Data Protection Notice Regarding the Use of Moxis


1. Data Controller: 

BDO Austria Holding Wirtschaftsprüfung GmbH
QBC 4 – Am Belvedere 4/Karl-Popper-Straße 4
1100 Vienna
datenschutz@bdo.at


2. Scope and Purposes of Processing:

In order to sign documents electronically, it is necessary to register for the signing process. The processing of personal data is undertaken for the purpose of technical management of registrations, the execution and verification of signatures, and the assurance of the integrity and traceability of signed documents.
In circumstances where an auxiliary identity verification procedure is implemented, we also process personal information to verify the individual's identity in conjunction with the electronic signature.
The objectives of processing are as follows:
  • To generate an electronic signature,
  • To technically enable and execute the signing process,
  • To document the signing process,
  • To verify the signature,
  • To ensure the integrity and traceability of the signed document,
  • To carry out an identity verification procedure through registration, if required by the specific process.

3. Categories of Personal Data Processed

In connection with the electronic signature procedure, we process the following personal data:
  • name and contact details,
  • the content of the document to be signed,
  • signature data, in particular timestamps and log data,
  • technical data, in particular IP address or device information.

Where an identification procedure is carried out, the following personal data may additionally be processed in particular:
  • biometric data derived from an official photo ID,
  • photo and video data generated during the identification procedure,
  • ID document data, in particular name, ID number and issuing authority,
  • log data, insofar as this is necessary for the identification procedure.


4. Legal Bases for Processing

Registration via the identification procedure is based on your explicit consent pursuant to Article 6(1)(a) General Data Protection Regulation (GDPR) in conjunction with Article 9(2)(a) GDPR, as biometric data is processed during this registration.

The use of the signature procedure serves the initiation and performance of a contractual relationship. The related processing is therefore based on Article 6(1)(b) GDPR.
We also store data for documentation purposes to safeguard and enforce potential legal claims based on our legitimate interests pursuant to Article 6(1)(f) GDPR.


5. Recipients and Service Providers

Your personal data may be disclosed to the internally responsible departments and to technical service providers, insofar as this is necessary for carrying out the signature and identification process.
Moxis is operated by XiTrust Secure Technologies GmbH. The identification procedure outside ID Austria is operated by Swisscom AG (Switzerland).


6. Place of Processing / Third-Country Transfers

Your personal data are processed in the European Union (EU), the European Economic Area (EEA), and Switzerland.
Where personal data is transferred to or processed in Switzerland, please note that Switzerland is subject to an adequacy decision of the European Commission. Therefore, an adequate level of data protection is recognised for data transfers to Switzerland.


7. Retention Period

Registration for the electronic signing of documents is valid for two years in the case of an auto-identification procedure and for five years in the case of a video-identification procedure, or in each case until the expiry of the validity of the official ID document, after which it must be renewed.

The biometric data required for the identification procedure is deleted immediately after completion of the registration and is not retained.

The document provided for electronic signature remains available for signature in the Moxis tool for a maximum period of 30 days. After expiry of this period, the document is automatically deleted, and signing is no longer possible. This applies unless a statutory retention obligation or another documented reason for longer storage exists.
We store personal data related to the signature process only for as long as this is necessary for carrying out and documenting the signature and identification process.


8. Provision of Data

For the performance of the relevant process (registration or signature), the provision of the relevant personal data is required. If this data is not provided, the electronic signature or the identification procedure may, in certain circumstances, not be carried out.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or other unlawful processing. These measures include, in particular, access restrictions, logging, integrity protection, and safeguarding of the systems used.


10. Your Rights

You have the right of access, rectification, erasure, restriction of processing, objection, and data portability.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future.


11. Right to lodge a complaint and Contact Details

You have the right to lodge a complaint with a competent supervisory authority.
Austrian Data Protection Authority
Barichgasse 40-42
1030 Vienna
Austria
Phone: +43 1 52 152-0
Email: dsb@dsb.gv.at
To exercise your rights or if you have any questions regarding data protection, please contact us at: datenschutz@bdo.at


Last Update: September 3rd, 2026