> How hotels can use Vioma booking engine and channel manager while complying with GDPR, ePrivacy, and German TTDSG. > > Canonical: https://www.flowconsent.com/en/services/ecommerce/vioma E-commerce # Vioma Marketing · [Official website](https://www.vioma.de) Vioma is a German hospitality software vendor that provides booking engines (IBE), channel managers, and website tools for hotels and resorts. Its widgets load on hotel websites, set first party cookies for the booking flow, and exchange reservation data with Vioma servers in Germany. [Block Vioma until consent](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=ecommerce) · [Scan my site](https://www.flowconsent.com/en/scan) At a glance - Category [E-commerce](https://www.flowconsent.com/en/services/ecommerce) - Consent Marketing - Prior consent Required - Documented cookies 4 - Third-party domains 5 - Servers Germany, primarily Freiburg im Breisgau and German data centers operated by Vioma GmbH and its hosting partners. Overview ## What does Vioma do? ## **What Vioma is and how it works** Vioma GmbH, based in Freiburg im Breisgau, builds booking and distribution software for the hotel industry, including its internet booking engine (IBE), channel manager, website CMS, and email marketing tools. Hotels embed the Vioma booking widget into their site so visitors can search availability, configure room and rate options, and place reservations. The widget loads JavaScript and assets from Vioma domains, persists session and search state in first party cookies, and posts booking and guest data to Vioma servers in Germany. Because Vioma services run on hotel websites that target EU travelers, deployments fall under GDPR, the ePrivacy Directive, and German TTDSG. ## **What data and cookies it collects** Vioma typically sets first party cookies on the hotel domain to manage the booking session, store the current search (dates, guests, room type), and remember the locale and currency. It processes guest data entered in the booking form, including names, email addresses, phone numbers, billing details, special requests, and payment tokens forwarded to a payment service provider. Server logs capture IP addresses, user agents, and timestamps for fraud prevention and operational diagnostics. Optional analytics and marketing modules can send aggregated event data to GA4, Meta, or other tools selected by the hotel. ## **GDPR and ePrivacy implications** When the booking engine is needed to process a reservation that the visitor has explicitly initiated, processing of guest data and the related strictly necessary cookies can rest on contract performance under GDPR Art. 6(1)(b) and the strict necessity exemption of ePrivacy Art. 5(3). Optional analytics, A/B testing, retargeting, and cross site tracking layered on top of Vioma require prior, freely given, specific, informed, and unambiguous consent from EU and UK guests. German hotels must also comply with TTDSG Section 25, which mirrors the ePrivacy rules and is enforced by the Länder data protection authorities. ## **Data transfers and sub processors** Vioma core services run from Germany, which keeps booking data inside the EEA. However, hotels typically integrate payment providers, distribution channels, and analytics that may transfer data outside the EEA. Each integration must be reviewed: payment service providers like Adyen or Stripe rely on Standard Contractual Clauses, OTAs may host data in multiple jurisdictions, and Google Analytics involves transfers to the United States under the EU US Data Privacy Framework. Document each sub processor in the record of processing and run a transfer impact assessment for non EEA flows. ## **Consent, configuration, and hotel duties** Hotels using Vioma act as controllers of guest data and must publish a clear privacy notice covering booking, marketing, and analytics. Configure the cookie banner so the booking engine can load when the user starts a reservation, but block optional analytics and advertising scripts until consent is given. Update the data processing agreement with Vioma, list it as a processor, and verify the chain of sub processors. Ensure that retention periods for booking data follow tax and accommodation tax laws while applying minimization for marketing profiles. ## **Practical compliance steps** Sign a written data processing agreement with Vioma and obtain its current sub processor list. Map the data flow from the booking widget through Vioma to the PMS, channel manager, payment provider, and any marketing or analytics tools. Configure the cookie banner so optional categories are off by default and only fire when the user actively consents. Document retention rules for guest profiles, marketing consents, and audit logs. Train front office staff on data subject rights and review the cookie audit and DPIA at least once per year and after major Vioma releases. Compliance ## Vioma and the GDPR Vioma is classified as “Marketing”. On a site that targets European visitors, it must only load after the visitor consents, and it must be listed in your cookie policy. - Legal basis Booking engine functionality strictly necessary to process a guest reservation can rely on contract under GDPR Art. 6(1)(b) and the strict necessity exemption of ePrivacy Art. 5(3). Optional analytics, marketing, and cross site tracking integrated with Vioma require consent under GDPR Art. 6(1)(a) and ePrivacy Art. 5(3). - Risk level medium - Applicable regulations GDPR, ePrivacy Directive 2002/58/EC, German TTDSG, BDSG, ePrivacy implementations across DACH, Austrian DSG, Swiss FADP, EDPB guidelines on cookies and tracking. ### Impact assessment (DPIA) A DPIA is recommended when Vioma is combined with extensive marketing automation, profiling of guest preferences, or large scale processing across many properties. Document the categories of guest data collected, the chain of processors (payment, channel manager, analytics), retention rules, and any non EEA transfers. Reference EDPB guidelines, German DSK position papers on cookie consent, and Bavarian or Baden Württemberg DPA guidance on hotel processing. ### Sample text for your banner > We use Vioma to power the online booking engine on this site. Strictly necessary cookies allow you to search availability, complete a reservation, and process payment. Optional analytics and marketing cookies help us improve the experience and send relevant offers, and only run with your consent. You can change your choices at any time in the cookie settings. Cookies and trackers ## What Vioma sets and contacts - Tracking method Loads JavaScript widgets such as the Vioma booking engine (IBE) and channel manager components on hotel websites. Sets first party cookies for session, search context, and selected room data, and sends booking requests, guest details, and analytics events to Vioma servers in Germany. - Server location Germany, primarily Freiburg im Breisgau and German data centers operated by Vioma GmbH and its hosting partners. ### Cookies set (4) | Name | Type | Duration | Purpose | | ----------- | ------------ | -------- | ---------------------------------------------------------------------------------------------------------------------- | | vm\_session | first\_party | Session | Maintains the active booking session and links the user to their search and selection. | | vm\_search | first\_party | 1 day | Stores the current search criteria such as arrival, departure, guests, and room type to allow returning to the search. | | vm\_locale | first\_party | 1 year | Remembers the selected language and currency for the booking engine. | | vm\_csrf | first\_party | Session | Protects booking and contact forms from cross site request forgery. | ### Third-party domains contacted (5) - `vioma.de` - `vioma.com` - `secure.vioma.de` - `ibe.vioma.de` - `cdn.vioma.de` Questions ## Frequently asked questions about Vioma Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What cookies does Vioma set? Vioma sets first party cookies on the hotel domain to maintain the booking session, store the current search criteria, remember the selected language and currency, and protect form submissions against cross site request forgery. Optional analytics or marketing cookies depend on which integrations the hotel activates and on the consent the guest gives. ### Do guests need to consent before the booking engine loads? Strictly necessary booking engine functions can load without prior consent because they deliver a service the guest actively requested. Optional analytics, retargeting, and marketing scripts attached to the booking flow require prior opt in consent in the EU, UK, and Switzerland. ### What is the legal basis? Booking processing rests on contract performance under GDPR Art. 6(1)(b) for the reservation itself, on legal obligation under Art. 6(1)(c) for invoicing and accommodation taxes, and on consent under Art. 6(1)(a) plus ePrivacy Art. 5(3) for optional analytics and marketing. Document each purpose separately rather than collapsing them. ### Are there data transfers outside the EEA? Vioma core processing happens in Germany, so the booking data stays inside the EEA. Some integrations such as payment providers, OTA channels, or analytics tools can trigger non EEA transfers, in which case the hotel must rely on SCCs, the EU US Data Privacy Framework, or another lawful mechanism and run a transfer impact assessment. ### When should a hotel run a DPIA? Run a DPIA when Vioma is combined with large scale guest profiling, automated marketing, multi property analytics, or processing of vulnerable guests. Document data flows, processors, retention, and safeguards. German DPAs expect a DPIA whenever the risk to data subjects is non trivial. ### How do we implement Vioma with a CMP? Configure the consent management platform so the Vioma booking widget loads when the user actively starts a reservation, while optional analytics, marketing, and chat widgets remain blocked until explicit opt in. Test that, when consent is denied, no marketing pixels fire and no profile is built. ### What alternatives are there? Alternatives include SiteMinder, Cloudbeds, Mews, Apaleo, hotelbird, and IBE platforms from Channel Manager vendors. They differ in hosting locations, sub processor lists, and pricing. The compliance assessment remains structurally the same: cookies, processors, transfers, and lawful bases. ### How often should the cookie policy be updated? Review the cookie policy at least quarterly, after each Vioma module update, and whenever you add or remove integrations such as analytics, channel managers, or payment providers. List name, purpose, duration, and first or third party status for each cookie. Same category ## More services: E-commerce [See the whole category](https://www.flowconsent.com/en/services/ecommerce) ### [iCart](https://www.flowconsent.com/en/services/ecommerce/identixweb-icart) [Identixweb iCart is a popular web platform powering millions of websites worldwide, offering a flexible and extensible foundation for building any type of online presence. It provides themes, plugins, and a user-friendly admin interface for developers and non-technical users. Identixweb iCart supports e-commerce, blogging, portfolios, and enterprise websites with robust customization options. With a massive community and continuous updates, Identixweb iCart remains a leading web development choice.](https://www.flowconsent.com/en/services/ecommerce/identixweb-icart) [Preferences](https://www.flowconsent.com/en/services/ecommerce/identixweb-icart) · ### [Kickflip](https://www.flowconsent.com/en/services/ecommerce/kickflip) [Kickflip is a marketing platform that equips businesses with tools to amplify their digital presence and drive customer acquisition. It supports audience segmentation, campaign automation, and cross-channel engagement. Kickflip provides real-time analytics and reporting dashboards for performance measurement and strategy optimization. By combining data intelligence with marketing execution, Kickflip helps deliver the right message to the right audience at the right time.](https://www.flowconsent.com/en/services/ecommerce/kickflip) [Preferences](https://www.flowconsent.com/en/services/ecommerce/kickflip) · ### [Aedi](https://www.flowconsent.com/en/services/ecommerce/aedi) [Aedi is an AI-powered platform that leverages artificial intelligence and machine learning to help businesses automate processes, generate insights, and enhance digital experiences. It provides intelligent automation, natural language processing, and predictive analytics. Aedi integrates with existing workflows and tools to deliver AI-driven optimization across marketing, customer service, and operations. With scalable infrastructure, Aedi makes advanced AI accessible to all teams.](https://www.flowconsent.com/en/services/ecommerce/aedi) [Preferences](https://www.flowconsent.com/en/services/ecommerce/aedi) · ### [Kimonix](https://www.flowconsent.com/en/services/ecommerce/kimonix) [Kimonix is a web technology service that provides essential functionality for websites and digital platforms. It delivers core capabilities that support site operations, content delivery, and user experience optimization. Kimonix integrates seamlessly with modern web architectures, ensuring reliable performance and compatibility across browsers and devices. Trusted by businesses worldwide, Kimonix helps organizations maintain robust websites that meet user expectations and technical requirements.](https://www.flowconsent.com/en/services/ecommerce/kimonix) [Preferences](https://www.flowconsent.com/en/services/ecommerce/kimonix) · ### [FedEx](https://www.flowconsent.com/en/services/ecommerce/fedex) [FedEx is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. FedEx supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, FedEx ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/fedex) [Preferences](https://www.flowconsent.com/en/services/ecommerce/fedex) · ### [Itoris](https://www.flowconsent.com/en/services/ecommerce/itoris) [Itoris is a foundational web service that powers critical website functions and digital experiences. It provides reliable infrastructure, seamless integration capabilities, and consistent performance across all devices and browsers. Itoris supports modern development practices and scales with growing business needs. With a focus on stability and compatibility, Itoris ensures your website delivers a smooth, uninterrupted experience to every visitor and search engine crawler.](https://www.flowconsent.com/en/services/ecommerce/itoris) [Preferences](https://www.flowconsent.com/en/services/ecommerce/itoris) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)