0 PRIVACY NOTICE

0.1 Data Protection Information for Websites

​​​This Privacy Notice explains how your personal data is processed in connection with the use of this website and the provided functionalities, such as the menu for ordering information, a blog and search functions (hereinafter collectively referred to as the „Website“), and other processing operations described below.

This Website uses SSL or TLS encryption for security and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries submitted to the data controller). You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser line.

0.2 Data Protection Information for Use of Safe (IU File Sharing Portal)

This Privacy Notice explains how your personal data is processed in connection with the use of Safe, IU’s portal for file sharing (hereinafter referred to as „Website“).

This Website uses SSL or TLS encryption for security and to protect the transmission of personal data and other confidential content. You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser line.

1 GENERAL

1.1 Data Controller and Data Protection Officer

​​​This Website is operated by IU Group N.V., Square Ambiorix 10, BE-1000 Bruxelles („IU Group“). IU Group is the data controller for the processing of your personal data.

IU Group processes your personal data on a subject-related basis in joint controllership with other companies belonging to the Group (all with their registered office at Mülheimer Straße 38, 53604 Bad Honnef, Germany, unless otherwise stated). Activities in connection with the operation of the IU International University are carried out in joint controllership with IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt ("IU"), also with regard to its study programs including getting into contact and the provision of information. For central services within the Group, such as controlling, accounting and personnel administration, office, process and quality management, purchasing and sales, as well as other services, the aforementioned companies receive support of IU Corporate Services GmbH, which is jointly responsible for data processing; IU IT Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, with regard to the provision of the operational IT infrastructure including hardware and software, telecommunication and electronic communication; IU Examination Service GmbH for services in the field of examination supervision; IU Marketing Service GmbH as well as IU Sales Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, for services in the area of marketing and sales (this also includes marketing via this website and the operation of the applicant portal for students); IU Commercial 1 GmbH for the management of the online campus and IU Commercial 2 GmbH for the management of the campus locations and with regard to the campus programs; IU Student Services GmbH together with the respective GmbH that exists for the respective location and is named after its city name, e.g. IU Dortmund GmbH or IU Bonn GmbH, for the support of prospective students and students, in particular student advising.

We can provide you with excerpts from the joint controller agreement. If you would like to receive an excerpt, please contact datenschutz@iu.org.

IU Group has appointed Dr. Annette Demmel, SPB DPO Services GmbH, An der Buche 4, 13465 Berlin, annette.demmel@spb-dpo-services.com, as the data protection officer for the aforementioned companies.

You can contact IU Group either in writing or per email at datenschutz@iu.org.

1.2 Recipients

Unless otherwise described in the context of a certain processing, only those IU employees, who are responsible for performing a specific task have access to your personal data. In addition, employees who are responsible for operating our IT systems may have access to some of your personal data as part of their job, e.g., administering an application or performing IT security control tasks. Our employees are obligated to maintain the confidentiality of all personal data.

In the course of our business activities, we rely on the support of various service providers, in particular for the aforementioned purposes as well as for the operation of our IT systems. If the service providers we use have access to personal data, we have entered into the necessary agreements to protect your personal data; in particular, we have concluded data processing agreements in accordance with Art. 28 GDPR, in which we oblige our service providers to maintain confidentiality. Furthermore, banks may receive personal data for the purpose of processing payments, or lawyers, tax advisors and auditors may receive personal data in the course of their work for us. In some cases, we transmit personal data due to legal obligations. In the event of a suspected criminal offense or during investigative proceedings, data may be transmitted to the police and public prosecutor’s office. For further information about who has access to your personal data when using the individual applications, please refer to the description of the respective application.

1.3 Transfers to Third Countries

If we transfer data to service providers in so-called third countries, this is described for the respective application. Some of these third countries do not have an adequate level of data protection. An overview of third countries for which an adequate level of data protection has been confirmed by the EU Commission can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. Particularly in the case of data transfers to the USA, there is a risk that your personal data will be processed by the authorities there for control and monitoring purposes without you becoming aware of this or having sufficient legal remedies available to you. We routinely safeguard transfers to third countries by using the so-called EU standard contractual clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. If some providers use binding internal corporate rules for data protection or the transfer is secured because a company is certified according to the Data Privacy Framework (see https://www.dataprivacyframework.gov/s/program-overview), this is explained in the individual applications. If the use of individual applications is optional or alternatives are available, we point this out and - if you do not want to use the alternatives - process your personal data in such cases only on the basis of your separate consent to legitimize the data transfer in accordance with Art. 49 (1) a) GDPR.

1.4 Consent

If you have given your consent to a processing activity, you may withdraw this consent at any time with effect for the future without providing a reason. For this purpose, please use the methods for contacting IU mentioned above or change the switch settings if you have given your consent via the selected switch settings.

1.5 Retention

It is our general policy to delete your data as soon as it is no longer needed for the required purpose and if there are no retention obligations. We usually delete your personal data within a short period of time, e.g. within a few months after the conclusion of any counseling. Unless special circumstances regarding deletion are described for the respective application, we process your personal data in accordance with the various retention periods under university or federal law for up to 15 years or in accordance with retention periods under tax and commercial law for a period of six to ten calendar years after the conclusion of a transaction or after the end of the contract. If you object to any processing under Art. 21 (2) GDPR, we will delete your data within four weeks after your objection, unless otherwise required by law or if we are obligated to block the data. If the processing takes place on the basis of your consent and you withdraw your consent or the processing ends for other reasons, we will process the information necessary to prove that consent had previously been granted, i.e. date, time, details of the granting and subject of the consent, for a period of three years after the processing based on consent ends.

2 Data Collection When Visiting the Website

​When using our Website for informational purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called „Server Log Files“). When you access our Website, we collect the following data, which is technically necessary in order to display the Website for you:

• Our Website visited

• Date and time of access

• Quantity of data transmitted in byte

• Source/reference from which you reached the page

• Browser used

• Operating system used

• IP address used

The processing takes place in accordance with Art. 6(1)(b) of the General Data Protection Regulation (“GDPR”) on the basis of your use of our Website and our interest in improving the stability and functionality of our Website in accordance with Art. 6(1)(f) GDPR.

We process your data in order to provide you with a functional website, retain the data for the duration specified by IU for this purpose and delete your data thereafter.

Only employees of IU who are responsible for maintaining the Website receive access to your personal data.

We use third-party services on our Website. Further information about these services and the related data processing is found in this Privacy Policy or the cookie settings.

3 Cookies

​Depending on your browser settings and whether you have given us your consent, cookies may be used when you visit this Website in order to extend the functionality of the Website and make it more convenient for you to use. Cookies are small text files that are stored on your computer. Most of the cookies used by IU are deleted from your hard drive at the end of the browser session („Session Cookies”). In addition, IU uses so-called permanent cookies („Persistent Cookies”), which remain on your device in order to recognize you the next time you visit the Website. If cookies are used, they collect and process to an individual extent certain user information such as browser and location data, IP address values and as described in the Server Log Files. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

An overview of the cookies used and the duration of the respective cookie storage can be found in the cookie settings in our Cookie Consent Tool.

If personal data is also processed through individual cookies used by us, the processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our Website (so-called „Necessary Cookies”) or in accordance with Art. 6(1)(a) GDPR on the basis of your consent for all other cookies (marketing and analysis cookies).

Please note that you can configure your browser in such a way that you are informed about the use of cookies and can decide individually whether to accept or to refuse to accept them in certain cases or in general. Each browser differs in the way it manages cookie settings. Cookie settings are described in the help menu of each browser, which explains how you can change your cookie settings.

Please note that if you do not accept cookies, the functionality of our Website may be limited.

4 Cookie Consent Tool

This website uses a so-called cookie consent tool of Usercentrics GmbH, Rosental 4, 80331 Munich, Germany (the „Cookie Consent Tool“) to obtain consent to the use of cookies and cookie-based applications that require consent.

By integrating a corresponding JavaScript code, users are shown a banner when they access our Website, in which consent for certain cookies and/or cookie-based applications can be given by ticking the appropriate box.

The Cookie Consent Tool blocks the use of all cookies requiring consent until the respective user grants the corresponding consent by ticking the appropriate box. This ensures that cookies of this type are only placed on the user’s device if consent has been granted.

In order for the Cookie Consent Tool to be able to clearly assign page views to individual users and to individually record, log and store the consent settings chosen by the user for a session duration, certain user information, as described in the Server Log Files and including the IP address, is collected by the Cookie Consent Tool when our Website is accessed, transmitted to servers of the Cookie Consent Tool and stored there. For further details, please refer to the information provided in each case in the Cookie Consent Tool.

The data processing carried out by the Cookie Consent Tool takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in a legally compliant, user-specific and user-friendly consent management for cookies and thus our legitimate interest in our Website being lawfully designed.

We have concluded a data processing agreement with Usercentrics GmbH, which obligates Usercentrics GmbH to protect the data of visitors to our Website and to refrain from disclosing such data to third parties.

We process your data for this purpose for the duration of your session and delete your data thereafter, unless you have given your consent to the use of cookies, in which case we process your data for the duration specified for each cookie.

For further information on the use of data by Usercentrics GmbH, please refer to Usercentrics’ Privacy Policy at https://usercentrics.com/privacy-policy/.

5 Contact (e.g. by email)

If you contact us by e-mail, we process the information necessary to answer your contact requrest, e.g. your e-mail address, the information you provide and the date and time of the contact. If you also provide us with your name and other personal data, we also process these.

If you conduct an online meeting with us or request consultation with regard to the studies, we additionally process your name displayed, if applicable your profile picture, preferred language, date, time, meeting ID, if applicable your phone number, as well as exchanged texts, audio and video data. To handle our communications, we use Microsoft 365, Microsoft Teams, both services are provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") and Zoom Video Communications, Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA („Zoom“).

The legal basis for this processing is Art. 6 (1)(b) GDPR or Art. 6 (1)(a) GDPR for such information that is not absolutely necessary for the meeting and that you provide to us voluntarily. We process your data in order to respond to your inquiry or conduct a consultation. Your personal data will be retained in each case for the period determined by IU in order to perform the task and will be deleted thereafter. This is based on the retention periods under commercial and tax law. Only employees of IU who are responsible for responding to contact requests will receive access to your personal data.

We have concluded data processing agreements with Microsoft and Zoom based on the EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. For more information on data processing by Microsoft, please visit https://privacy.microsoft.com/de-de/privacystatement and for Zoom https://explore.zoom.us/en/privacy/.

5.1 Free Call-Back Service

​If you use our free call-back service, we will process your first and last name, your email address, if applicable, your telephone number, the desired call-back time (date and time) and a message to us in order to call you back about the matter you have specified. The legal basis for this processing is Art. 6(1)(b) GDPR. If we do not reach you by telephone and you have given us your consent to do so in accordance with Art. 6(1)(a) GDPR, we will contact you by email. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. Only employees of IU who are responsible for handling corresponding inquiries receive access to your data. As part of our telephone customer support, we may occasionally record telephone calls for training and quality control purposes. Should this be the case, you will be informed about this separately and can give your consent in this regard.

5.2 WhatsApp

​If you decide to communicate with us via WhatsApp prior to an application or as part of your application for admission or during your studies, we will process your personal data, such as your telephone number, your picture, your status information and your name if you provide us with this information. In addition, we process any personal data that you communicate to us via WhatsApp. In this regard, we recommend that you only provide us with the information that is absolutely necessary to answer your request and refrain from providing any additional information. Whether you use WhatsApp is up to you, and you can receive the same information by phone, electronically and/or regular mail.

IU processes your personal data in order to communicate with you. The legal basis for this data processing by IU is your use of our WhatsApp channels in accordance with Art. 6(1)(ba) GDPR.

You can withdraw your consent to the processing of your personal data at any time. The withdrawal can be made via the specified contact options. The declaration of withdrawal does not affect the lawfulness of the processing carried out so far.

The data processing by WhatsApp is governed by the Privacy Policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, which can be found at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy.

WhatsApp is a telecommunications service offered by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and a company of Meta Inc.

Access to your personal data is granted to those IU employees who manage our WhatsApp channels. IU uses a software solution of the provider Messenger People, which does not require an app installation. Even if the use of the software solution largely excludes access to data by WhatsApp, it cannot be ruled out that employees of WhatsApp or Meta may also receive access to your personal data. Likewise, it cannot be ruled out that your data will be stored on WhatsApp servers in the United States of America. WhatsApp LLC and Meta are certified under the Data Privacy Framework. You can find further information in this regard in WhatsApp’s Privacy Policy, if applicable. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted.

We use a chat bot based on artificial intelligence in our WhatsApp channel. The functionality and data processing of this is described in the following section.

If we use a chat-bot based on artificial intelligence or any other artificial intelligence in our WhatsApp channel that processes your personal data, we will inform you of this in advance within the WhatsApp channel. The exact functionality of the chat-bot and the associated data processing is described in more detail in the following section.

5.3  Chat Bot

IU uses a chat bot that can help with questions on operational topics. Chat bots are programs that simulate an online dialog. During processing, responses are generated that mimic natural human speech patterns when answering text-based queries. This means that you are not chatting with an employee, but with a computer program. To answer your query, we use a knowledge database where the contextual relevance is recognized, and the dialogue is conducted with the help of deep learning technology and natural language processing. We process the answers entered into the chat, e.g. education and professional experience. The chat bot uses AI-supported technology that uses deep learning algorithms and is provided by OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA ("OpenAI") and is operated in a protected environment at IU on servers of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). Further information on securing international data transfers can be found in the section "Transfers of personal data to third countries". Information on data processing by Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement.

Your entries in the chat will not be transferred to the OpenAI database for general reuse outside the IU. Excerpts of the content of the chat with you are used to train the chatbot. Only anonymized components are used for this, never e.g. your telephone number or your name. Furthermore, your data is used to personalize the service offered and to send you offers tailored to your interests. The legal basis for this processing is your consent in accordance with Art. 6 par. 1 (a) GDPR. Furthermore, with your consent pursuant to Art. 6 par. 1 (a) GDPR, information from the chat will be stored together with your name in Salesforce, Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England ("Salesforce"), and URLs with parameters for tracking and user guidance on the website will be created. Please also read the section on profiling.

Your personal data and the history of the chat will be stored for the duration specified by IU with regard to the fulfillment of the task and then deleted. The purpose of this is to save you from having to go into the history of your request if you contact us with a query.

To analyze the interaction of the chats, we use the service provider Dashbot, Inc, 548 Market Street, San Francisco, California 94104, USA ("Dashbot"), which is operated on servers of Amazon Web Services, Inc, 410 Terry Avenue North, Seattle, WA 98109-5210, USA ("AWS"). Both Dashbot and AWS are certified according to the Data Privacy Framework. You can find more information here: https://www.dataprivacyframework.gov/s/program-overview.

5.4 Unibuddy

IU uses a live chat provided by Unibuddy Ltd, Third Floor, 20 Old Bailey, London EC4M 7AN, United Kingdom ("Unibuddy"). The live chat is conducted by students or other individuals who can provide information on the topics requested. To use Unibuddy, you are required to create an account with Unibuddy in accordance with Unibuddy's terms of use and privacy policy. When using Unibuddy, IU processes your name, email address, phone number (if you provide it), and the time of your request in its Salesforce CRM system, provided by Salesfore, Floor 26, Salesforce Tower, 110 Bishopsgate EC2N 4AY London, United Kingdom, and in this way can determine whether you have previously made an inquiry to IU and whether and when your inquiry was answered. The processing of your personal data is carried out with your consent on the basis of Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time by addressing to the specified contact options. The withdrawal does not affect the lawfulness of the processing that has taken place to date.

Access to your personal data will be granted to those IU employees who are in charge of the live chat via Unibuddy. When transferring your data from Unibuddy to our CRM system, it may be stored in the United States of America. For this purpose, a contract has been concluded that includes the EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. In each case, your personal data will be stored for the period of time determined by the IU with regard to the performance of the task and then deleted. For more information on data processing by Unibuddy, please refer to Unibuddy's privacy policy, which can be found at https://unibuddy.com/privacy-policy/.

5.5 Typeform

​We use typeform provided by TYPEFORM SL, C/Bac de Roda, 163 (Local), 08018 Barcelona, Spain (“Typeform”) for some contact forms. You can tell that we use Typeform because “Typeform” is displayed as a logo at the bottom right of the screen. Typeform allows us to provide you with an easy way to contact us.

For this purpose, we share the following personal data with Typeform:

• Email address*

• First name*

• Last name*

• Telephone number

• Mandatory fields are marked with *.

Typeform is a recipient of your personal data and acts as a processor for us, which is why we have concluded a data processing agreement with Typeform. The legal basis for these processing operations is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent to the processing of your personal data at any time. The withdrawal can be made via the specified contact options. Your data will be processed until your request has been answered. By withdrawing your consent, the legality of the processing that has taken place so far will not be affected.

The data is retained exclusively for the purpose of transmitting and responding to requests. The mandatory data is used for assigning and responding to your requests. You can also choose not to provide us with your personal data using such a contact form. Alternatively, you can contact us at the email address provided in this Notice.

In addition to the data mentioned above, Typeform collects the following personal data with the help of cookies: Information about your device (IP address, device information, operating system, browser settings). Furthermore, usage data is collected, such as the date and time when you used the contact form. Further information can be found at: https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data.

For further information regarding objection and deletion options in relation to Typeform, please refer to: https://admin.typeform.com/to/dwk6gt.

6 Online Information Events AND STUDENT COUNSELING

​6.1 Study counseling

If you request study counselling, we process the following categories of personal data: Name, contact data, time and date of contact, various counseling data, possibly data on your origin, health or income. The purpose of the processing is to provide advice to prospective students about studying and university entrance qualifications. The processing is carried out pursuant to Art. 6 par. 1 (b) GDPR for the conclusion of a study contract. With regard to special categories of personal data, processing is based on your express consent pursuant to Art. 9 par. 2 (a) GDPR. Access to your personal data is granted to employees of the IU who are active in the area of student advising. We process your personal data for the period of the study counseling.

6.2 Appointment booking for study counseling

For the purpose of simplified appointment booking for student advising, we use the service Calendly, offered by Calendly, LLC, 88 N Avondale Road #603, Avondale Estates, GA 30002, USA ("Calendly"). When using the service, in addition to the time slots and information you provide in the appointment booking, we process your display name, email address, preferred language, and date, time of use. The legal basis for the processing of your personal data is your consent pursuant to Art. 6 par. 1 (a) GDPR. We would like to provide you with a user-friendly and efficient appointment booking option and require your consent for this, as your data will be transferred to the USA; the USA has a lower level of data protection compared to Europe and there may not be sufficient legal protection against data access by government agencies. The connection to Calendly is only established if you use the offered booking function, which you are not obliged to do. Alternatively, you can choose other contact options to make an appointment. Access to your data is granted to IU employees who provide student advising and activate slots in Calendly. IU has entered into an order processing contract with Calendly. Calendly is certified under the Data Privacy Framework.

6.3 General information events

If you register to participate in an online information event via our Website, then we process your first and last name and your email address in addition to the data mentioned under Server Log Files. We process your data on the basis of Art. 6(1)(b) GDPR in order to send you an invitation to our online information event. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. You will receive information on the processing of your data by the provider of the video conferencing tool when you receive the invitation.

We will store information about your completed registration in your browser and, by using a cookie, information in the fields you populated subject to your consent, so that you can use the pre-filled fields when you register again and you will be shown for which event you are already registered. We process your data on basis of Art. 6 (1) (a) GDPR. You can withdraw your consent for the local storage in the browser and the processing of your data for the purpose of pre-filling the fields separately at any time with future effect. You can declare your withdrawal by using the cookie consent tool and declare it by emailing datenschutz@iu.org.

6.4 Information events for practice partner search

If you register via our website to participate in an information event for practice partner search, we process your first and last name and your e-mail address, in addition to the data mentioned under the server log files. We process your data with your consent on the basis of Art. 6 par. 1 a) GDPR in order to send you an invitation to our info event. The event is booked via MS Bookings; please see data protection information in the Application/Schedule Booking section. The processing of your data to conduct the event and send you the results is based on Art. 6 par. 1 a) GDPR due to our legitimate interest in facilitating your search for practice partners. The lists of participants generated on the occasion of the event for sending the results are deleted 24 hours after the event. The list compiled for you is visible to the responsible study advisor for the duration of the advisory process.

7 Newsletter

​​With your consent, you can subscribe to our newsletter, which we use to inform you about current interesting offers concerning 1) our degree programs, discount campaigns on tuition fees and study-related information events 2) information about entrepreneurship 3) alumni, discount campaigns for alumni and other activities for our graduates 4) event and publication information from members of the research network. We will personalize such information, based on your interests as well as your previous use of our website and our offers, provided that you have given us separate consent to do so via the cookie selection.  You can withdraw your consent to receive the newsletter at any time. You can withdraw your consent by clicking on the link located at the end of the newsletter or by sending an email to loeschung@iu.org.

If you register to receive our newsletter, we use the so-called double opt-in procedure: after receiving your registration, we send an email to the specified email address. In this email we ask you to confirm that you wish to receive the newsletter. If you confirm your registration to our newsletter, we store your email address, IP address and the time of registration and confirmation. The purpose of this processing is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data. The legal basis for this processing is your consent in accordance with Art. 6(1)(a) GDPR. In order to send you our newsletters, we use the services of external service providers, some of which are located outside the EU. In such situations, we conclude data processing agreements that incorporate EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. We store your consent for three years after the end of the year in which you withdraw your consent.

8 Free Info Brochure, Financing Check, CV-Generator

8.1 Free Info Brochure, Financing Check

If you request information material to be sent to you electronically, we will process your title, first and last name, email address, telephone number (if applicable) and details of the subject of the requested information in order to provide you with the information material. The legal basis for this processing is Art. 6(1)(b) GDPR. If we do not reach you by email and you have provided us with your consent in accordance with Art. 6(1)(a) GDPR, we will contact you by telephone. Access to your data will be granted to those employees who are responsible for managing and processing such requests as part of their job.

We provide a financing check on our website which you may use to obtain information tailored to your personal situation on financing options for your studies. With your consent, we will save your entries and send you a code by email, which you can use to access your data again later. Legal basis for data processing is your consent in accordance with Art. 6 par. 1 a) GDPR, which you can revoke at any time with effect for the future by contacting datenschutz@iu.org.

IU employees who are responsible for supporting prospective students will have access to your personal data. We store your data, which we have received in connection with your financial check, in the software of our service provider Salesforce, Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England. In exceptional cases, Salesforce employees, possibly also from the U.S., may have access to your personal data. IU has entered into a data processing agreement with Salesforce. Salesforce Inc. is certified in accordance with the Data Privacy Framework.

8.2 CV-Generator

If you use our CV generator, we will process your first name and surname, your e-mail address and, if applicable, your telephone number as part of the creation process. Within the CV generator, all information is optional; if you decide to enter it, we will process your title, first and last name, date of birth, contact details such as address, telephone number and e-mail address, information on previous school education, previous courses of study, professional career, other qualifications such as software skills, soft skills, awards, hobbies and interests. The legal basis for this processing is Art. 6 par. 1 b) GDPR. If we are not able to contact you by email and you have given us your consent to do so in accordance with Art. 6 par. 1 a) GDPR, we will contact you by phone. Those employees who are entrusted with the administration and processing of such requests as part of their work will have access to your data. If you have given us your consent to store the form data, you can resume the creation of your CV within seven days.

9 Enrollment for Studies

9.1 Enrollment via Website
If you register for a course of study via the website, we process your name, date of birth, nationality, address, contact information (including, for example, your phone number), details of your previous education in the form of certificates, letters of recommendation, and a resume, your desired field of study, and payment details such as account information, as well as data for the preparation and execution of the education contract concluded with you.

Please note that when uploading a copy of your official ID document, you must redact all fields except your last name, first name, date of birth and nationality as well as the photo and the validity of your ID.

We require additional information to check whether you are eligible to study and whether there are any obstacles to enrolment, e.g. parallel enrolment at another university in the same degree program. Any further information you provide, e.g. in a CV, which is not mandatory for checking your university entrance qualification, is voluntary. However, if you, for example, wish to have ECTS points transferred and credited it is advantageous to provide information on previous stages in your education. We will process the additional information in your CV in order to draw your attention to the possibility of crediting previous educational achievements as part of your studies and to advise you on your choice of studies. If you have obtained your university entrance qualification through a high school diploma (German Abitur), we do not necessarily need information on your professional experience. If you have completed vocational training or a course of study in a subject that has no connection or overlap with the desired course of study, we do not require any information in this respect either. However, please bear in mind that our academic advisors have specialized knowledge regarding possible credits that you may not consider but could nevertheless be beneficial to you.

We process the data required for the examination of the university entrance qualification on the basis of Art. 6  (1)(c) GDPR in conjunction with sec. 70 par. 1 Thuringian Higher Education Act and the General Admission and Enrolment Regulations of the IU (AZE). We process information that is also required for the conclusion of the study contract, e.g. your bank account details, in order to prepare the conclusion and execution of the study contract in accordance with Art. 6 (1)(b) GDPR. We process any further voluntary information you provide for the purpose of receiving advice on the basis of your consent in accordance with Art. 6 (1)(a) GDPR. You can withdraw your consent to the processing of voluntary information at any time with future effect. Please use the IU contact channels mentioned at the beginning. 

If you decide to cache your online application and complete it at a later date, we will send you a link to the storage location to your email address where we will retain the incomplete application for you for 30 days to access for completion. If you wish to receive a study contract by postal mail, we will use your data to summarize the information you have provided so far in a draft and send it to you by postal mail.

If you fill out the online application for recognition/credit for previous achievements via the Website, we collect your contact data, including name and postal address, email address, your telephone number, desired course of study, information on your previous education and your previous professional career, information on other qualifications, evaluations, training and work references.

The legal basis in this regard is Art. 6(1)(b) GDPR. You will receive detailed information on the processing of your personal data during the registration and recognition process. Access to your personal data is granted to those employees who are responsible for supporting applicants in the Enrollment Office or the Admissions Office of IU.

We process the phone number you provide for conducting multi-factor authentication as part of your logins to our systems. This is to ensure adequate security measures are in place according to the current state of technology, aimed at preventing unauthorized access to our systems, your user accounts with us, and ultimately your data. As part of multi-factor authentication, you may receive a code via SMS to your phone number when logging into our system, which you can then enter in the login area to verify that it is a legitimate access request. The processing is carried out pursuant to Art. 6(1)(f) GDPR to safeguard our legitimate interest in the secure operation of our systems. We utilize the services of external IT providers to maintain the multi-factor authentication system. Where these providers have access to personal data, we have made the necessary agreements to protect your personal data. If data is transferred to so-called third countries, we have concluded the EU Standard Contractual Clauses (you can retrieve a copy at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en) or the EU-US Data Privacy Framework applies (https://www.dataprivacyframework.gov/s/program-overview).

Personal data that you provide in the course of enrolling for a course of study will be retained for the duration of your studies and in accordance with statutory retention periods (for a period of six to ten years under the German Fiscal Code and the German Commercial Code). Data collected in the context of an application for possible recognition/credit of prior achievements will be stored for twelve months from the date of submission of the application. If matriculation does not take place during this period, the application together with all documents will be deleted.

For further information, please refer to the privacy notice for students, which you will receive with the documents to enroll in a degree program.

9.2 Reminders

We process your phone number to inform you about circumstances that may lead to an early termination of the contract. We do this, among other things, to fulfill our transparency obligations and to avoid unnecessary disadvantages for you. The legal basis for the processing is Art. 6(1)(c) GDPR. For this purpose, we send messages via WhatsApp and use the services of the processor Twilio Inc, 101 Spear St FL 5, San Francisco, CA 94105, USA. Twilio Inc. is certified under the Data Privacy Framework. For more information on data processing by Twilio Inc., please visit https://www.twilio.com/en-us/legal/privacy.

10 Applicant Portal for Students

​​10.1 Registration with the Applicant Portal

As part of the online application for admission, you will be able to use the applicant portal (hereinafter collectively referred to as the „Applicant Portal“) and its functionalities, such as uploading your data and documents and describing your knowledge and skills. If you use other functionalities, such as if you want to participate in an information session or an applicant interview, then these activities take place outside the Applicant Portal. You will receive information on the data processing that takes place in this case separately.

If you register for the Applicant Portal, we use the so-called double opt-in procedure, i.e. you will receive an email with which you must confirm that you are the email address owner. Please note that this is purely a precautionary measure and that sending a confirmation email to you has no legal effect. Once you have provided the appropriate confirmation, you will be granted access to our Applicant Portal. The legal basis for this processing is the sending of your application to us in accordance with Art. 6(1)(b) GDPR.

In order to make the onboarding process as easy as possible for you, in particular to provide you with a good overview of the status of your application or missing documents at any time, to facilitate the selection of a practice partners, to request help or to enable you to change your information, we use the onboarding tool of Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits"). Please find detailed information in section “Usage of Product Fruits in our portals”.

Only those employees of IU who are responsible for the admission will have access to your personal data. We store your personal data in our CRM system from Salesforce, Floor 26, Salesforce Tower, 110 Bishopsgate EC2N 4AY London, United Kingdom, from which Product Fruits creates the user journeys described above. In this respect, it may occasionally happen that employees of the service provider gain access to your data, e.g. if errors in the system need to be corrected. For this purpose, we have concluded data processing agreements with the service providers in accordance with Art. 28 GDPR; the EU standard contractual clauses are incorporated in the agreement with Salesforce. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

We process your personal data for as long as you save your profile in our Applicant Portal. If we find that you have registered for the Applicant Portal but have not logged in for more than 12 months, we will send you an email informing you that we will delete your data after 4 weeks if you do not log in again.

10.2 Uploading your documents

If you upload your application documents to the Applicant Portal, then we also process the following categories of data about you in addition to the data mentioned in the Server Log Files:

• Your first and last name,

• Your contact information, such as address, telephone number, email address,

• Your curriculum vitae,

• An application photograph, if you include one,

• Your certificates,

• Your cover letter,

• In particular, proof of internships, volunteer work, portfolios with work samples, proof of language skills

We process the aforementioned data as part of your application, specifically, to determine whether you meet the requirements and we can offer you the desired course of study. The legal basis for this processing is Art. 6(1)(b) GDPR, i.e. the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract.

Only those employees of IU who are responsible for admissions will receive access to your personal data. Your data will be processed in the Federal Republic of Germany. We also store your personal data in our CRM system. In this respect, it is possible that employees of the service provider may occasionally receive access to your data, for example, if errors in the system need to be corrected. In such a case, your data may also be processed outside the EU. For this purpose, we have concluded a data processing agreement with the service provider in accordance with Art. 28 GDPR, which incorporates the EU standard contractual clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

In addition, we also use various other service providers that assist us with our Applicant Portal. In this context, it is possible that employees of these service providers, who host our website, for example, may receive access to your personal data as part of their job function. If our IT service providers process personal data, we have entered into a data processing agreement with them in accordance with Art. 28 GDPR. Furthermore, employees of service providers providing consulting services, such as law firms and/or tax advisors, who are legally bound to secrecy, may receive access to your personal data.

We process your data for the duration of the application process. If you are accepted as a student, then we process the documents that you have submitted for the duration of your studies and possibly beyond. You will then receive more detailed information in the privacy notice for students. If we have not accepted you as a student, we will continue to process documents containing your personal data for a period of six (6) months from the date of sending the rejection letter and will delete your data thereafter, unless you have given us your consent that you want us to keep your documents for a period of one (1) year from the date of receipt of your consent; in such a case, we will not delete your data until the end of the year or within two (2) weeks from receipt of your withdrawal of consent.

10.3 Registering for an information session

If you click on the “Information Session” field, you will be taken to another website via a hyperlink. The data processing that takes place in this regard is governed by the privacy notice that you can view on the website.

If you register for an information session, we process the following data in order to hold an information session with you:

• Your first and last name

• Your telephone number/your email address and

• The data described in the context of the Server Log Files

We process the aforementioned data in order to invite you to an information session. The legal basis for this processing is Art. 6(1)(b) GDPR.

Only those employees of IU who are responsible for conducting the information sessions will receive access to your personal data. If we hold an information session online, we will send you a link to the provider’s privacy notice together with the participation link.

Your personal data will be processed, stored and deleted as described in 10.2.

10.4 Participating in an interview

If you have uploaded your documents completely, we may invite you to an interview. In this context, we process the categories of data described in section I. In addition, we will then also process

• Your email address,

• Your telephone number,

• The appointment scheduled with you and

• The data described in the context of the Server Log Files.

We process your data in order to conduct an interview with you to determine whether we can accept you as a student. The legal basis for this processing is Art. 6(1)(b) GDPR, i.e. the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract.

Only those employees of IU who are responsible for conducting the interview, who supervise applications for admission, and who participate in such an interview will receive access to your personal data. If we hold the interview online, we will send you a link to the provider’s privacy notice together with the link to participate.

Your personal data will be processed, stored and deleted as described in 10.2.

10.5 Concluding a contract and matriculation

If we are able to accept you as a student, we will process the data described in the Server Log Files and the data mentioned in 10.2 so that you can enter into an educational contract with us and enroll. You will receive information on how we process the personal data of our students together with the educational contract.

10.6 Study Match Quiz

We offer you the opportunity to take the Study Match as part of our Applications Portal. This is a mini online assessment center that can help you find out whether the dual study program is suitable for you as a mixture of theory and practice. Your preferences pertaining to study preferences are asked via free text or multiple choice. We then process your answers entered here, which are considered personal data. We add your answers to your applicant profile in our CRM system. IU staff responsible for academic advice receives access to your answers. The legal basis for this processing is your consent according to Art. 6 para. 1 a) GDPR. We store the data for as long as your applicant or study profile exists. We use Alpha Test (alpha-test GmbH, Dynamostraße 15, 68165 Mannheim, Germany) for the technical provision of Study Match. We have concluded a data processing agreement with Alpha Test in accordance with Art. 28 GDPR. The Study Match quiz is only for your own orientation and decision-making support; it is not considered profiling and automated decision making, as the Study Match quiz does not have any legal effect on you and you can decide for dual studies, for example, despite possible indications to the contrary.

11 IU COMPANY PORTAL - PARTNER PORTAL FOR PRACTICE PARTNERS

The IU Company Portal offers companies and practice partners a platform through which they can find suitable dual students for open positions. You can register your requirements there and receive matches, i.e. applicants (from our B2C portal), as search results based on your information. Furthermore, the company portal contains a news page as well as information about upskilling offers, with which you can keep your students longer in the company.

11.1 Login

In order to use the IU Company Portal, you must log in. You will receive an e-mail from us including an access link, which you can use to assign yourself a password. With these access data you can log in to the IU Company Portal.

To provide the login, we use Auth0, an application of the provider Okta, Inc, 100 1st Street, San Francisco, CA 94105, USA. For more information on data processing by the respective providers, please contact Auth0 at the following link: https://auth0.com/de. Please also read the notice on the setting of cookies by Auth0 on our Consent Management Platform.

As part of the login process, we process the following categories of personal data: First name, last name, gender, ad name, email address and the title of your ad. The legal basis for this processing is Art. 6 par. 1 (b) GDPR, i.e. the processing is necessary for the implementation of (pre-) contractual measures, which are carried out upon your request. The purpose of the processing is to enable the login and the provision of the IU Company Portal.

Access to your personal data is granted to employees of IU who are responsible for the administration of the IU Company Portal, as well as to employees of the respective providers of the applications used for this purpose. Your personal data may be transferred to or accessed from third countries. We have concluded a data processing agreement with Okta, which includes EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. For more information on safeguarding international data transfer, please see the section "Transfer to Third Countries". Information on data processing by the respective application providers can be found in the section for the respective service. We process your personal data for the duration of the existence of your account.

11.2 Using the company profile

If you have registered a company profile, you can store information about your company. In this context, we process personal data of the managing directors and specified e-mail contacts. If the company name of your company is the clear name of a natural person, we also process this. In addition, we process payment data provided by you and, in this context, personal data, such as the name of the account holder, if this is a natural person.

The legal basis for this data processing is Art. 6 par. 1 (b) GDPR, i.e. the processing is necessary for the implementation of contractual measures, namely, the provision of the company portal.

If you create user accounts in our company portal that enable your employees to access the company portal, then we process title, first and last name, e-mail address, password, department, position and telephone number. The legal basis for this data processing is Art. 6 par. 1 (f) GDPR, our legitimate interest in offering a user-friendly and efficient company portal.

If you register for notifications, such as our newsletter, then the legal basis for this processing is Art. 6 par. 1 (a) GDPR, your consent, which you can revoke at any time with effect for the future.

Only those employees of IU who are responsible for the support of the company portal will have access to your personal data. Your data is stored in a CRM solution of the provider Salesforce, located at Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England. We have entered into a data processing agreement with Salesforce.

We process your personal data that is required for the provision of your account or that we additionally receive with your consent for the time of the existence of the account and a period of one month after deletion of the account. We delete usage data within seven days. We process payment data in accordance with commercial and tax regulations for a period of six or ten years after the booking has been made.

If a contract is concluded between your company and a student, we process the personal data required to form the contract, such as the company, payment and user data together with information on the practice location, vacation entitlement, expense allowance and assumption of the costs of a semester ticket. The legal basis for this processing is Art. 6 par. 1 (f) GDPR, our legitimate interest in offering a user-friendly and efficient company portal.

If you would like to contact us, we will process your name, email address and your request; if you contact us via WhatsApp, we will process your telephone number instead of your email address. If you send us attachments, then we also process these. The legal basis for this data processing is Art. 6 par. 1 (b) GDPR, i.e. the processing is necessary for the implementation of (pre-) contractual measures, which take place upon your request. We store your information for as long as is necessary to process your request and delete it afterwards.

In order to make the application and onboarding process as easy as possible for you, we use the onboarding tool of Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits"). Please find detailed information in section “Usage of Product Fruits in our portals”.

Your personal data will not be processed for automated decision-making and/or profiling.

11.3 Usage of Product Fruits in our portals

In order to make the application and onboarding process as easy as possible for you, we use the onboarding tool of Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits").

Product Fruits createsuser journeys for you by visualizing the personal data you have provided to us as part of the application or onboarding process. In addition, IU employees may access aggregated statistics generated from the user´s activities. However, no reference to an individual person can be made in this process. IU uses these statistics to monitor how many users abandon the application or onboarding process or how long an average application or onboarding process takes.

In order to be able to use Product Fruits, cookies are set in your browser by Product Fruits, provided that you have consented to this within the framework of our Consent Management Platform. The legal basis for the processing is your consent in accordance with Art. 6 para. 1 lit a) GDPR and § 25 TTDSG. You can find more information on this and options for revoking your consent in our cookie settings.

12 General Information on the use of the Alumni PLATFORM

If you register for the alumni platform via the website, we process your name, your email address, your affiliation to a certain department, your chosen password as well as information about your use of the alumni platform to provide the functionalities of the alumni platform, such as a members’ directory, a feed or a search function. The alumni platform is operated by IU Group. The purpose of the processing is to offer you the opportunity to stay in contact with other former students, as well as to be informed about our alumni offers. The legal basis is Art. 6 par. 1 (b) GDPR. If you decide to upload further personal information to your profile, e.g. your photo, this is done on the basis of your consent pursuant to Art. 6 par. 1 (a) GDPR. The same applies if you release certain personal data for access by other participants of the alumni platform.  You can revoke your consent at any time with effect for the future by notifying the contact options mentioned at the beginning. Please note that in order to operate the alumni platform, we use the assistance of an external service provider who processes your data in the USA. For this purpose, we have concluded a data processing agreement with the service provider in accordance with Art. 28 GDPR, which is based on the EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

Personal data that is required for the provision of your account or that you additionally provide with your consent, we process for the time of the existence of the account and a period of one month after deletion of the account. We delete usage data within seven days.  We store your consent for three years after the end of the year in which the revocation takes place.

13 DATA PROCESSING IN THE COURSE OF OUR FIRST EMPLOYEE REFERRAL PROGRAM

If you register with our firstbird employee referral program, we process the following personal data: To create your user profile, we process your name, e-mail address, a password of your choice, employee ID, time zone as well as location and field of activity. You also have the option of uploading a photo of yourself to your profile, which is visible to other firstbird users when you make a recommendation. Should you select in the notification settings that you wish to receive notifications on certain topics at different intervals, we will process your data to generate and deliver the notification in accordance with your selection. If you recommend a job, we process information about the recommended position, the date and time of the recommendation, and information about the selected medium through which the link to the recommended position is shared. If someone applies for an advertised position based on your recommendation, we process the information that you made the corresponding recommendation. In the case of a successful application, we additionally process information about the bonuses that are credited to you, as well as information about the redemption of the bonuses. The legal basis for this processing is a user relationship concluded with you for this purpose regarding participation in firstbird in accordance with Art. 6 (1) (b) GDPR. Your personal data will be processed by us during the activity of your account and deleted thereafter, unless rewards have been credited to you. In this case, we process information about this in firstbird for three years from the end of the year of the last credit. Information about billing of rewards is stored for 10 years in accordance with tax regulations.

Employees of the IU who are entrusted with the management of the firstbird employee referral program have access to your personal data. IU uses various IT service providers, including firstbird GmbH, Gertrude-Fröhlich-Sandner-Str. 2-4, Spaces, Tower 9, 1100 Vienna, Austria, and has concluded a data processing agreement with the service provider in accordance with Art. 28 GDPR.

14 Applications

14.1 Applications for job advertisements and expressions of interest via LinkedIn

If you apply for an advertised job, we process the following categories of personal data, in particular:

• Your name, i.e. first and last name,

• Your address,

• Your telephone number,

• Your email address,

• Information in your curriculum vitae, including

• Education history, highest school-leaving qualification and final grade,

• Information, certificates and final grade relating to your vocational training (at a company or in school) and/or

• Information, certificates and final grade relating to your academic studies,

• Details of previous employers together with information on the line of work,

• Information together with proof of advanced training, continuing education and/or other qualifications,

• Other information you provide, such as hobbies, knowledge of foreign languages, other details regarding special skills, etc.

• Your desired salary,

• Your photograph,

• Your signature,

• Letters of recommendation, if applicable, and

• All data submitted in an application together with other proof and documentation.

If you apply for a job about our website, we use the so-called double opt-in procedure, i.e. you will receive an email with which you must confirm that you are the email address owner. Please note that this is purely a precautionary measure and that sending a confirmation email to you has no legal effect. The legal basis for this processing is the submission of your application to us in accordance with Art. 6(1)(b) GDPR.

If you use the application function via WhatsApp, the legal basis for processing is your consent in accordance with Art. 6 (1) (a) GDPR. You can withdraw your consent at any time with effect for the future. We use PitchYouGmbH, Campusallee 9, D-51379 Leverkusen ("PitchYou"), as a processor for applications via WhatsApp. Communication via WhatsApp is end-to-end encrypted. We use the WhatsApp business interface to communicate with you. Therefore, we do not create a contact list that is transmitted to WhatsApp. If you decide during the communication not to continue, you can cancel the communication at any time and use an alternative communication channel. Your personal data will then be deleted within 24 hours. If you withdraw your application completely by giving the appropriate command, all data previously stored by PitchYou will be deleted. Your data will only be transferred from PitchYou to IU once the application is complete. Application documents of rejected applicants will be deleted after six months at the latest. PitchYou stores your data exclusively on servers in Germany. Only employees of PitchYou and the IU who are responsible for applicant selection or administration have access to your data. Further information on data protection can be found here: https://www.pitchyou.de/datenschutz or https://www.whatsapp.com/legal/privacy-policy-eea.

If we receive your application or your expressed interest in a position via LinkedIn, we will process the data you provide on LinkedIn for application purposes. Your application data, which you upload via our application portal or which we transfer from LinkedIn to our application portal, is hosted by our service provider Workday Inc., 6110 Stoneridge Mall Road, CA 94588 Pleasanton ("Workday") in the EU. However, in exceptional circumstances, Workday employees may have access to your personal information for troubleshooting, support and maintenance purposes. For this reason, we have concluded a data processing contract with Workday. Workday is certified under the Data Privacy Framework.

IU uses various other IT service providers to assist us in providing our career websites that you can use to submit a job application. Employees of such service providers, especially of those who provide the portals we use and through which you have uploaded your application to us, may receive access to your personal data for troubleshooting purposes in individual cases.

We have concluded a data processing agreement with our service providers for this purpose in accordance with Art. 28 GDPR. In this context, it is also possible that employees of the service provider who are responsible for technical support may receive access to your personal data from outside the EU. In this case, we have incorporated the EU standard contractual clauses into the data processing agreement. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. In addition, employees of service providers providing advice, such as law firms, who are legally bound to secrecy, may receive access to your personal data.

If we offer you a permanent position at IU, we will process your personal data as described in the privacy notice for employees. If we are unfortunately unable to consider your application further, we will process your data for a period of six (6) months from the date of sending the rejection letter and delete your data thereafter.

14.2 Data processing during the application procedure

14.2.1 Application videos

As part of the application process, you may be given the opportunity to record an application video. In doing so, we will process the time and date of the recording, your voice and image, and the information contained in the video, such as information from your narration or images in the background. We use the opportunity of the application video to give the people involved in the hiring decision an efficient way to get to know you. The legal basis for this processing is your consent pursuant to Art. 6 (1) a) DSGVO. You can revoke your consent at any time with effect for the future by notifying datenschutz@iu.org.

Only those employees of IU who are responsible for conducting the interview and other persons involved in the hiring decision will have access to your personal data. These are, in particular, our internal recruiters and, if applicable, also the members of an appointment committee. IU cooperates with VidCruiter Inc, 100 Cameron St, Moncton, NB E1C 5Y6, Canada, for the realization of application videos and has entered into a data processing agreement with the service provider in accordance with Art. 28 DSGVO, which is based on the EU Commission's adequacy decision for Canada as of 01/20/2001, C(2001) 4539. as a country with an adequate level of data protection. Your application video and related personal data will be deleted no later than six months after the hiring or rejection decision.

14.2.2 Cognitive tests

As part of the application process, you may further be given the opportunity to take cognitive tests. In the course of cognitive tests, we process the time and date of your participation, as well as your input and interactions during the testing. We use cognitive tests to determine your suitability for the position offered. The legal basis for such processing is your consent pursuant to Art. 6 (1) (a) GDPR. You can revoke your consent at any time with future effect by notifying datenschutz@iu.org.

Only those employees of the IU who are responsible for conducting cognitive tests as part of the application process will have access to your personal data. After evaluation of the tests by these employees, only summary results will be communicated to other parties involved in the further application process. IU uses the assistance of Aon Assessment GmbH, Großer Burstah 18-32, 20457 Hamburg, Germany, for the performance of cognitive tests and has concluded a data processing agreement with the service provider in accordance with Art. 28 DSGVO. The data collected as part of the cognitive tests will be deleted no later than six months after the test has been performed.

14.2.3 Appointment booking

For the purpose of simplified appointment booking for job interviews, we use MS Bookings, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). When using the service, in addition to the information provided by you in the appointment booking, we process your name displayed, email address, preferred language, and date, time of use. The legal basis for the processing of your personal data is Art. 6 (1) (f) GDPR and our legitimate interest in offering a user-friendly and efficient appointment booking option. The connection to MS Bookings is only established if you use the offered booking function, which you are not obligated to do. Alternatively, you can choose other contact options to make an appointment. Access to your data processed via MS Bookings is granted to employees of IU who are entrusted with the selection of job applicants. We delete your data contained in MS Bookings no later than six months after the hiring decision or rejection decision. MS Bookings is part of Office 365, through which the IU has entered into a contract processing agreement with Microsoft. Microsoft is certified under the Data Privacy Framework. For more information on data processing by Microsoft, please visit https://privacy.microsoft.com/de-de/privacystatement.

14.2.4 Talent Pool for Job Applicants

​If you would like your application documents to also be considered for other suitable job vacancies, you can give us your consent in accordance with Art. 6(1)(a) GDPR to include your documents in our talent pool. We will then process your application documents for a period of 24 months. If you would like your application documents to be kept in the talent pool beyond this period, we will ask you for your consent again before the aforementioned period expires. If you do not give us any further consent or if you withdraw your previous consent, we will delete your application documents within two weeks of receiving your withdrawal. We store the proof of a previously given consent for three years. Your consent is voluntary. You can refuse your consent without giving reasons, without fear of any disadvantages. In addition, you can revoke your consent at any time without giving reasons with effect for the future. As part of the talent pool, employees of IU and the companies named in the section "Controller and Data Protection Officer" who wish to fill an open position in their department ("Recruiters") can also access your name and qualifications with your consent, as long as you are registered in the talent pool as an interested party for a position at IU. In addition, our Group companies may provide us with IT services. Employees of these companies may have access to your personal data to the extent necessary to perform their tasks. Furthermore, we use the help of various external service providers to operate our IT infrastructure.

IU uses a software solution of Workday, Inc., 6110 Stoneridge Mall Road, CA 94588 Pleasanton ("Workday"),  to store your application data. Your data is hosted in a data center in the European Union. For information about Workday, see the section below.

14.2.5 Login for Job Applicants

​​If you apply for a job with us, you can create a user profile on our Workday Inc., 6110 Stoneridge Mall Road, CA 94588 Pleasanton, USA ("Workday"), platform. For this purpose, we process your personal data, such as your full name, your self-selected password, your email address, your contact details (such as address and telephone number), together with the information contained in your application - as described above under Applications for Advertised Jobs.

The legal basis for this processing is a user relationship concluded with you in accordance with Art. 6(1)(b) GDPR. We will retain your personal data for the duration of the application process.

If you make use of the "Delete my data" function, your user profile will be deleted early, i.e. your personal data will be completely deleted after one month. If your application process is completed, for whatever reason, your personal data (i.e. your user profile) will be retained by us for a period of six months and then deleted, unless you continue to use your access for other applications.

In order to provide this platform, we have engaged Workday. Your personal data is hosted in a data center located in the European Union. However, in exceptional circumstances, employees of Workday, Inc. may receive access to your personal data for troubleshooting, support and maintenance purposes. For this reason, we have entered into a data processing agreement with Workday. Workday is certified under the Data Privacy Framework.

15 Processing of data in the case of further training purchases

​​If you purchase a training course via our webshop, in addition to the data mentioned in the server log files, we will process your title, name, address, e-mail address, telephone number (if provided), date of birth, location of birth, nationality and further documents that you have uploaded (CV), the training course you have booked, the purchase price and the payment method of your purchase, as well as the time stamp of the purchase, and information in relation to the use of an education voucher, in case the training course is supported by the Federal Labor Agency or the Jobcenter.

If you use the option offered on the website to save your data for the purpose of completing your application at a later date, you will receive an e-mail link from us to complete your data and upload additional documents. We use a hash key in the URL to pre-fill the application form with data already entered by you as part of your expression of interest (title, first name, last name, telephone number, e-mail address). We store the data entered for later completion of the application for 30 days.

IU employees who are entrusted with the supervision of the advanced training course will have access to your personal data. IU uses various IT service providers, such as our Salesforce software solution from the provider Salesforce, headquarters: Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England (“Salesforce”). Your data, which we received in connection with your license purchase, will be saved on our Salesforce platform. In exceptional cases, Salesforce employees may have access to your personal data. IU has concluded a data processing contract with its CRM service provider. Salesforce is certified under the Data Privacy Framework.

IU stores the named personal data for the duration of your advanced training course, in accordance with statutory retention periods according to § 147 Tax Code and § 257 Commercial Code, for a period of six to ten years.

Your payment data will be transmitted by IU to the payment service provider you have selected for processing the payment.

If you decide to pay via Stripe, the payment will be processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. IU will transmit to Stripe the information communicated during the ordering process as well as your name, address, account number, bank code, credit card number, invoice amount, currency and transaction number (if applicable).

The data processing takes place on the basis of Art. 6 (1) (b) GDPR. The data is transmitted solely for the purpose of processing payments; the data will be deleted after it has been delivered, unless our service providers are obliged to store the data for legal reasons themselves. Stripe processes your personal data in accordance with the contract you have concluded with Stripe. You can find more information on Stripe’s data protection policy at: https://stripe.com/de/privacy#translation.

If you decide to pay via PayPal, the payment will be processed via PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. IU will transmit your name, address, email address, telephone and mobile number, and IP address to PayPal. The data processing takes place on the basis of Art. 6 Para. 1 lit. b) GDPR. The legal basis for the data processing is Art. 6 Para. 1 b) GDPR, since the processing of the data is necessary for the payment with PayPal and therefore is required for the fulfilment of the contract. The data is transmitted solely for the purpose of processing payments; the data will be deleted after it has been delivered, unless our service providers are obliged to store the data for legal reasons themselves. PayPal processes your personal data in accordance with the contract you have concluded with PayPal. PayPal may also pass on your data to third parties if this is necessary in order to fulfil contractual obligations, or if the data is required to be processed on their behalf by a service provider. You can find PayPal's privacy policy at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.

16 Processing of data in the case of an Adobe licence purchase

​​If you purchase an Adobe license via our webshop, we will process your name, address, e-mail address, telephone number (if provided), the training course you have booked, the purchase price and the payment method of your purchase, in addition to the data specified in the server log files and the timestamp of the purchase.

IU employees who are entrusted with maintaining the Adobe licenses will have access to your personal data. IU uses various IT service providers, such as Shopify, the hosting provider of our webshop. We save your data, which we have received in connection with your license purchase, in the shop management section of the Shopify shop. Your information is stored at Shopify International Ltd., headquarters: Victoria Buildings, 2nd floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland (“Shopify”). In exceptional cases, Shopify employees may have access to your personal data. Shopify processes your personal data through its Irish subsidiary, Shopify International Ltd. Your data will also be sent to other Shopify locations and service providers, which may be located in other regions, including Canada (where Shopify’s main headquarters are based) and the United States. The European Commission has established a data protection level for Canada that is equivalent to that of the EU. If Shopify will send your personal data to a country outside of Canada, Shopify will protect it in accordance with the EU standard regulations regarding data protection.
IU has concluded a data processing contract with Shopify, which includes EU standard contractual clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

IU stores the named personal data for the duration of your advanced training course, in accordance with statutory retention periods according to § 147 Tax Code and § 257 Commercial Code, for a period of six to ten years.

Your payment data will be transmitted to the payment service provider you have selected for processing the payment.

If you decide to pay via PayPal, the payment will be processed via PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. IU will transmit your name, address, email address, telephone and mobile number, and IP address to PayPal. The data processing takes place on the basis of Art. 6 Para. 1 lit. b) GDPR. The legal basis for the data processing is Art. 6 Para. 1 b) GDPR, since the processing of the data is necessary for the payment with PayPal and therefore is required for the fulfilment of the contract. The data is transmitted solely for the purpose of processing payments; the data will be deleted after it has been delivered, unless our service providers are obliged to store the data for legal reasons themselves. PayPal processes your personal data in accordance with the contract you have concluded with PayPal. PayPal may also pass on your data to third parties if this is necessary in order to fulfil contractual obligations, or if the data is required to be processed on their behalf by a service provider. You can find PayPal's privacy policy at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.

17 Use of Payment-Provider

​We process your payment information for the purpose of payment processing, e.g. when you purchase or use a service and/or a license.

Your payment data will be transmitted by IU to the payment service provider you have selected for processing the payment. You can find more Information below.

17.1 PayPal

If you decide to pay via PayPal, the payment will be processed via PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. IU will transmit your name, address, email address, telephone and mobile number, and IP address to PayPal. The data processing takes place on the basis of Art. 6 Para. 1 lit. b) GDPR. The legal basis for the data processing is Art. 6 Para. 1 b) GDPR, since the processing of the data is necessary for the payment with PayPal and therefore is required for the fulfilment of the contract. The data is transmitted solely for the purpose of processing payments; the data will be deleted after it has been delivered, unless our service providers are obliged to store the data for legal reasons themselves.

PayPal processes your personal data in accordance with the contract you have concluded with PayPal. PayPal may also pass on your data to third parties if this is necessary in order to fulfil contractual obligations, or if the data is required to be processed on their behalf by a service provider. You can find PayPal's privacy policy at: https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.

17.2 Stripe

​If you decide to pay via Stripe, the payment will be processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. IU will transmit to Stripe the information communicated during the ordering process as well as your name, address, account number, bank code, credit card number, invoice amount, currency and transaction number (if applicable).

The data processing takes place on the basis of Art. 6 Para. 1 lit. b) GDPR. The data is transmitted solely for the purpose of processing payments; the data will be deleted after it has been delivered, unless our service providers are obliged to store the data for legal reasons themselves. Stripe processes your personal data in accordance with the contract you have concluded with Stripe. You can find more information on Stripe’s data protection policy at: https://stripe.com/de/privacy#translation.

17.3 SEPA direct debit

If you wish to make payments by SEPA direct debit, we will process the data categories requested on the direct debit collection form (surname, first name, address, name and registered office of your credit institution, IBAN, etc.) for the purpose of collecting the debt. Legal basis for processing is your consent in accordance with Art. 6 (1) a) GDPR. Once the SEPA mandate has been issued, we will forward the data you have provided to our house bank for the debiting of the selected direct debit receivables. Access to your personal data in connection with the direct debit procedure is granted to employees who are entrusted with payment processing. We also use the services of external IT service companies. We process your personal data within the EU, unless your account-holding entity is located outside the EU. Your data used in connection with the direct debit procedure will be stored for up to 10 years in order to fulfill legal retention obligations in accordance with the German Fiscal Code. If you revoke your consent to the use of the data prior to debiting, we will delete the data after receiving your consent.

17.4 Shopify Payments

​If you decide to pay via Shopify Payments, the payment will be processed by Shopify Payments, 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered via the payment service provider Shopify Payments, the payment processing is carried out by the technical service provider Stripe Payments Europe Ltd, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on the information you provided during the ordering process, together with information about your order (name, address, account number, bank code, credit card number if applicable, invoice amount, currency and transaction number) in accordance with Art. 6 (1) lit. b DSGVO. The data transfer takes place solely for the purpose of payment processing; the data is deleted again after delivery, insofar as our service providers are not themselves obliged to store the data for legal reasons. You can find more information on the data protection of Shopify Payments at the following Internet address: https://www.shopify.de/legal/datenschutz.

Data protection information on Stripe Payments Europe Ltd. can be found here: https://stripe.com/de/privacy#translation.

18 Use of our Blog

​Different topics relating to IU are published on our blog. If you participate in a discussion or publish a contribution yourself, we process the data described in the Server Log Files as well as your name and photograph in order to introduce you. The legal basis for this processing is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. We will then delete your blog post within two weeks of receiving your withdrawal. Please bear in mind that posts and your photograph may be stored locally on blog readers’ devices and we have no way of deleting any locally stored data. We recommend that you use a pseudonym instead of your real name. Please keep in mind that your posts are visible to everyone worldwide. We reserve the right to delete contributions if third parties object that they are illegal. Our employees who maintain the Website will receive access to your personal data.

19 BRING A FRIEND

Through our site, you may recruit friends to study at IU, and receive rewards for doing so. For this purpose, we process your name and email address, as well as the data entered by your friend. You can create a personalized link through our website and send it to your friend. This e-mail contains an affiliate link which contains a pseudonymized referral code in the URL. If your friend clicks on the link, he or she will be taken to a website form for sending information material. The form is used to query whether your friend was recruited by you.

Alternatively, with your prior consent, you may receive an email from us with information about Bring-a-Friend and tell your acquaintances about IU. When expressing interest via our website forms, people recruited by you have the opportunity to indicate their recommendation by you (i.e. your first name, last name and email address). IU will then check whether the recommendation is valid and contact you by email.

The processing is carried out in accordance with Art. 6 par. 1 f) GDPR to pursue our legitimate interest in attracting new customers. The purpose of the processing is to reward customer acquisition. Access to your personal data is granted to employees of IU who are responsible for the customer acquisition program. We process your personal data for the period of time determined by the IU with regard to the performance of the task. We base this on the retention obligations under commercial and tax law.

20 Web Analysis Services

​Our website uses analysis services in order to collect information about our website, provided you have consented to the setting of the corresponding cookies. The data obtained with the help of these analysis services, such as the location of the visitors or their length of stay on our website, gives us information about visitor behaviour on our website. With the help of this data, we can not only eliminate website issues, but also improve the efficiency of our website. Further information on the analysis services used on our website can be found below. For information on the processing of personal data by the cookies set for this purpose, such as the storage duration of the cookies, please refer to our cookie settings.

20.1 Google Analytics and Google Signals

​We use Google Analytics to get an overview of the behaviour of website visitors, and gain insights regarding our digital marketing efforts. Google Analytics allows us to collect and evaluate the data specifically relevant to IU, for example how far down a webpage was scrolled, which button was clicked, etc. Google Analytics also helps us, for example, understand user demographic characteristics such as age, gender and interests, geographic characteristics such as language and location, as well as technical characteristics such as device type, browser and operating system, search history, YouTube history as well as data from Google partner sites.

With the help of this data we can not only optimise our website, but can also recognise how the respective user sessions ended (e.g. simple website visit, request for information material, application for studies). Google Analytics also helps us recognise which webpage a user is accessing and via which channel the users come to our website from (e.g. via a paid or unpaid ad, a Google search, a Facebook post or direct access to the website). With the help of this information, IU can identify which marketing channels are working and which are not. Google Analytics also allows us to recognise user paths, i.e. where users are moving on our website, whether they are going back to the start page and how many users access our website. With the help of this information, we can, for example, recognise whether the jumping off of a large number of users is due to a technical defect in the website. The above data gives us a good overview of our website and how it is used. Even if we collect user data, we cannot draw any conclusions about your identity from this data, as we receive reports from Google Analytics that are based on aggregated data sets.

This also applies to data collected through our contact forms (for instance, when requesting informational material, subscribing to the newsletter, registering for online informational events, participating in info sessions, and using application forms), which are used by Google Analytics in hashed form to model website usage. The processed data, such as email addresses, telephone numbers, names, and address data, are hashed using SHA256 prior to transmission. The matching of these hash values with Google accounts is conducted exclusively by Google.

Since we have also activated the Google Signals service offered by Google, i.e. so-called cross-device tracking, your aforementioned data is analyzed across devices and processed for personalizing ads. Google can thus recognize whether you visit our website first via a smartphone and later via a laptop. We ourselves only receive reports with anonymous data from which we can recognize patterns in user behavior. Google Signals is active if you have a Google account and are logged into it when you visit our website. Furthermore, you must have agreed to "personalized advertising" with Google. If you do not want cross-device tracking, you must deactivate "personalized advertising" in your Google account. Google Signals allows us to launch cross-device remarketing campaigns. This means that we also show you our advertising on third-party websites. You may access your data or delete them at Google in “My Activity”. Google LLC is certified under the Data Privacy Framework.

Additional information on Google Analytics plus the Google data privacy policy is available here. The contact information for GDPR claims (e. g. right to erasure) against the Google Ireland Limited is also available there.

Information on the provider, the cookies set, the legal basis for cookie collection, international data transfers and storage times of the cookies can be found in our cookie settings.

20.2 Mouseflow

​We use Mouseflow to analyse user behaviour on our website, provided you have consented to the setting of the corresponding cookies. Mouseflow observes website users, records session videos and uses these videos to show how users behave on the website (e.g. how far down they scroll). Mouseflow does not collect any clear data for this purpose (e.g. if you enter data in a contact form, Mouseflow does not collect this data because the fields on the contact form are hidden from it). Using Mouseflow, we can also create what is known as heat maps for website use. This is summarised data on all visitors that helps us evaluate scroll, click and mouse behaviour. Mouseflow also shows us exactly at which point in a form users have stopped filling out the form. This user data analysis gives us insights into the use of our website without being able to draw any conclusions about your identity, as we receive reports from Mouseflow based on aggregated data sets. Mouseflow is certified under the Data Privacy Framework.

Information on the provider, the cookies set, the legal basis for cookie collection, international data transfers and storage times of the cookies can be found in our cookie settings.

20.3 Contentsquare

We use ContentSquare to analyze usage behavior on our website, provided you have consented to the setting of corresponding cookies. Contentsquare collects interaction data of your visit to our website (such as duration of visit, clicks or scrolling). By means of this data, which we process in pseudonymous form, we gain insight into the way our website is used and can base measures for optimizing user-friendliness or develop marketing measures on this. Contentsquare is certified under the Data Privacy Framework.

Information on the provider, the cookies set, the legal basis, international data transfers and storage times of the cookies can be found in our cookie settings.

20.4 Amplitude

To improve the quality and performance of our services, we use Amplitude, an analytics service provided by Amplitude Inc. ("Amplitude"), located at 201 3rd Street, Suite 200, San Francisco, CA 94103, USA. Amplitude uses cookies and similar technologies to collect and analyze data about the use of our website. This data may include information about the device used to access the website, such as IP address, browser type, operating system, as well as interactions with the website. This information is anonymized and aggregated to identify trends and improve user experience.

By giving your consent, you agree that we may send data about your interactions to Amplitude for analytical purposes. For more information on how Amplitude collects and uses data, as well as your rights regarding your data, please refer to Amplitude's privacy policy at https://amplitude.com/privacy. The legal basis for this data processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

Where Amplitude is used within the scope of technically necessary cookies, only anonymized and/or aggregated data is processed. Further information about Amplitude, the cookies used, the legal basis, international data transfers, and cookie storage times can be found here.

IU has also concluded a data processing agreement with Amplitude Inc., which incorporates the EU Standard Contractual Clauses. You can request the main content of the agreement from us at datenschutz@iu.org. Amplitude is also certified under the Data Privacy Framework, for which you can find more information here: https://www.dataprivacyframework.gov/s/program-overview.  

21 Google Tag Manager

​​This website uses Google Tag Manager („GTM”), a service provided by Google Ireland Ltd. („Google”), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Through the use of GTM, tags such as code snippets or pixels are used on our own Website by means of a so-called container, which inserts a kind of placeholder into the source code and in which the tools that are to be used are stored without IU having to interfere with the source code of our Website. Using GTM, tools can be used on our own Website without having to include each of them in the source code. Instead, only the code of GTM has to be included, and then GTM can be used as a central place to launch or disable the desired tools.

GTM works on the Website when a defined user behavior triggers a tag (i.e. a pixel tag, web beacon, or html code) for the tool. GTM collects the relevant data for the built-in tool and forwards it to the tool. Information about the tools used on our Website that are loaded via GTM can be found here . In this context, not only are the data categories described for the respective tools transferred to the respective tool providers; Google Ireland Ltd. also receives information about your usage behavior on our Website. Since a large number of the tool providers are located in countries outside the EU, please refer to the description of the respective tools if you would like to receive information on the transfer mechanisms agreed with IU. IU has also entered into a data processing agreement with Google Ireland Ltd. The main content of this agreement is available for review here: https://policies.google.com/privacy/frameworks?hl=en. Google LLC is certified under the Data Privacy Framework.

IU uses GTM to deploy not only statistical tools but also marketing tools. Accordingly, GTM is a statistics and marketing tool, and the use of GTM is based on your consent in accordance with Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future by sending an email to datenschutz@iu.org.

22 Customer List Matching

We use tools to match customer lists with various advertising providers in order to more specifically target customers who may have an interest in our products. For this purpose, we import a list with names, email addresses, date of birth, gender and, if applicable, address data of our customers into our own advertising account that we have created with an advertising provider, e.g. Facebook,  and hash it, i.e. we generate a shorter, numeric value or key with a fixed length. The advertising provider matches this list in the hashed form with its own database and, based on this, selects customers to whom our ads are displayed when they use the advertising provider's products, such as a search engine, a social media platform, a streaming platform or a communication service. In case of a match of customer data, they are added to our account as successfully matched customers.

The legal basis for processing is your consent in accordance with Art. 6 para. 1 a) GDPR. Your personal data in connection with the use of customer list matching with advertising providers will be stored by the respective provider for the duration of the matching of the customer list and is then deleted. IU will use the data for the duration of your consent. At IU, only employees of IU who are responsible for the relevant area have access to your personal data. We currently use the following services:

Google Customer Match: Your personal data will be transferred to Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland; Alphabet Inc. and Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. To the extent that your personal data is transferred to Google in the USA, this is done on the basis of an agreement that IU has concluded with Google . You can view the main content of the agreement at https://policies.google.com/privacy/frameworks?hl=de. Google LLC is certified under the Data Privacy Framework.For further information, please visit https://support.google.com/adwordspolicy/answer/6299717?hl=de. Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/. You can edit your  personal data and privacy settings under Google "My Account": https://myaccount.google.com/intro?hl=de.

Facebook Custom Audience: Your personal data will be transferred to Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland. Insofar as your personal data is transferred to Meta, Inc., 1 Hacker Way, Menlo Park, CA 94025, in the USA, this is done on the basis of an agreement that IU has concluded for this purpose with Meta or Meta within the group of companiesYou can view the main content of the agreement at https://www.facebook.com/legal/terms/dataprocessing. Meta is certified under the Data Privacy Framework. Further information is available at https://www.facebook.com/legal/terms/customaudience

Microsoft Customer Match: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. To the extent that your personal data is transferred to the USA, this is done on the basis of an agreement that IU has concluded with Microsoft. You can view the main content of the agreement at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?year=2021. Microsoft is certified under the Data Privacy Framework. Further information is available at https://privacy.microsoft.com/de-de/privacystatement

23 Social Media

For the purpose of increasing our reach, we maintain social media online presences on Facebook, Instagram, LinkedIn and YouTube. If you click on a link embedded in our website, you will be redirected to the respective page: Facebook: https://www.facebook.com, Instagram: https://www.instagram.com, LinkedIn: https://de.linkedin.com, YouTube: www.youtube.com. Plugins of these social networks are integrated on our website. When you visit our website, a direct connection between your browser and the server of the social network is established via the plugins. The social network thereby receives the information that you have visited this website with your IP address. If you are logged into your account with the social network, the social network can assign the visit to this website to your user account. Details on data collection (purpose, scope, further processing, use) as well as your rights and setting options can be found in the privacy policy of the social network. The deletion of your personal data by the social network takes place as described in the respective privacy policy. If there is joint responsibility with Instagram or Facebook, the contract on joint responsibility applies. You can find the contract at https://de-de.facebook.com/legal/terms/page_controller_addendum. For more information on the respective responsibilities, please refer to the Facebook Page Insights Supplement (https://de-de.facebook.com/legal/terms/page_controller_addendum). The legal basis for the processing of the data is Art. 6 para. 1 f) GDPR. Our legitimate interest in this respect is to increase the reach of our online presence on the social media channels. The purpose of the processing is to increase our presence on the Internet. Access to the data is granted to employees of IU who are active in the support of the social media channels and, if applicable, to employees of the respective provider. Your personal data is transferred to the companies listed below in the USA or can be accessed from there. For more information on safeguarding the international transfer of data, please refer to the section "Transfers of personal data to third countries". Information on data processing can be found at: LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) - Privacy Policy https://www.linkedin.com/legal/privacy-policy, Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) - Privacy Policy/Opt-Out: http://instagram.com/about/legal/privacy. Facebook (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) - Privacy Policy (Opt-Out: https://www.facebook.com/about/privacy/legal_bases). Meta is certified under the Data Privacy Framework. YouTube (Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, Privacy Policy: https://policies.google.com/privacy, Opt-Out: https://adssettings.google.com/authenticated.). Google LLC is certified under the Data Privacy Framework.We process your personal data for the duration determined by the IU with regard to the performance of the task. In this regard, we take the retention obligations under commercial and tax law as a basis. Clicking on a link, such as to Facebook, Instagram, Twitter, YouTube, TikTok or LinkedIn, will take you to the respective websites of the different providers. Data processing on the respective website is governed by the data protection information applicable there. The IU has no influence on the data processing carried out there.

24 Videos

24.1 Vimeo

​We have embedded videos on our Website that are stored on the video portal Vimeo. The video portal is operated by Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA. With the help of a plug-in, we can show you interesting video material directly on our Website. In the process, the data specified in the Server Log Files is transferred to Vimeo. The legal basis is your consent in accordance with Art. 6 (1)(a) GDPR to view the corresponding content.

When you visit a website in which a Vimeo video is embedded, your browser connects to Vimeo’s servers. This results in a data transfer to Vimeo and your data is stored on Vimeo servers in the USA. IU has entered into a data processing agreement with Vimeo for this purpose, which incorporates the EU standard contractual clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. Vimeo uses your data, among other things, to improve its own service offering and to display advertisements for you. Whether or not you have a Vimeo account, Vimeo collects data about you. Information about data processing by Vimeo is available at https://vimeo.com/privacy.

If you have a Vimeo user account and are logged in while visiting our Website, data about your visit will be linked to your Vimeo user account to form a user profile. If you would like to prevent this, we recommend logging out before visiting our Website. You also have the right to object to such data processing at any time. To do this, we recommend adjusting the settings in your browser regarding cookies and the settings in our Cookie Tool.

For information about the cookies used in connection with Vimeo, please refer to our cookie settings.

24.2 YouTube

On our website, we offer videos that you can watch by using YouTube. YouTube is operated by YouTube, LLC, 901 Cherry Ave. San Bruno, CA 94066 USA. After clicking the button to play the video, a connection to the YouTube servers is established.

We have embedded the YouTube videos by framing. An HTML link provided by YouTube is inserted into the code of the website and creates a playback frame. The video that is stored on the YouTube servers is then played by the frame. We use YouTube in the so-called extended data protection mode. Data collection initiated by cookies takes place only after you have pushed the playback function of the video. In order to watch YouTube videos, we need your consent pursuant to Art. 6 par. 1 (a) GDPR. You can provide your consent via the cookie consent tool or by clicking the button to play the video. If you use YouTube, YouTube receives information that you are currently using our website. Your IP address, browser information, the operating system and settings of the end device used, the URL of the current web page, previously visited web pages if you have followed a link, and information about the videos you have watched is then transmitted to YouTube. If you have logged into your YouTube account, your data will be associated with your YouTube profile. You can prevent this association by logging out of your YouTube user account before using our website and deleting the corresponding cookies from YouTube. The YouTube privacy policy can be viewed here: at https://policies.google.com/privacy, Opt-out: https://adssettings.google.com/authenticated.

25 Cloudinary

On our Website we use a so-called Content Delivery Network („CDN“) of Cloudinary Ltd., 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA („Cloudinary“). A CDN is an online service that is used in particular to load large media files (such as graphics, page content or scripts) through a network of regionally distributed servers connected via the Internet and display them on our Website. The use of the CDN helps us to optimize the loading speeds of our Website. It may happen that your data is transferred to the USA for the purpose of providing the CDN.

The processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in a secure and efficiently functioning website as well as the improvement of the stability and functionality of our Website.

We have concluded a data processing agreement with Cloudinary (Data Processing Addendum, available at https://cloudinary.com/gdpr/dpa) . Further information can be found in Cloudinary’s privacy notice at https://cloudinary.com/privacy . Cloudinary is certified under the Data Privacy Framework.

26 Sentry

In our offers we use the service Sentry. Sentry is operated by Functional Software, Inc, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. We use Sentry to improve the technical stability of our offerings by monitoring system stability and identifying code errors. For more information about the processing of your personal data by Sentry, please visit: https://sentry.io/privacy. The processing is carried out in accordance with Art. 6 para. 1 f) GDPR to protect our legitimate interest in the secure operation of our offers. Access to your data is granted to administrative employees of IU, as well as employees of Sentry, who are responsible for the operation of the application and may gain access to personal data. We process your personal data for the duration of the error analysis and delete it afterwards.  Sentry is certified under the Data Privacy Framework.

In our offerings, we use the service DataDog. DataDog is operated by Datadog, Inc., 620 8th Ave Fl 45, New York, NY 10018, USA. We utilize DataDog to enhance the technical stability of our offerings by monitoring system stability and identifying code errors. Further information on the processing of your personal data by DataDog can be found at: https://www.datadoghq.com/legal/privacy/. The processing is carried out in accordance with Art. 6 para. 1 f) GDPR to safeguard our legitimate interest in the secure operation of our offerings. Administrative staff of IU and employees of DataDog, who are responsible for the operation of the application, may have access to your data and might gain access to personal data. DataDog is certified under the Data Privacy Framework. We process your personal data for the duration of the error analysis and delete it thereafter.

27 Usage of Google Maps

We use Google Maps, a mapping service offered by Google Ireland Limited, Gordon House, Barrow Street Dublin 4, Ireland ("Google Maps"), to display an interactive map as well as to create directions or to assist you in finding our campus or study locations and locations of the student advisory service. We also use Google Maps to determine the nearest campus or study location based on your location. In order to display Google Maps, we require your consent pursuant to Art. 6 Para. 1 lit. a GDPR, which you can give - if you have not already given it as part of the cookie consent tool - via the button in the Google Maps area. You can manage the cookie settings at any time here (hyperlink to cookie settings) and revoke your consent with effect for the future.

When using Google Maps, information about your use (such as date and time of your visit, location information, URL, usage data, search terms, geographical location, and your IP address) is transmitted to Google and stored there. We have concluded a data processing agreement with Google for this reason. You can view the content of the agreement at https://business.safety.google/controllerterms/. If you have logged into your Google account, your data will be assigned to your Google profile. You can prevent this assignment by logging out of your Google user account before using our website and deleting the corresponding cookies. Once you have accessed Google Maps, you are on a Google website; you can view the privacy policy and terms of use of Google Maps here: https://policies.google.com/privacy?hl=de and https://www.google.com/intl/de_de/help/terms_maps.html . Google LLC is certified under the Data Privacy Framework.

28 Survey Questions on the Website

​When visiting our Website, we may ask you via a window that opens whether you already knew us before visiting our Website. For this purpose, we collect the data specified in the Server Log Files. If you answer the question, we also process your answer. This information is evaluated in aggregated form on the basis of our legitimate interest in being able to track the effectiveness of our marketing measures in accordance with Art. 6(1)(f) GDPR.

We retain information in this context for the duration specified by IU in order to perform the task and delete the data thereafter.

29 Complaint procedure according to the Supply Chain Act

IU provides a complaint procedure in accordance with the Act on Corporate Due Diligence Obligations in Supply Chains (“Supply Chain Act”). By submitting a complaint you may inform us confidentially or anonymously about violations of human rights and environmental protection that have occurred by us or one of our direct suppliers. Your personal data will be processed in order to receive and clarify such reports in case of suspicions according to the Supply Chain Act.

If you are the whistleblower yourself, we have received your personal data directly from you. Depending on the information you provide, this may involve processing of, for example, your name, contact details, the circumstances of the report or your observations. The legal basis for data processing is your consent pursuant to Article 6 (1) (a) GDPR, if you have given us your consent. For possible data transfer to the United States by using the form, your consent is required according to Art. 49 (1) (a) GDPR. You may revoke your consent at any time with future effect without giving reasons.

To submit a complaint via our online form, we use Microsoft Forms. Your personal data may be transferred by Microsoft to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") in the US. Information on data processing by Microsoft can be found at: https://privacy.microsoft.com/de-de/privacystatement. Microsoft is certified under the Data Privacy Framework.

It may also be that you yourself are not a whistleblower, but another named person or a defendant. In such a case, we have received your data as part of a report by a whistleblower. Depending on the content of the report, we may then process your name, function, contact details, other factual information, including information regarding alleged legal violations. The legal basis for this processing is our compliance with legal obligations (namely the Supply Chain Act) pursuant to Art. 6 (1) (c) GDPR. As a matter of principle, your personal data will only be made accessible to those employees of the IU who need this data in order to be able to guarantee the purpose of processing. Your identity as a whistleblower may only become known to the persons responsible for receiving reports or taking follow-up action, as well as to the persons assisting in the performance of these tasks, if this is necessary, for example, to clarify the facts of the case.

If you are an accused person in a report or are otherwise named, then your personal data may be transferred to external third parties, such as the police, public prosecutor's office, customs, or the Federal Ministry of Labour and Social Affairs (BAFA). The legal basis for this transfer is Art. 6 (1) (c) GDPR.

IU processes personal data in the context of this complaint procedure for a period of seven years from receipt of a notification. If judicial and/or official proceedings occur, IU will process your personal data until the (final/appealable) conclusion of the proceedings, which may exceed a period of seven years. If a report proves to be groundless, IU deletes corresponding reports immediately after determining the groundlessness.

30 Communication with journalists and press representatives

​IU processes from representatives of the press and journalists their names, contact details, information about professional activities and the content of the communication for the purpose of press and public relations work and direct communication. The legal basis for the processing of personal data is Art. 6 par. 1 lit. f) GDPR. The legitimate interest for the processing is the implementation of public relations and press work, which is why we maintain a press distribution list. For the email press distribution list we use the services of Meltwater (Meltwater Deutschland GmbH, Rotherstraße 22, 10245 Berlin). You may unsubscribe from the press distribution list by clicking on the link that is included at the end of each email. We have entered into a data processing agreement with Meltwater in accordance with Art. 28 GDPR. For the provision of a user-friendly newsroom and for the publication of press content, we use PressPage (PressPage B.V., Joan Musykenweg 22, 1096 CJ Amsterdam). We provide a contact form on our website that you can use to get in touch with us. For this purpose, we process the mandatory information requested there (first and last name, e-mail address, medium) as well as other optional information that you provide to us. We also use Presspage to manage your request. We have entered into a data processing agreement with PressPage in accordance with Art. 28 GDPR. Employees involved in public and press relations have access to the data. We process the personal data for the period in which we occasionally provide press representatives and journalists with information. We delete contact data upon request or after we have become aware that an activity for the press or in the area of public relations is no longer being carried out.

31 Registration Portal for Applicants for Employment as a Professor at IU

​31.1 Registration for the Portal

In the context of applying for a position as a professor at IU Internationale Hochschule GmbH, the registration portal (hereinafter collectively referred to as the „Portal“) is made available to you for use with the functionalities, such as uploading your data and documents and describing your knowledge, skills and work experience for the purpose of reviewing the application for authorisation to use the professional title of professor during any period of employment at IU, i.e., whether you would be entitled to use the title of professor during the period of your employment at IU Internationale Hochschule GmbH in the event of possible employment at IU Internationale Hochschule GmbH (hereinafter „examination procedure“).

As soon as you have logged into the portal using your e-mail address, which you provided to us during the application process, and a password to be created by you when registering for the first time, you will be granted access to the portal. The legal basis for this processing is the contract for using the portal, Art. 6 Para. 1 lit. b) GDPR.

We process your personal data for the period of your use of the portal and three months after.  Access to your personal data will be granted to employees who are engaged to administer the portal. For further information please refer to section 2 where the data processing on the website is described.

31.2 Uploading your documents into the portal

If you upload your documents to the portal, we also process the following categories of personal data in addition to the data specified in the server log files:

• Your first and last name,

• your contact details, such as address, telephone number, e-mail address,

• your curriculum vitae,

• an application photo, if you attach one,

• your school and work certificates,

• internship certificates, voluntary work, portfolios with work samples, language certificates, etc.

We process the above data as part of your application and the examination process, namely to determine whether you meet the requirements and whether we can offer you authorisation to use the professional title of professor in the event of employment at IU Internationale Hochschule GmbH. The legal basis for this processing is Art. 6 (1) (b) GDPR, i.e. the processing is necessary for the implementation of pre-contractual measures, which is carried out at the request of the data subject.

Only those employees of the IU who are responsible for the examination procedure will have access to your personal data. Your data will be processed in the Federal Republic of Germany.

We also store your personal data in our CRM system. In this respect, it may occasionally happen that employees of the service provider gain access to your data if, for example, errors in the system need to be corrected. In such a case, your data may also be processed outside the EU.

For this purpose, we have concluded a contract processing agreement with the service provider in accordance with Art. 28 GDPR, which includes the EU standard contractual clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

We also use various other service providers to assist us with our portal.

In this context, it may happen that employees of these service providers who, for example, host our website, receive access to your personal data as part of their job function. If our IT service providers process personal data, we have concluded a contract processing agreement with them in accordance with Art. 28 GDPR.

In addition, employees of advisory service providers, such as law firms and/or tax advisors, who are legally bound to secrecy, may have access to your personal data.

We process your data for the duration of the application and examination process. If you are offered employment as a professor at the IU International University of Applied Sciences, we will process the documents you have submitted for the duration of your employment with the IU and possibly beyond. You will then receive more detailed information in the data protection information for employees. If we have not offered you a job, we will continue to process documents containing your personal data for a period of six (6) months from the date of sending the rejection letter, after which we will delete your data, unless you have given us consent whereby you want us to keep your documents for a period of one (1) year from the date of receipt of the consent; in such a case, we will only delete your data at the end of the year or within two (2) weeks from receipt of your revocation.

31.3 Offer of conclusion of a contract

If we are able to offer you a job, we process your data in order for you to conclude an employment contract with us. You will receive information on how we process the personal data of our employees when you send us the employment contract.

32 Data processing when sharing information

Internal users of IU may store a secret that is placed in a digital vault or store a document that is placed in a digital file storage space through this Website. Further, internal users can create a file portal and request to upload files. The link to retrieve the secret or the document or the file portal can be sent by email either manually or automated. In doing so, we process first name, last name, email address, as well as the time and date of storage, file name, format and content, if applicable, and the amount of data transmitted.

External users can upload a secret or a file, or upload a file to a file portal by verifying their email address with a link. The secret or file will be stored in the previously defined digital vault or digital storage room or uploaded to the file portal and a previously defined person within IU will be informed. In doing so, we process first name, last name, email address, as well as the time and date of storage, file name, format and content, if applicable, and the amount of data transmitted.

The legal basis for this processing is Art. 6 par. 1 b) GDPR, i.e. the processing is necessary in order to execute a contractual relationship or steps prior to entering into a contract. In case you transmit information without our request, the legal basis is your consent, Art. 6 par. 1 a) GDPR.

For operating the website we use Microsoft Azure, a service provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). We have entered into a data processing agreement with Microsoft based on the EU Standard Contractual Clauses. You can access the EU Standard Contractual Clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en. We generally store your data within the EU. For more information on data processing by Microsoft, please visit https://privacy.microsoft.com/de-de/privacystatement.

33 Rights of Data Subject

You can contact IU in writing or per email at datenschutz@iu.org in order to exercise the following rights:

• Access your data in order to check and verify this data;

• Obtain a copy of your personal data;

• Rectification, erasure or restriction of processing, which also includes the right to complete incomplete or incorrect data by providing a supplementary statement;

• Right to object to the processing; please note that pursuant to Art. 21 GDPR you have the right to object to the processing of personal data processed by us on the basis of legitimate interests pursuant to Art. 6 (1) (f) DSGVO; you have a right to object to processing insofar as this is done on grounds relating to your particular situation; insofar as the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right to object without the requirement to specify a particular situation,

• You can receive your provided personal data in a structured, commonly used and machine-readable format and transmit this data to another controller, provided that you have given your consent to the processing or the processing is based on a contract;

• If you have given us your consent to process your personal data, you can withdraw this consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority with regard to the processing of your personal data. To exercise this right, you can contact the authority responsible for your place of residence or for the location of the IU in Thuringia:

Der Thüringer Landesbeauftragte für den Datenschutz, Häßlerstraße 8, 99096 Erfurt.

34 Automated Decision-making and Profiling

​Except for the services described below your personal data will not be used by IU for automated decision-making.

​When visiting our Website, we place cookies from various providers, provided you have given your consent in this regard. By means of the cookies that you have allowed in each case, data is generated as described in the Server Log Files. This data is consolidated and combined by IU with the help of a Google solution. For this purpose, IU has concluded a data processing agreement with Google, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC is certified under the Data Privacy Framework. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. If we receive information about you through our Website, for example, because you ask us to send you informational materials or contact us, then we store your data and combine it with the data generated by cookies. In addition, we receive reports from Google Analytics with data that we also combine with your data. For further information, please refer to the section on Google Analytics.

With the help of your consent regarding the data generated via our website, we store it in a CRM solution. We analyze the data to determine whether you are only interested in a course of study offered by us or whether you have also applied, and we add the relevant information to your data record. We store this profile created about you in a salesforce solution provided by Salesforce, with its registered office at Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England.

The legal basis for this data processing is your consent in accordance with Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future by contacting datenschutz@iu.org.

35 Why Do We Collect Your Personal Data?

​​You may choose not to provide us with your personal data or choose to provide incomplete data. In such a case, for example, if you prevent the storage of a cookie, you may not be able to use all the functionalities of the Website.

35.1 In the course of a study application procedure or an application for a job

If you do not provide us with your personal data or only provide us with incomplete personal data in the context of an admission procedure or a job application, we may not be able to accept you as a student or offer you the opportunity to participate in a job application procedure.

35.2 In the course of the purchasing process

If you do not provide us with your personal data or only provide us with incomplete personal data in the context of an purchasing process, we may not be able to purchase you a licence or a training.