularly the European Union General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

OtelX acts as a travel intermediary. As a general rule, OtelX is not a tour operator organising package holidays in its own name. Travel services such as hotels, flights, package holidays, transfers, car rentals, tours and activities are provided by third-party service providers. OtelX facilitates the conclusion of the booking between the customer and the relevant service provider.

2. Controller

The controller responsible for processing your personal data is:

Otovia GmbH

Trading name: OtelX

Address: Holzener Str. 83, 58708 Menden, Germany

Managing Director: XXXXXX

Commercial Register: Amtsgericht XXXXXX, HRB XXXXXX

Telephone: +49 163 0198812

Email:[email protected]

Reservations:[email protected]

Website:www.otelx.de

You may submit enquiries concerning the protection of your personal data to [email protected].

3. Personal Data We Process

Depending on the service you use and the nature of your booking, we may process the following personal data:

• First name, surname, title and date of birth,
• Address, telephone number and email address,
• Nationality and passport or identity document information,
• Passport number, date of issue and expiry date,
• Details of other passengers included in the booking,
• Flight, hotel, transfer, car rental and other travel preferences,
• Arrival and departure dates, itinerary and destination details,
• Booking, transaction, ticket or confirmation numbers,
• Billing and payment transaction information,
• Payment amount, currency, payment status and refund information,
• Requests, complaints and customer service correspondence,
• Communications conducted by email or WhatsApp Business,
• IP address, date and time,
• Browser, device, operating system and connection information,
• Server, security and error logs,
• Cookie preferences and, where necessary, cookie data.

If you inform us of an accessibility requirement, reduced mobility, an allergy, a special meal request or another health-related special requirement, we may also process special categories of personal data concerning your health. Such data will only be processed to the extent necessary to fulfil your request and where an appropriate legal basis exists.

If you provide information about other passengers when making a booking, you are responsible for informing those individuals that their personal data will be processed by OtelX and the relevant travel service providers.

4. How We Obtain Personal Data

We may obtain your personal data from the following sources:

• Search, contact and booking fields completed on our website,
• Communications by telephone, email or WhatsApp Business,
• Information provided by you during the booking process,
• Information provided by another passenger or the person making the booking,
• Hotels, airlines, tour operators, transfer companies, car rental companies and other travel providers,
• Booking providers supplying services through XML, API or similar technical connections,
• Payment service providers such as PayPal and Stripe,
• Security, server and technical logs generated by our website.

5. Purposes and Legal Bases of Processing

5.1. Preparing and fulfilling bookings

We process your personal data to:

• Search for and display travel services,
• Check prices and availability,
• Process your booking request,
• Forward the booking to the relevant provider,
• Produce booking confirmations, tickets or vouchers,
• Handle amendments, cancellations and refunds,
• Provide customer support before and after your journey.

The legal basis for this processing is Article 6(1)(b) GDPR, as the processing is necessary to take steps before entering into a contract or to perform a contract.

Where a booking is made by another person or the data is not obtained directly from the data subject, processing may be based on our legitimate interest in fulfilling the booking under Article 6(1)(f) GDPR.

5.2. Compliance with legal obligations

We may process your personal data to issue and retain invoices and accounting records, comply with tax obligations, respond to lawful requests from competent authorities and retain commercial records.

The legal basis for this processing is Article 6(1)(c) GDPR, as the processing is necessary to comply with our legal obligations.

5.3. Customer communication and responding to requests

We process your contact details and message content to answer questions, booking requests, complaints and other enquiries.

Where the communication concerns an existing or intended booking, the legal basis is Article 6(1)(b) GDPR. For general enquiries, processing is based on our legitimate interest in maintaining customer communications under Article 6(1)(f) GDPR.

5.4. Website operation and security

We may process IP addresses, connection information, server data and security logs to ensure that our website operates securely, reliably and without errors, to prevent misuse and cyberattacks, and to detect and resolve technical problems.

The legal basis is our legitimate interest in securely operating our website under Article 6(1)(f) GDPR.

5.5. Processing based on consent

Where a processing activity may only be carried out with your consent, the legal basis is Article 6(1)(a) GDPR and, in relation to special categories of personal data, Article 9(2)(a) GDPR.

You may withdraw your consent at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

6. Travel Service Providers and Booking Systems

To fulfil your booking, the necessary personal data may be disclosed to:

• Hotels and other accommodation providers,
• Airlines and other transport companies,
• Tour operators,
• Transfer service providers,
• Car rental companies,
• Tour, excursion and activity providers,
• Global distribution and booking systems,
• Platforms supplying travel products through XML or API connections,
• Local representatives of the relevant service providers.

Depending on the booking, the disclosed information may include your first name, surname, date of birth, contact information, passport details, travel dates, itinerary, booking number and special requests.

The hotel, airline, tour operator or other provider supplying the travel service may process the transferred data under its own responsibility. These providers may have their own privacy notices and statutory retention obligations.

7. Paximum

OtelX may use the Paximum infrastructure to access third-party travel products and booking services.

When a booking is made, the customer, passenger, contact, travel and passport information necessary to create the booking and transmit it to the relevant service provider may be transferred automatically to the system. Our staff do not enter additional personal data that is unnecessary for providing the requested service.

The legal basis for this processing is Article 6(1)(b) GDPR. Limited processing for security, error detection and technical system operation may be based on Article 6(1)(f) GDPR.

8. Tourmax and WOX Teknoloji

OtelX may use Tourmax software for internal agency operations and technical process management. Tourmax is an agency management platform provided by WOX Teknoloji Yazılım Anonim Şirketi, a company established in Türkiye.

No booking, passenger, passport or payment information is transferred to Tourmax.

During the technical use of the system, the following data may be processed to a limited extent:

• IP address,
• Date and time of the connection,
• Browser and device information,
• Operating system information,
• Technical error, access and security logs.

The purpose of this processing is to ensure system security, access control and technical operability. The legal basis is our legitimate interest in secure and orderly business operations under Article 6(1)(f) GDPR.

Where data is processed in or transferred to Türkiye, Articles 44 et seq. GDPR concerning international data transfers apply. Where necessary, the European Commission’s Standard Contractual Clauses and supplementary security measures are used.

9. Payment Processing: PayPal and Stripe

Payments may be made through PayPal and Stripe on our website. Even if payment fields appear to be integrated into our website, the financial data required to process the payment is transmitted directly to the payment service provider you select.

OtelX does not see or store:

• Your full credit or debit card number,
• Your card security code,
• Your PayPal password,
• Your online banking login details.

The following information may be shared with OtelX to process the payment and associate it with your booking:

• The payer’s first name and surname,
• Email address or billing information,
• Payment amount and currency,
• Booking or order number,
• Payment transaction number,
• Whether the payment was successful, pending or declined,
• Refund, chargeback or dispute information.

The legal basis for processing payment data is Article 6(1)(b) GDPR. Processing for fraud prevention and security purposes may be based on Article 6(1)(f) GDPR.

Stripe may use automated fraud prevention systems such as Stripe Radar. Such checks may be performed by Stripe under its own responsibility and in accordance with its own privacy rules.

PayPal and Stripe may act as independent controllers for certain payment processing activities. We therefore recommend that you also review the privacy notice of the relevant payment service provider.

10. WhatsApp Business

If you contact us through WhatsApp Business, your telephone number, profile information, message content, documents you send and communication records may be processed by WhatsApp.

Using WhatsApp Business is voluntary. We recommend that you do not send sensitive information or passport documents through WhatsApp and, where possible, use a more secure communication method specified by us for submitting necessary documents.

Where the communication relates to a booking or contract, the legal basis is Article 6(1)(b) GDPR. General customer communications are based on Article 6(1)(f) GDPR.

In Europe, WhatsApp services may be provided by WhatsApp Ireland Limited. Data processing carried out by WhatsApp is governed by its own privacy policy. WhatsApp may transfer data to countries outside the European Economic Area.

11. Cloudflare

We may use Cloudflare services to improve the security and performance of our website and protect it against malicious traffic and cyberattacks.

When Cloudflare is used, IP addresses, access times, requested pages, browser and device information, security events and connection logs may be processed.

The legal basis for this processing is our legitimate interest in protecting our website under Article 6(1)(f) GDPR.

Where Cloudflare processes data outside the European Economic Area, appropriate international data transfer mechanisms are applied.

12. Hosting and Technical Service Providers

We may use hosting, maintenance, email, data storage and information technology service providers to operate our website and technical infrastructure.

To the extent necessary to perform their services, these providers may have access to IP addresses, contact details, booking data, technical records or customer correspondence.

Where required, data processing agreements are concluded with these service providers in accordance with Article 28 GDPR. The legal basis is Article 6(1)(b) GDPR where processing is necessary to fulfil a contract and Article 6(1)(f) GDPR where processing is necessary for secure technical operations.

13. Cookies

Our website may use cookies and similar technologies that are strictly necessary for its operation.

Strictly necessary cookies enable essential functions such as website security, maintaining sessions, completing bookings and storing language or privacy preferences. The legal basis is Section 25(2) TDDDG and, where personal data is processed, Article 6(1)(f) GDPR.

Non-essential analytics, advertising or similar cookies may only be used with your prior consent. In this case, the legal basis is Section 25(1) TDDDG and Article 6(1)(a) GDPR.

Further information about cookies is available in the Cookie Policy on our website. Where a cookie settings panel is available, you may change your preferences at any time.

14. Marketing Communications

OtelX does not currently send customers bulk advertising or campaign communications by email, SMS or WhatsApp.

Booking confirmations, payment updates, flight or accommodation changes, cancellations, refunds and important travel-related notifications are service communications and not marketing messages.

If we decide to send commercial communications in the future, we will obtain your prior consent where required and provide an easy way to unsubscribe.

15. Travel Insurance

OtelX does not currently sell travel insurance or act as an intermediary for travel insurance contracts. Therefore, personal data is not processed or transferred to insurance companies for insurance sales or intermediation purposes.

16. Special Categories of Personal Data

We process special categories of personal data, such as information concerning health, disability, reduced mobility, allergies or assistance requirements, only where this is necessary to provide the requested travel service.

Such information may be disclosed to the relevant airline, hotel, transfer company or other travel service provider to fulfil your request.

Depending on the circumstances, processing is based on your explicit consent, the protection of vital interests or another applicable legal basis under Article 9 GDPR. Please do not provide health information unless it is necessary for your booking.

17. Transfers Outside the European Economic Area

Where a travel service is provided in a country outside the European Economic Area, your personal data may need to be transferred to a hotel, airline, tour operator, transfer company or other service provider in that country.

Some countries may not provide the same level of data protection as the European Union. Where the transfer is necessary to fulfil your booking, Article 49(1)(b) GDPR may apply.

For regular international transfers involving technical service providers, appropriate safeguards may include:

• Adequacy decisions adopted by the European Commission,
• Standard Contractual Clauses,
• The EU–US Data Privacy Framework,
• Supplementary technical and organisational measures.

18. Retention Periods

We retain your personal data only for as long as necessary for the purpose for which it was collected.

In general:

• Booking and contractual data is retained until the booking has been completed and the applicable limitation periods for potential claims have expired,
• Invoices, payment records and accounting documents are retained for the statutory periods required by German commercial and tax law,
• Customer correspondence is retained for as long as necessary to resolve the request and establish, exercise or defend legal claims,
• Technical and security logs are retained for a limited period necessary for security and error investigations,
• Data processed on the basis of consent is retained until consent is withdrawn or the purpose of the processing no longer applies.

Where there is an ongoing legal dispute, official investigation or statutory retention obligation, the relevant data may be retained for a longer period. Once the retention purpose no longer applies, the data will be deleted, anonymised or access to it will be restricted.

19. Personal Data Security

We implement appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, alteration and disclosure.

Depending on the circumstances, these measures may include:

• Encrypted data transmission,
• Access and authorisation controls,
• Secure password practices,
• System and security logging,
• Backup and updating procedures,
• Confidentiality obligations for employees,
• Data protection assessments of service providers.

Nevertheless, no method of data transmission over the internet can be guaranteed to be completely secure.

20. Automated Decision-Making and Profiling

OtelX does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. OtelX does not create customer profiles for marketing purposes.

Payment service providers may carry out automated risk assessments under their own responsibility, particularly to prevent fraud. Information about such processing is available in the privacy notice of the relevant payment service provider.

21. Requirement to Provide Personal Data

You are not required to provide booking-related personal data merely to visit our website.

However, certain information—such as your first name, surname, contact details, travel information and, where required for the service, passport or identity information—is necessary to complete a booking. If you do not provide the required information, we may be unable to create the booking or provide the requested service.

22. Your Rights

Under the GDPR, you have the following rights:

• Right of access: You may request confirmation as to whether we process your personal data and obtain information about that processing.
• Right to rectification: You may request correction of inaccurate or incomplete personal data.
• Right to erasure: You may request deletion of your personal data where the applicable legal requirements are met.
• Right to restriction of processing: You may request restriction of processing in certain circumstances.
• Right to data portability: Where the applicable conditions are met, you may receive the data you provided in a structured, commonly used and machine-readable format.
• Right to object: You may object, on grounds relating to your particular situation, to processing based on Article 6(1)(e) or Article 6(1)(f) GDPR.
• Right to withdraw consent: Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
• Right to lodge a complaint: If you believe that your data protection rights have been infringed, you may lodge a complaint with a competent data protection supervisory authority.

You may exercise your rights by contacting [email protected]. We reserve the right to request additional information where necessary to verify your identity.

Requests will be answered within the periods specified in Article 12 GDPR and will generally be handled free of charge.

23. Specific Information About Your Right to Object

Where we process your personal data based on our legitimate interests under Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.

Following your objection, we will no longer process the relevant personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms or the processing is necessary for the establishment, exercise or defence of legal claims.

24. Competent Supervisory Authority

As Otovia GmbH is established in North Rhine-Westphalia, the competent data protection supervisory authority is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen – LDI NRW

Kavalleriestraße 2–4

40213 Düsseldorf

Germany

Postal address:

Postfach 20 04 44

40102 Düsseldorf

Germany

Telephone: +49 211 38424-0

Email:[email protected]

Website:www.ldi.nrw.de

You may also contact another competent data protection supervisory authority at your habitual residence, place of work or the place where the alleged infringement occurred.

25. Third-Party Websites

Our website may contain links to websites operated by hotels, airlines, tour operators, payment providers or other third parties.

The relevant website operator is responsible for processing personal data on third-party websites. We recommend reviewing the relevant provider’s privacy notice before using such websites.

The inclusion of a link on the OtelX website does not mean that OtelX endorses all content or data protection practices of the third party.

26. Children’s Personal Data

Children’s personal data is processed only to the extent necessary to complete a booking and provide the requested travel service.

A person making a booking on behalf of a child must have the necessary parental responsibility, custody or authority to represent the child. Children’s personal data is not used for marketing or profiling purposes.

27. Amendments to This Notice

This Privacy and Personal Data Protection Notice may be updated if our services, technical systems or applicable legislation change.

The latest version will be published on our website. Where appropriate, we may provide additional notice of material changes.

Last updated: 22.09.2026