Booking & Payment Legal Validation — Working Draft

Status: Working draft for counsel validation. This is not legal advice and must not be treated as signed-off product policy until reviewed by qualified Reise-, Datenschutz-, and Zahlungsdienst counsel.

This note captures the current legal working answers for the Session 2 booking/payment boundary question: whether DEPOSIT_PAID can safely act as the stable domain boundary for confirmation, cost locking, ticketing, messaging, and ledger creation.

Core Driver

Almost every downstream rule depends on whether the booking is:

• PACKAGE_TRAVEL
• LINKED_TRAVEL_ARRANGEMENT
• SINGLE_SERVICE_EXCLUDED

The system must capture enough facts to classify a booking before applying checkout, payment, document, cancellation, ticket, and refund rules.

Required classification inputs:

• hasOvernightStay
• durationHours
• totalPriceGross
• service composition: TRANSPORT, ACCOMMODATION, VEHICLE_RENTAL, TOURIST_SERVICE
• touristServiceShareOfPrice
• b2bFrameworkContract
• operatorCountry
• travelerCountry
• ancillaries with type and price
• departureDate
• bookingDate

The classifier should store both the enum and the rationale that fired the rule.

Product Classification

Product shape	Likely classification
Multi-day bus tour including hotel	PACKAGE_TRAVEL
Day trip, transport only, <= EUR 500	SINGLE_SERVICE_EXCLUDED
Day trip, transport only, > EUR 500	Single service, but not Art. 250 EGBGB package information flow
Day trip, transport + meal/guided tour, <= EUR 500	Excluded under the day-trip carve-out
Day trip, transport + guided tour + entrance, > EUR 500	PACKAGE_TRAVEL
Multi-day tour, transport + tourist services, no hotel	PACKAGE_TRAVEL if tourist services are >= 25% of value or shape the trip's essential character
B2B group charter under framework contract	Excluded from package-travel regime

Event Model Implication

Do not conflate payment facts with contract formation or legal confirmation.

Recommended event separation:

• BookingRequested — customer submits the checkout request.
• PaymentAuthorized / PaymentCaptured / PaymentReceived — PSP/payment facts.
• BookingAccepted — operator acceptance, automated or manual.
• BookingConfirmed — legal confirmation sent on a durable medium.
• CostingBaselineLocked — internal accounting/planning baseline lock.
• FulfillmentAuthorized — ticket/boarding eligibility decision.

DEPOSIT_PAID may remain a factual payment state, but should not by itself mean "contract concluded, confirmation legally delivered, boarding-valid fulfillment authorized."

Must Enforce In Software

• Classification rule engine for package travel, linked travel arrangement, and excluded single-service bookings.
• Capture the required classification data points per tour SKU and booking.
• Separate payment events from contract acceptance and booking confirmation events.
• For package travel, block prepayment unless valid insolvency protection exists and the traveler has received the Sicherungsschein.
• Default package-travel deposit to 20%.
• Enforce deposit caps and require documented justification above 20%.
• Enforce final-payment due dates within counsel-approved bounds; 30 days before departure is the working default.
• For overdue final payment, require reminder, cure period, and formal withdrawal/cancellation declaration before cancellation side effects.
• Distinguish issued ticket artifact from boarding validity; boardingValid should remain false until full payment unless counsel approves another model.
• Void tickets only as a downstream effect of formal cancellation, not silently on overdue payment.
• Generate and deliver package-travel booking confirmation on a durable medium with counsel-approved Art. 250 EGBGB content.
• Enforce pre-checkout display/acknowledgment and post-booking delivery of required documents.
• Display the statutory withdrawal exclusion for dated travel where applicable.
• Apply and store the exact cancellation fee schedule shown before contract formation.
• Trigger refunds within 14 days for package-travel cancellations; use 14 days as the operational standard elsewhere unless counsel approves another SLA.
• Maintain an append-only audit trail for classification, documents, acknowledgments, payment events, delivery proofs, cancellation decisions, refunds, and legal declarations.
• Introduce a country-specific policy layer from day one, even if Phase 1 ships only Germany.

Operator-Configurable Within Hard Envelopes

• Deposit percentage, with default 20%, justification above 20%, and hard upper cap pending counsel.
• Final payment due date, within counsel-approved limits.
• Cure-period length after overdue final payment.
• Cancellation fee schedule, within counsel-approved reasonableness envelopes.
• Operator AGB and document wording, with counsel-approved templates and versioning.
• Ancillary refundability rules, where legally permissible.

Manual / Legal-Process Only Until Counsel Signs Off

• Busflow's marketplace, travel-intermediary, payment-collector, or merchant-of-record role.
• Mollie Marketplaces and any fund-flow structure that might implicate ZAG, BaFin, § 651v BGB, or § 651t BGB.
• B2B framework-contract edge cases.
• Partial-cancellation edge cases that require commercial/legal judgment.
• Switzerland-specific package-travel handling.
• Force-majeure or unavoidable-extraordinary-circumstances decisions.

Document Timing Matrix

Document	Package travel	Single service / excluded day trip
Formblatt	Show before contract; active acknowledgment	Not required
AGB	Show before checkout; acceptance required	Same
Cancellation policy	Pre-checkout disclosure	Required if used
Privacy policy	Pre-checkout	Same
Sicherungsschein	Required before or with confirmation if prepayment accepted	Not required
Reisebestätigung	After contract conclusion on durable medium	Simple confirmation sufficient
Payment terms	Pre-checkout	Same

Audit Evidence

Store per booking:

• tour SKU and classification result with rule rationale
• all document versions shown pre-checkout, with content hash/version/timestamp
• customer acknowledgment events with timestamp, IP, user agent, and UI target
• Sicherungsschein file, content hash, and delivery proof
• Reisebestätigung file, content hash, and delivery proof
• Mollie payment IDs and status events
• cancellation actor, reason, timestamp, applied rate, refund amount, and refund payment ID
• every reminder, cure-period notice, withdrawal/cancellation declaration, and delivery proof

DACH Policy Layer

Germany and Austria are close because both implement the EU package travel directive, but insolvency protection, templates, and authority details differ. Switzerland is a separate non-EU regime and should not be treated as a small variant of Germany.

Working policy:

• Phase 1 may ship DE only.
• AT and CH require separate policy modules before launch.
• The domain should already route through policyEngine.resolve(country, productAttributes).

Counsel Confirmation Checklist

Ask counsel to confirm:

1. The classification decision tree and statutory carve-outs.
2. The contract-formation model: customer offer followed by operator acceptance, or immediate contract at checkout subject to rejection/refund.
3. The precise document content for Formblatt, Sicherungsschein, Reisebestätigung, payment terms, cancellation terms, and withdrawal-exclusion wording.
4. The permissible deposit defaults, caps, and justification requirements.
5. The final-payment due-date envelope and overdue-payment cure-period workflow.
6. Whether issued-but-not-boarding-valid tickets are acceptable after deposit.
7. The cancellation fee envelopes and partial-cancellation treatment.
8. The Mollie Marketplaces fund-flow, Busflow role, § 651v / § 651t exposure, ZAG implications, and whether BaFin input is needed.
9. Which rules are hard-coded, operator-configurable, or manual-only.

Session 2 Impact

This draft supports the high-risk booking/payment boundary finding in session-2-domain-product.md. The action-oriented implementation companion is dach-travel-law-payment-compliance-spec.md. The main modeling conclusion is: DEPOSIT_PAID should remain a factual payment state, while confirmation, accounting baseline lock, and fulfillment authorization should be explicitly named policy decisions/events that can be rebound after counsel review.