In connection with your study or training programme at IU, it is necessary for IU to process personal data about you. This document informs you about the processing of your personal data regarding the enrolment and administration of your studies or training with IU. If you enter into an employment relationship as a student worker with IU, you will receive separate information concerning data processing in this context. Details on data processing relating to the use of our website are provided in our website's privacy policy available online. Data processing when using online tools is explained within the respective tools.
Controller and Data Protection Officer
IU Group N.V., Square Ambiorix 10, BE-1000 Brussels ("IU Group") processes your personal data jointly with other group companies depending on the subject matter (all headquartered at Mülheimer Straße 38, 53604 Bad Honnef, unless specified otherwise). Activities related to the operation of IU International University are conducted under joint responsibility with IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt ("IU"), including its study programmes, contacting prospective students, and providing information materials. Central administrative services within the group, such as controlling, financial accounting and HR management, office management, process and quality management, purchasing and sales, as well as central services, are supported by IU Corporate Services GmbH, which is also responsible for the respective data processing; IU IT Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, regarding the provision of the operational IT infrastructure including hardware, software, telecommunications, and electronic communication; IU Examination Service GmbH, responsible for exam monitoring services; IU Marketing Service GmbH and IU Sales Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, responsible for marketing and sales services (including marketing via this website and operation of the applicant portal for students); IU Commercial 1 GmbH for managing the online campus; IU Commercial 2 GmbH for managing campus locations and campus programs; IU Student Services GmbH jointly with the respective GmbH responsible locally, named after their respective cities (e.g., IU Dortmund GmbH or IU Bonn GmbH), responsible for advising prospective students and enrolled students, especially for student counselling. We will gladly provide excerpts from our joint controllership agreement upon request. Please contact datenschutz@iu.org.
IU has appointed Dr. Annette Demmel, SPB DPO Services GmbH, An der Buche 4, 13465 Berlin, annette.demmel@spb-dpo-services.com as the data protection officer for these aforementioned companies. You can contact IU either in writing or by email at datenschutz@iu.org.
Purpose of Processing
Your personal data are processed for the following purposes:
Participant and student administration, including enrolment, implementation of training or study programmes, issuance of ID cards and similar documents, assessment and collection of tuition or training fees, attendance tracking if needed, organisation of teaching activities (online and virtual events), registration and participation in courses, participation in research projects, surveys, and academic cooperation projects, provision and distribution of instructional materials, collection and evaluation of academic coursework including plagiarism checks, conducting exams, issuing exam transcripts, certificates or similar credentials, and other general administrative and HR-related processes required for the proper operation of academic programmes;
If you have a contract with Study Access Alliance: transmission of information regarding initial logins and study progress according to your contract with Study Access Alliance (the Study Progress Report does not contain individual grades, only overall academic progress, particularly completed exams);
Academic and student counselling, including personal consultations;
Maintaining legally required records, including accounting;
Internal and external auditing;
Booking, performing, and billing of any provided services;
Fulfilling legal notification and reporting obligations;
Providing operational IT infrastructure including hardware, software, telecommunications, and electronic communication, internet, mobile applications, remote maintenance access, online meetings, technical equipment for teaching, learning, and examinations, software licensing and control, user permissions management, debugging and troubleshooting, firewall services, multi-factor authentication, URL and malware filtering and reporting, monitoring files copied to removable media, ticketing system for request management and helpdesk, IT security software, and, within legally permitted limits, monitoring compliance with proper usage policies;
Internal audits to ensure compliance with legal, regulatory, corporate governance obligations, and internal policies, and investigation of suspected criminal or administrative offences, including compliance breaches.
Legal basis for processing
Your personal data are processed pursuant to Article 6 (1)(b) of the General Data Protection Regulation ("GDPR") for the performance of our contractual relationship with you. If we are legally obligated to process your personal data, the processing is based on Article 6 (1)(c) GDPR. In cases where we transfer your personal data to other group entities or other recipients based on legitimate interests pursued by us or a third party, this will be done on the legal basis of Article 6 (1)(f) GDPR, e.g., for utilizing shared operational infrastructure such as IT systems or online teaching tools, including plagiarism checks. In exceptional cases where the processing of your personal data is not necessary for performing our contractual obligations, but we would like to propose such processing to you nevertheless, we will explicitly request your consent pursuant to Article 6(1)(a) GDPR separately. Further information will be given in the respective context.
If you decide to communicate with us via WhatsApp for purposes related to your study or training, we will process your personal data accordingly. The legal basis for IU processing data via your use of our WhatsApp channels is Article 6(1)(b) GDPR. The data processing carried out by WhatsApp is governed by the privacy policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for users located within the EU, or by WhatsApp Inc. for all other users. The privacy policy is available at: https://www.whatsapp.com/legal/?lg=en#privacy-policy. IU employees responsible for handling our WhatsApp channels will have access to your personal data. IU uses a software solution provided by Twilio Inc., 101 Spear Street, Suite 500, San Francisco, CA 94105, USA, for the provision of communication services. Twilio processes personal data such as communication and technical connection data (for example, mobile phone number, message content, timestamp, delivery status). The legal basis for using Twilio is Article 6(1)(b) GDPR (performance of a contract or carrying out pre-contractual measures).
Twilio may process data outside of the EU. Twilio Inc. is certified under the EU-U.S. Data Privacy Framework and therefore ensures appropriate data protection standards for the data transfer (see https://www.dataprivacyframework.gov/s/participant-search). Additionally, we have concluded a Data Processing Agreement with Twilio pursuant to Article 28 GDPR.
Even though using this software solution largely excludes WhatsApp’s access to data, it cannot be ruled out that WhatsApp, Facebook or Meta employees might obtain access to your personal data. It also cannot be ruled out that your data might be stored on WhatsApp's servers in the United States. For this purpose, an agreement incorporating the EU standard contractual clauses has been concluded. For further details, please refer to WhatsApp’s privacy policy. Your personal data will be stored for the retention period set by IU to comply with our tasks, and deleted thereafter. If we use a chatbot based on artificial intelligence or other artificial intelligence technologies within our WhatsApp channel, which processes your personal data, we will inform you of this in advance via the WhatsApp channel. Details of chatbot functionality and the associated processing of data are described more fully below.
IU utilizes a chatbot that provides assistance with operational questions. Chatbots are programs which simulate an online dialogue. Within this processing, answers created imitate natural human language patterns when responding to text-based inquiries. This means you are chatting with a computer program instead of an employee. To respond to your inquiries, we use a knowledge database in which contextual relevance is identified, and the dialogue is conducted using deep-learning technology and natural language processing. We process responses entered into the chat by you, such as your educational background and professional experience. The chatbot utilizes an AI-supported technology incorporating deep-learning algorithms, provided by OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA ("OpenAI"), and operating within a secured IU environment on servers provided by Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, and its subcontractor Microsoft Corporation, One Microsoft Way, Redmond WA 98052-6399, USA ("Microsoft"). Further information regarding securing international data transfer is available in the section "Transfers of Personal Data to Third Countries". Information on data processing by Microsoft is available under: https://privacy.microsoft.com/en-us/privacystatement.
Inputs provided by you in the chat are not transferred to OpenAI’s databases for general reuse outside of IU. Parts of your chat content are used to train the chatbot. Only anonymized information is utilized for this purpose, never personal identifiers such as your telephone number or name. Furthermore, your data is used to personalize the service provided to you and to send you offers tailored to your interests. Legal basis for these processing activities is your consent according to Art. 6(1)(a) GDPR. Furthermore, also based on your consent according to Art. 6(1)(a) GDPR, information from the chat will be stored together with your name in Salesforce, Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, UK ("Salesforce"), and URLs with parameters to facilitate tracking and user guidance on the website will be created. Please also read the separate section on profiling.
Your personal data and the history of live chats are stored for the retention period defined by IU to accomplish the assigned tasks, afterwards being deleted. This allows us potentially to avoid extensive clarification of historical inquiry contents if you come back to us with further questions.
We use "Dashbot, Inc.", 548 Market Street, San Francisco, California 94104, USA ("Dashbot"), operated on Amazon Web Services ("AWS") servers, 410 Terry Avenue North, Seattle, WA 98109-5210, USA, for analyzing interactions within the chats. Both Dashbot and AWS are certified under the Data Privacy Framework. Further information is available at: https://www.dataprivacyframework.gov/s/program-overview.
Recipients
Only IU employees and lecturers tasked with activities described in "Purpose of the Processing" have access to your personal data. Additionally, our affiliated group companies may provide IT services on our behalf. We will gladly provide an overview of our group companies upon request. Employees of these companies may have necessary access to personal data strictly for performing their contractual duties. Moreover, we use various external service providers for operating our IT infrastructure, electronic communication systems, websites, and administrative tasks.
In connection with online study resources, including plagiarism checking, online tutorials, etc., we use various functions provided by external providers ("online tools"), which may receive your name, information about your courses and their content, including voice and video recordings.
If we transfer personal data to service providers in third countries, the individual tools' privacy notices on myIU will detail this. Certain third countries do not offer an adequate level of data protection. Especially, when transferring data to the USA, there is a risk that your personal data may be processed by U.S. authorities for control and surveillance purposes without your knowledge or adequate legal remedies. We safeguard transfers to third countries regularly with the EU Standard Contractual Clauses. You can obtain a copy here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj. Some companies use Binding Corporate Rules or certification under the Data Privacy Framework (https://www.dataprivacyframework.gov/s/program-overview). Specific tool information is detailed with each online-tool next to its start button.
When you communicate via IU's WhatsApp channel, employees of WhatsApp, IU, and possibly Twilio may access your personal data. Thus, it cannot be excluded that your data is stored on WhatsApp servers in the USA as described in WhatsApp’s privacy policy: https://www.whatsapp.com/legal/?eea=1#privacy-policy.
Categories of Data
We process the following categories of data:
Master Data and Contact Information
Name
Date of birth
Gender
Nationality
D card number or passport number, as well as issuing country or authority
Photographs
Home address
Personal contact details
If you use our WhatsApp channel: data from your status messages, as well as date and time of delivered messages
If you use the Live Chat or the chatbot, we additionally process data submitted via the Live Chat or chatbot
Contract Information
Details related to initiating, carrying out and ending your studies or further education
Training programme or degree programme
Information from admission processes, e.g., your curriculum vitae (CV)
Dates of enrolment and completion
Professional education and career history
Qualifications and certificates or degrees
Skills
Course attendance
Performance in your training programme or degree programme
Assessment of your performance
Examination results achieved
Examination assessments
Bank account details or other payment information
Insurance Data
Details concerning long-term care insurance, health, occupational accident and social security insurance
Details concerning other mandatory or voluntary forms of insurance
Information Connected to IT Infrastructure Use
Usage data related to the operational IT infrastructure including electronic communication means, e.g., internet, phone and intranet
Login records such as date and time of logins, visited pages, sent and received data, courses booked and attended
Voice recordings and video footage of yourself made within the context of course participation, online instruction or taking exams online
How long is your personal data stored?
As a general rule, we delete your data once it is no longer required for the intended purposes and no statutory retention obligations remain. If no specific deletion rules are provided in the respective application, we generally retain your personal data according to various mandatory university- or funding-related periods for up to 15 years, or according to statutory obligations under commercial and tax law, usually between six and ten calendar years after the end of the matter or the conclusion of the contract.
If you object to data processing in accordance with Article 21(2) GDPR, we delete your data within four weeks after receipt of your objection unless conflicting statutory retention periods apply or we are obliged to restrict processing instead of deletion. If processing is based on your consent and you withdraw your consent or processing ends for other reasons, we retain data necessary to demonstrate previously given consent — specifically date, time, details and content of consent given — for three years after consent-based processing ends. Detailed information about retention periods for specific data categories can be obtained upon request via datenschutz@iu.org.
Your Rights
You may contact us either in writing or via email at datenschutz@iu.org to exercise the following rights:
Right of access to your data in order to review, verify, and receive information about it;
Right to receive a copy of your personal data;
Right to rectification, erasure, or restriction of processing, including the right to complete incomplete or inaccurate data through supplementary statements;
Right to object to processing; please note that you have the right to object, pursuant to Article 21 GDPR, to processing of your personal data based on legitimate interests under Article 6(1)(f) GDPR for reasons arising from your particular situation; in the case of processing for direct marketing purposes, your right to object is absolute and does not require justification from your specific situation;
Right to receive the data you provided to us in a structured, commonly used, and machine-readable format and to have this data transmitted to another controller where processing is based on consent or a contract;
If you have provided us with consent, you have the right to withdraw that consent at any time with future effect.
Furthermore, you have the right to lodge a complaint with a supervisory authority regarding the processing of your personal data. To exercise this right, you may contact the supervisory authority responsible for your place of residence, or the authority responsible for IU:
Der Thüringer Landesbeauftragte für den Datenschutz und die Informationsfreiheit
Häßlerstraße 8
99096 Erfurt
Why is Your Personal Data Collected?
We require your personal data to perform our contractual relationship with you. You are free not to provide your personal data, or to provide us incomplete information; however, this could mean that we may not be able to carry out our contractual relationship with you properly. Please be aware that IU, being an internationally operating organisation, needs to provide our students and participants with access to courses, in part and sometimes exclusively, via internet-based online tools. For these purposes, we use software providers whose servers may be located in particular in the United States of America or other countries outside the European Union. More detailed information regarding data processing through individual online tools is provided next to the start-button of each online tool.
Automated Decision-Making and Profiling
Your personal data will not be used for automated decision-making.
Awards, accreditations and certifications
