General Information on the processing of personal data

In the course of your studies at IU, it is necessary for IU to process data about you. This letter provides information on the processing of your personal data in connection with the commencement and pursuit of your studies at IU. If you enter into a student employment relationship with IU, you will receive separate information on the data processing in this regard. For details about the data processing when using our website, please refer to the website privacy notice available on the internet. Data processing through online tools will be explained to you in the corresponding tools.

Controller and Data Protection Officer

IU Group N.V., Square Ambiorix 10, BE-1000 Bruxelles (“IU Group”) processes your personal data depending on the topic as a joint controller with other companies belonging to the group (all of which are located at Mülheimer Straße 38, 53604 Bad Honnef, unless otherwise indicated). Activities in connection with the operation of IU Internationale Hochschule are carried out in joint controllership with IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt (“IU”), also with regard to the courses of study it offers, including establishing contact and sending information. For central services within the group, such as controlling, accounting and personnel administration, office, process and quality management, purchasing and sales, as well as central services, the aforementioned companies rely on the support of IU Corporate Services GmbH, which is also responsible for data processing; IU IT Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, provides operational IT infrastructure including hardware and software, telecommunications and electronic communications; IU Examination Service GmbH provides services in the area of examination supervision; IU Marketing Service GmbH and IU Sales Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, provides services in the area of marketing and sales (this also includes marketing via the website and the operation of the student applicant portal); IU Commercial 1 GmbH manages the online campus and IU Commercial 2 GmbH manages the campus locations and campus programs; IU Student Services GmbH together with the respective GmbH that exists for the respective location and is named after its city name, e.g., IU Dortmund GmbH or IU Bonn GmbH, provides services to support prospective students and current students, in particular student advisory services. We are happy to provide you with excerpts from the joint controller agreement. Please contact datenschutz@iu.org.

IU has appointed Dr. Annette Demmel, SPB DPO Services GmbH, An der Buche 4, 13465 Berlin, annette.demmel@spb-dpo-services.com, as the data protection officer for the aforementioned companies. You can contact IU Group either in writing or by email at datenschutz@iu.org.

Purpose of Processing

Your personal data will be processed for the following purposes:

• Student administration, including enrollment, conducting studies, issuing ID cards and similar documents, setting and collecting tuition fees, checking attendance and absences if necessary, organizing teaching operations (online and virtual events), registering for and attending courses, providing and distributing teaching materials, receiving and distributing course credits including plagiarism checks, conducting examinations and issuing examination certificates or transcripts, other general administrative and personnel processes required for properly conducting teaching operations;

• Study support including opportunities for discussions;

• Keeping records required by law, including accounting records;

• Internal and external auditing;

• Booking, execution and billing of any services;

• Fulfillment of legal notification and reporting obligations;

• Provision of operational IT infrastructure including hardware and software, telecommunications and electronic communications, including the internet, mobile applications, remote maintenance access, online meetings, other technical facilities for teaching and learning and taking exams by means of software, licensing and license control, assignment of user rights, debugging and troubleshooting, operation of a firewall and similar security devices, URL and malware filtering as well as malware reporting, tracking of files copied to removable media, ticket system for inquiries and help desk, use of IT security software and monitoring of lawful use to the extent permitted;

• Internal audits to ensure compliance with legal, regulatory and other corporate governance obligations and internal guidelines, and in the event of suspected criminal or regulatory offences, to uncover such offences, including the investigation of compliance violations.

Legal Basis for the Processing

Your personal data is processed on the basis of Art. 6 (1) b) of the General Data Protection Regulation (“GDPR”) for the purpose of implementing the study contract with you. To the extent that we are required to process your personal data to comply with a legal obligation, this takes place on the basis of Art. 6 (1) c) GDPR, or in cases where we transfer your personal data to another group company or to other recipients for the legitimate interests pursued by us or a third party, we will do so on the basis of and in accordance with Art. 6 (1) f) GDPR in order to use shared operational infrastructure, e.g., IT systems or online tools for teaching and examinations, including plagiarism control. In exceptional cases, where the processing of your personal data is not necessary to carry out the study relationship with you, but we would like to propose such processing to you, we will ask you separately for your consent pursuant to Art. 6 (1) a). You will then receive more detailed information in this context unless an explanation is included in this privacy notice.

If you terminate your study relationship and have given us your consent to contact you in this context pursuant to Art. 6 (1) a) GDPR, we will contact you to discuss the reasons for the termination, the possible continuation of the study program in a modified form in terms of content or within a different time frame, as well as other issues related to the termination. If you do not give your consent to be contacted after termination for this purpose, this will not affect the validity of any existing consent to be contacted for advertising purposes. You may revoke your consent(s) at any time with effect for the future. To do so, please contact datenschutz@iu.org.

If you decide to communicate with us via WhatsApp to carry out your studies, we will process your personal data to this extent. The legal basis for this data processing by IU is your use of our WhatsApp channels according to Art. 6 (1) b) GDPR. Data processing by WhatsApp is governed by the privacy policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for users within the European Union, or WhatsApp Inc. for all other users. This privacy policy is available at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy.

If you decide to communicate with us via live chat or chat bot in order to carry out your studies, we process your name, email address, date and time of delivered messages as well as topics and information that you make available via the live chat or chat bot. The legal basis for this data processing by IU is your use of our chats in accordance with Art. 6 (1) b) GDPR. Data processing by the live chat and chat bot is governed by the privacy policy of Genesys Telecommunications Laboratories B.V. with its registered office located at Gooimeer 6 – 02, 1411 DD Naarden, Netherlands. This privacy policy is available at https://help.mypurecloud.com/articles/genesys-cloud-privacy-policy.

Recipients

Only employees and teaching staff of IU, who are responsible for the activities described in the section ‘Purpose of Processing’, have access to your personal data. In addition, our group companies may provide IT services for us. We are happy to send you an overview of our group companies. Employees of these companies may have access to your personal data to the extent necessary to perform their tasks. Furthermore, we rely on the support of various external service providers for the operation of our IT infrastructure, including electronic communications, the operation of our websites, and administration.

As part of the courses offered via the internet, including plagiarism control, e.g., online tutorials, we use various functions of external providers (hereinafter referred to as “Online Tools”), which receive your name, details of your courses and their content, including recordings of your voice and video recordings of you. If we transfer data to service providers in so-called third countries in this context, this is described for the respective application in the myIU privacy notice. In some cases, these third countries do not have an adequate level of data protection. In particular, in the case of any data transfer to the USA, there is a risk that your personal data will be processed by the authorities there for control and monitoring purposes without you becoming aware of this or having sufficient legal remedies available to you. We regularly safeguard transfers to third countries by using the so-called EU standard contractual clauses. You can access a copy at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=de. If some providers use binding internal corporate rules for data protection or the transfer is secured because a company is certified under the Data Privacy Framework (see https://www.dataprivacyframework.gov/s/program-overview), this is explained in the individual applications. Detailed information on the data processing by the Online Tools can be found in each case next to the start button of the respective Online Tool.

If you use the WhatsApp channel of IU to communicate with us, in addition to employees of WhatsApp and IU, employees of our contractual partner MessengerPeople GmbH, which manages the WhatsApp channel, will also have access to your personal data. In this context, it is certainly not excluded that your personal data is stored on WhatsApp servers in the USA. Further information in this regard can be found in WhatsApp’s privacy policy at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy. WhatsApp LLC is certified under the Data Privacy Framework.

Categories of Data

We process the following categories of data:

Master and Contact Data

• Name

• Date of birth

• Gender

• Nationality

• Identity card number or passport number and issuing country or authority

• Photographs

• Private address

• Private contact details

• If you use our WhatsApp channel, details from your status messages as well as date and time of delivered messages

• If you use the live chat or chat bot, we also process information that you make available via the live chat or chat bot

Information related to the study relationship

• Details in connection with the commencement, execution and termination of the course of study

• Degree program

• Details from application procedures, e.g., curriculum vitae

• Entry and exit date

• Professional education and career

• Qualifications and certificates or degrees

• Skills

• Course participation

• Achievements in the course of study

• Performance evaluation

• Examination achievements

• Examination evaluation

• Bank account details or other payment data

Insurance Data

• Information on long-term care, health, labor and social insurance

• Information on other compulsory or optional insurance

Information related to the IT Infrastructure

• Usage data of operational IT infrastructure including electronic means of communication, e.g., internet, telephone, intranet

• Login information such as date or time, pages used, data transmitted and received, courses booked and attended

• Recordings of your voice and video recordings of you in the course of conducting courses or taking exams via the internet

How long will your personal data be stored?

Your personal data will be stored for the period required by law or for the period we determine in order to perform our duties. Details on the retention period for individual categories of data are available upon request at datenschutz@iu.org.

Your Rights

You may contact us either in writing or by email at datenschutz@iu.org to exercise the following rights:

• Access your data in order to check and verify it,

• Receive a copy of your personal data,

• Rectification, erasure or restriction of processing; this also includes the right to have incomplete or incorrect data completed by means of providing a supplementary statement,

• Right to object to the processing,

• You may receive the data you have provided in a structured, commonly used and machine-readable format and transmit this data to another controller if you have given your consent to the processing or the processing is based on a contract.

You also have the right to file a complaint with a supervisory authority in connection with the processing of your personal data. You can exercise this right by contacting the data protection authority responsible for your place of residence or the authority responsible for IU:

The Thuringian Data Protection Commissioner, Häßlerstraße 8, 99096 Erfurt.

Why Is Your Personal Data Collected?

We require your personal data in order to carry out the study relationship with you. You may choose not to provide your personal data or to provide us with incomplete information. However, this may mean that we are unable to carry out the study relationship with you. Please note that as an internationally active enterprise, we must enable our students to participate in courses partly, sometimes even exclusively, via the internet using Online Tools. For this purpose, we use the services of various software providers, particularly in the United States of America or in other countries outside the European Union. You can find more detailed information on the processing of personal data by Online Tools next to the start button of the Online Tool.

Automated Decision-making and Profiling

Your personal data will not be used for automated decision-making.