Your question has two distinct aspects which have to be considered separately: criminal law and civil law. I will give an opinion on both aspects, but first I have to give you a word of warning:
This case is not clear in the sense that the law can be immediately apply. For a full answer you need the services of a practicing lawyer who does the necessary research. I have a degree in German Law and I have had some practice in IT law, so I know what I am talking about, but I am currently not practicing it and I have done no research for this case. So please, pretty please, don't base any important decision on my opinion. It is a mere guidance, not more.
Criminal Law
The German Criminal Code (StGB) specifies two cyber crimes explicitly:
- Computer Fraud (Computerbetrug, § 263a StGB), which you violate when you gain some illegal monetary advantage using a computer, for example a hacker using your stolen credit card data to transfer funds to his account.
- Computer Sabotage (Computersabotage, § 303b StGB), which applies when you cause damage with a computer, for example a hacker attacking the power grid.
The second option clearly does not apply here, but the first one could. That would depend on the answer to a couple of questions, most importantly if a user would gain some monetary advantage at your expense and if that advantage would be illegal.
The first of these questions (advantage at your expense) already does not have a clear and universal answer. As it is quite common with fraud, this criminal law question has a civil law aspect (more on that on part two of the answer). The two ways how this could create an advantage to an attacker world be...
- A contract would not be enacted between you and the attacker, but he would take advantage of you believing in the contract's validity. This option would though probably not apply here, judging from the (spoiler alert) civil law part of the question.
- A valid contract would be created, but the terms and conditions would not apply and that would cause an illegal financial advantage for the attacker at your cost. Since the base contract would still be in effect and that comes with the obligation to pay, that advantage would have to be in the terms and conditions not applying. You can construct such a case, but that would depend on the terms in question, so there can not be an answer here. There is though a good chance that the terms would still apply (see below), so there will probably be no damage.
The other aspect is if this advantage would be through illegal use of the system, which is an interesting question in your case, since the link is publicly accessible. But, then again you can also fake a POST, so you can argue that it is always possible to make the terms not appear.
An aspect to be considered though, is that merely attempting computer fraud is already an offense. An attacker who thinks he can gain a monetary advantage from such an attack could be still punished, even if it is not even possible to commit the crime due to the circumstances (this by itself is an interesting question in criminal law).
The bigger danger that I see is that your solution makes it easy for an attacker to make their own site and then use your public link to book on your site (in a man in the middle attack). That would clearly be an offense, but it would be the attacker's not your client's. But since your success depends on the trustworthiness of your site, I would recommend to look for a safer solution (such as POST with https).
To summarize that part: There is a possibility that accessing the site in the described way is a crime, but I would say it is rather not due to the lack of damage. It is though possible that an attacker still commits a crime by attempting such an attack. You should in any case make your site safer to make it harder to commit MITM attacks.
Civil Law
The civil law side is whether the terms can be accepted in the described way. This is a case for the law of general terms and conditions (Allgemeine Geschäftsbedingungen or AGB). In a few words, for AGB to apply, the have to be notified to the client and he has to accept them. If your site is used how it is supposed to be, both conditions are met.
In the (invalid) way you have described, the first condition is in question. Since the user knows that using the described URL means accepting the terms, I would consider the second condition to be satisfied. So how can the terms apply if the user has not seen them?
In case you provide no shortcut to the accepted link and you also prevent that it can be found in another way (e.g. through a search engine), the direct link would be equivalent to someone signing terms and conditions without reading them, although he has had a chance to do so. That would still make the terms apply, because the client would have been given the chance to read them, which is the only thing the seller needs to do. So chances are that your terms would still apply (thus negating the financial advantage necessary for a crime).
However, AGB law is a complex subject that is generally handled by specialists. Any opinion of someone who is not such a specialist has to be handled with care. That includes my opinion.
