This privacy policy informs you about the processing of your personal data in the context of the use of this website and the functionalities provided on it (hereinafter collectively referred to as the "Website"). This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g. orders or enquiries to the administrators). You can recognise an encrypted connection by the string "https://" and the lock symbol in your browser address bar.

1 GENERAL

Responsible parties and data privacy officers

The Website is operated by IU Group N.V., Square Ambiorix 10, BE-1000 Brussels ("IU Group"). IU Group is responsible for the processing of your personal data. IU Group processes your personal data on a subject-related basis under joint responsibility with other group companies (all of which have their registered office at Mülheimer Straße 38, 53604 Bad Honnef, Germany, unless otherwise stated). Activities in connection with the operation of IU International University are carried out under joint responsibility with IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt ("IU"). For central services within the affiliated group such as controlling, accounting and personnel administration, office, process and quality management, purchasing and sales as well as central services, the aforementioned companies avail themselves of the support of IU Corporate Services GmbH, which is additionally responsible for data processing; IU IT Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, concerning the provision of the operational IT infrastructure including hardware, software, telecommunications and electronic communication; IU Examination Service GmbH for services in the area of examination supervision; IU Marketing Service GmbH as well as IU Sales Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, for services in the area of marketing and sales (this also includes marketing via this website and the operation of the applicant portal for students); IU Commercial 1 GmbH for the management of the online campus and IU Commercial 2 GmbH for the management of the campus locations and concerning the campus programmes; IU Student Services GmbH together with the respective GmbH that exists for the respective location and is named after its city name, e.g. IU Dortmund GmbH or IU Bonn GmbH, for the support of prospective students and existing students, in particular study guidance. We will be happy to provide you with excerpts from the joint responsibility agreement. Please contact us at datenschutz@iu.org. IU Group has appointed Dr Annette Demmel, SPB DPO Services GmbH, An der Buche 4, 13465 Berlin, annette.demmel@spb-dpo-services.com as the data privacy officer for the aforementioned companies. You can contact IU Group either in writing or by e-mail at datenschutz@iu.org.

Recipients

Unless otherwise described for the respective processing, only those employees of IU who are responsible for performing a specific task, e.g. evaluating feedback or organising a consultation, have access to your personal data. In addition, employees who are responsible for operating our IT systems may have access to some of your personal data in the course of their work, e.g. administering an application or performing IT security tasks. Our employees are obliged to handle personal data confidentially. In the course of our business activities, we use the help of various service providers, in particular for the purposes mentioned above. Insofar as the service providers used to gain access to personal data, we have concluded the necessary agreements to protect your personal data, in particular, data processing agreements according to Art. 28 DSGVO, in which we oblige our service providers to maintain confidentiality. Furthermore, banks may be recipients of personal data for processing payments or lawyers, tax advisors and auditors may be recipients of personal data in the course of their work for us. In some cases, we transmit personal data due to legal obligations. In the event of a suspected criminal offence or investigation proceedings, data may be transmitted to the police and public prosecutor's office. For more information about who has access to your personal data, please see the description of the respective specific area of use.

Transfer to third countries

If we transfer data to service providers in so-called third countries, it is described in the respective area of application. Some of these third countries do not have an adequate level of data protection. Particularly in the case of data transfer to the USA, there is a risk that your personal data will be processed by the authorities there for control and monitoring purposes without you becoming aware of this or having sufficient legal remedies available to you. We regularly safeguard transfers to third countries by using the standard EU contractual clauses. You can access a copy at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=de.

Consent

If you give your consent to the processing, you can revoke this at any time with effect for the future without giving reasons. To do so, please use the contact channels of IU mentioned at the beginning or change the checkbox settings if consent was given via the checkbox settings selected by you.

Storage period

As a matter of principle, we delete your data as soon as it is no longer required for the necessary purpose and there are no retention obligations. We usually delete your personal data within a short period, e.g. after a consultation within a few months after the conclusion of the consultation. If no specifics are described concerning deletion for the respective application, we process your personal data in the application of the various university or federal law periods for up to 15 years or in the application of tax and commercial law retention periods for a period of six to ten calendar years after completion of a transaction or after the end of the contract. If you object to processing according to Art. 21 (2) DSGVO, we will delete your data within four weeks of your objection, provided that there are no other statutory retention periods to the contrary or we are not obliged to withhold data. If the processing is based on your consent and you revoke it or the processing ends for other reasons, we process the information necessary to prove the consent previously given, i.e. date, time, details of the granting and subject of the consent for three years after the consent-based processing expired.

2 DATA COLLECTION WHEN VISITING THE WEBSITE

When you use our website for information purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect the data that your browser transmits to our server (so-called "server log files"). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you:

• Our visited website

• Date and time at the time of access

• Amount of data sent in bytes

• Source/reference from which you reached the page

• Browser used

• Operating system used

• IP address used

The data processing is carried out in accordance with Art. 6 para. 1 p. 1 lit. b) of the General Data Protection Regulation ("DSGVO") based on your use of our website and our interest in improving the stability and functionality of our website in accordance with Art. 6 para. 1 S. 1 lit. f) DSGVO.

We process your data to provide you with a functional website, store the data for the duration specified by IU for this purpose and delete your data afterwards. Only employees of IU who are entrusted with the maintenance of the website have access to your personal data.

We use third-party services on our website. For more information on these services and the data processing associated with them, please refer to this privacy policy or the cookie-settings.

3 COOKIES

When you visit this website, depending on your browser settings and whether you have given us permission to do so, cookies may be set in order to extend the functionality of the website and make it more convenient for your use. Cookies are small text files that are stored on your computer. Most of the cookies used by IU are deleted from your hard drive at the end of the browser session ("session cookies"). In addition, IU uses so-called permanent cookies ("persistent cookies"), which remain on your end device in order to recognise you the next time you visit the website. If cookies are set, they collect and process certain user information to an individual extent, such as browser and location data and IP address values and as described in the server log files. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

An overview of the cookies used and the duration of the respective cookie storage can be found in the cookie-settings in our cookie consent tool.

If personal data is also processed by individual cookies used by us, the processing is carried out in accordance with Art. 6 para. 1 S. 1 lit. f) DSGVO on the basis of our legitimate interest in improving the stability and functionality of our website (so-called "necessary cookies") or in accordance with Art. 6 para. 1 S 1 lit. a) DSGVO on the basis of your consent for all other cookies (marketing and analysis cookies). Please note that you can set your browser so that you are informed about the setting of cookies and can decide individually whether to accept them or can exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. Cookie settings are described in the help menu of each browser, which explains how you can change your cookie settings. Please note that if you do not accept cookies, the functionality of our website may be limited.

4 COOKIE CONSENT TOOL

This website uses a so-called cookie consent tool from Usercentrics GmbH, Rosental 4, 80331 Munich, Germany (hereinafter referred to as "Cookie Consent Tool") to obtain consent for cookies and cookie-based applications that require consent.

By integrating a corresponding JavaScript code, users are shown a banner when they call up our website in which they can give their consent to certain cookies and/or cookie-based applications by ticking the appropriate box.

The cookie consent tool blocks the setting of all cookies requiring consent until the respective users give their consent by ticking the corresponding box. This ensures that such cookies are only set on the respective user's end device if consent has been given.

For the cookie consent tool to be able to clearly assign page views to individual users and to individually record, log and store the consent settings made by the user for session duration, certain usage information, as described in the server log files and including the IP address, is transmitted to servers of the cookie consent tool and stored there when our website is called up by the cookie consent tool. For further details, please refer to the information provided in the cookie consent tool.

The data processing carried out by the cookie consent tool is carried out in accordance with Art. 6 para. 1 S. 1 lit. f) DSGVO based on our legitimate interest in a legally compliant, user-specific and user-friendly consent management for cookies and thus in a legally compliant design of our website.

We have concluded a Data Processing Agreement with Usercentrics GmbH, with which we oblige Usercentrics GmbH to protect the data of visitors to our website and not to pass it on to third parties.

We process your data for this purpose for the duration of your session and delete your data thereafter unless you have given your consent to the setting of cookies, in which case we process your data for the duration specified per cookie. For more information on the use of data by Usercentrics GmbH, please refer to the Usercentrics data protection declaration at https://usercentrics.com/privacy-policy/.

5 CONTACT (E.G. VIA E-MAIL)

If you contact us by e-mail, we process the information necessary to carry out the contact, e.g. your e-mail address, the information you have provided and the date and time of the contact. If you also provide us with your name and other personal data, we will also process this.

If you hold an online meeting with us, e.g. to advise you about your studies, we also process your display name, your profile picture if applicable, the preferred language, date, time, meeting ID, your telephone number if applicable, as well as exchanged texts, audio and video data. To handle our communications, we use Microsoft 365, and Microsoft Teams, both services of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") and Zoom Video Communications, Inc, 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA ("Zoom").

The legal basis for this processing is Art. 6 para. 1 S. 1 lit. b) DSGVO or Art. 6 para. 1 S. 1 lit. a) DSGVO for such information which is not absolutely necessary for the meeting and which you provide to us voluntarily. We process your data to answer your enquiry or to advise you. In each case, your personal data will be stored for the period of time determined by IU concerning the fulfilment of the task and then deleted. This is based on the retention periods under commercial and tax law. Only employees of IU who are entrusted with answering contact enquiries have access to your personal data.

We have concluded data processing agreements with Microsoft and Zoom, which are based on the EU standard contracts. You can access the EU standard contractual clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=de. Further information on data processing by Microsoft can be found at https://privacy.microsoft.com/de-de/privacystatement and by Zoom at https://explore.zoom.us/en/privacy/.

5.1 FREE CALLBACK SERVICE

If you use our free callback service, we will process your first and last name, your e-mail address if applicable, your telephone number, the desired callback time (date and time) and a message to us to call you back on the subject you have specified. The legal basis for this processing is Art. 6 para. 1 S. 1 lit. b) DSGVO. If we cannot reach you by telephone and you have given us your consent to do so in accordance with Art. 6 para. 1 S. 1 lit. a) DSGVO, we will contact you by e-mail. Your personal data will be stored for the period of time determined by IU concerning the fulfilment of its tasks and then deleted. Only employees of IU who are entrusted with the support of corresponding enquiries have access to your data. In the course of our telephone support for clients, it may occasionally happen that we record telephone calls for training and quality control purposes. In such a case, you will be informed separately and can give your consent.

5.2 WHATS APP

If you decide to communicate with us via WhatsApp as part of your application for a place on a degree programme or to pursue your studies, we will process your personal data provided by you, such as your telephone number, your picture, your status information and your name. Additionally, we process the personal data that you communicate to us via WhatsApp. In this regard, we recommend that you only provide us with the information that is absolutely necessary to answer your request and refrain from providing additional information. Whether you use WhatsApp is entirely at your discretion and you can receive the same information by telephone, electronically and/or by post.

IU processes your personal data to communicate with you via WhatsApp. The legal basis for this data processing by IU is your use of our WhatsApp channels in accordance with Art. 6 para. 1 S. 1 lit. a) DSGVO. You can revoke your consent to the processing of your personal data at any time. The revocation can be made via the specified contact options. The declaration of revocation does not affect the lawfulness of the processing carried out so far. Data processing by WhatsApp is governed by the privacy policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and can be accessed at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy. WhatsApp is a telecommunications service provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and is part of Facebook Inc. Your personal data is accessed by those IU employees who manage our WhatsApp channels. IU uses a software solution from the provider Messenger People, which does not require an app installation. Even if the use of the software solution largely excludes access to data by WhatsApp, it cannot be ruled out that employees of WhatsApp or Facebook also gain access to your personal data. It also cannot be ruled out that your data will be stored on WhatsApp servers in the United States of America. For this purpose, a contract has been concluded in which the EU standard contractual clauses are included. You can find more information on this in WhatsApp's privacy policy, if applicable. Your personal data will be stored in each case for the duration determined by IU with regard to the fulfilment of the task and then deleted.

5.3 ONLINE CHAT (BOLD360)

IU uses a live chat provided by the company Genesys Telecommunications Laboratories GmbH, Joseph-Wild-Straße 20, 81829 Munich ("Genesys"). The online chat is carried out using a chatbot that can help with questions on operational topics. Chatbots are programs that simulate an online guided dialogue. This means that you do not chat with a staff member, but with a computer programme. Alternatively, you can use the live chat like a contact form to chat with our staff in almost real-time. For this purpose, we process your first name and last name in addition to the data mentioned under server log files. If you enter your e-mail address, we will also process this information. Depending on the course of the conversation with our employees, you may provide further personal data during the chat. If this is the case, we will also process this personal data about you. The type of data processed depends largely on your request. Your personal data is processed based on Art. 6 para. 1 S. 1 lit. b) DSGVO to respond to your enquiry. By using the online chat function, cookies are placed on your device. You can find more information on this in our cookie-settings.

Your personal data and the course of the live chat are stored in each case for the duration that IU has determined to fulfil the task and then deleted. This serves to save you extensive explanations of the history of your enquiry under certain circumstances, should you contact us with a follow-up query. For more information on data processing by the chatbot, please refer to the Genesys privacy policy at https://help.mypurecloud.com/articles/genesys-cloud-privacy-policy/.

5.4 TYPEFORM

We use Typeform from TYPEFORM SL, C/Bac de Roda, 163 (Local), 08018 Barcelona Spain (Typeform) for some contact forms. You will recognise that we use Typeform by the fact that "Typeform" is displayed as a logo at the bottom right of the screen. Typeform enables us to provide you with a simple means of contact.

For this purpose, we pass on the following personal data to Typeform:

• Email address*

• First name*

• Surname*

• Telephone number

Mandatory fields are marked with *.

Typeform is the recipient of your personal data and acts as an order processor for us, which is why we have concluded a Data Processing Agreement with Typeform. The legal basis for this processing is your consent in accordance with Art. 6 para. 1 S. 1 lit. a) DSGVO. You can revoke your consent to the processing of your personal data at any time. The revocation can be made via the specified contact options. Your data will be processed until your request has been answered. The declaration of revocation does not affect the lawfulness of the processing carried out so far.

The data will be stored exclusively for the purpose of transmitting enquiries and responding to them. The mandatory data serve the purpose of allocating and answering your requests. You can also choose not to provide us with your personal data via such a contact form. Alternatively, you can contact us at the e-mail address provided in this policy.

Additionally, to the data mentioned above, Typeform collects the following personal data with the help of cookies: Information about your terminal device (IP address, device information, operating system, browser settings). Furthermore, usage data is collected such as the date and time when you used the contact form. Further information can be found at: https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data.

You can find further information on the options for objecting to and deleting Typeform's data at:

Typeform

6 ONLINE INFORMATION EVENTS

If you register via our website to participate in an online information event, we will process your first and last name and your e-mail address, in addition to the data mentioned under server log files. We process your data in accordance with Art. 6 (1) S. 1 lit. b) DSGVO to send you an invitation to our online information event. Your personal data will be stored in each case for the duration determined by IU to fulfil its tasks and then deleted. You will receive information on the processing of your data by the provider of the video conferencing tool when you receive the invitation.

If you give your consent, information about your registration in your browser and the details in the fields will be stored based on a cookie so that you can use the pre-filled fields when you register again and you will be shown for which event you are already registered. We process your data in accordance with Art. 6 para. 1 S. 1 lit. a) DSGVO. You can revoke your consent for local storage in the browser and the processing of your data for the purpose of pre-filling the fields separately at any time with effect for the future. You can set the revocation in the cookie consent tool and declare it via datenschutz@iu.org.

7 NEWSLETTER

With your consent, you can subscribe to our newsletter, which we use to inform you about current interesting offers 1) on our degree programmes, discount campaigns on tuition fees and study-related information events 2) as well information on entrepreneurship 3) for alumni, discount campaigns for alumni and other activities for our graduates 4) as well as event and publication information from members of the research network. This information is personalised based on your interests and previous use of our website and our services provided that you have given us separate consent to do so via the cookie selection. You can revoke your consent to receive the newsletter at any time. You can revoke your consent by clicking on the link at the end of the newsletter or by sending an e-mail to abmeldung@iu.org.

For the registration to our newsletter, we use the so-called double opt-in procedure: after your registration, we send an e-mail to the specified e-mail address. In this e-mail, we ask you to confirm that you wish to receive the newsletter. If you confirm your registration for our newsletter, we store your e-mail address, IP address and the time of registration and confirmation. The purpose of this processing is to prove your registration and, if necessary, to be able to clarify a possible misuse of your personal data. The legal basis for the processing is your consent according to Art. 6 para. 1 S. 1 lit. a) DSGVO. To send you our newsletters, we use the services of external service providers, some of which are located outside the EU. In such situations, we conclude processing contracts that incorporate EU standard contractual clauses. You can view these here https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=de. We store your consent for three years after the end of the year in which the withdrawal takes place

8 REQUESTS FOR INFORMATION MATERIAL

If you request information material to be sent to you electronically, we will process your title, first name and surname, e-mail address, telephone number (if applicable) and details of the subject of the requested information to provide you with the information material. The legal basis for this processing is Art. 6 para. 1 S. 1 lit. b) DSGVO. If we do not reach you by e-mail and you have given us your consent to do so in accordance with Art. 6 para. 1 S. 1 lit. a) DSGVO, we will contact you by telephone. Access to your data will be granted to those employees who are entrusted with the administration and processing of such enquiries in the course of their work. To collect your above data, we use Google Lead Form Ads, an application provided by Google Ireland Ltd ("Google"), whose registered office is Gordon House, Barrow Street, Dublin 4, Ireland. The information you enter in the form to request information material may be transferred to a Google server in the USA. The data entered in the form will be encrypted and stored by Google for up to 60 days. Only IU has access to this data. To secure this data transfer, IU has concluded a Data Processing Agreement with Google, which includes EU standard contractual clauses. You can view these here https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=de.

9 REGISTRATION FOR STUDIES

If you apply for a course of study via the website, we will process your name, address, contact information, details of your previous education in the form of certificates, letters of recommendation and a curriculum vitae, desired course of study and payment data, such as account information, as well as data for the preparation and implementation of the education contract concluded with you. If you temporarily save your online application and complete it at a later date, we will send you a link to the storage location to your e-mail address, where we will keep the incomplete application data for you for 30 days for the purpose of completion. If you wish to receive a study contract by post, we will use your details to summarise the information you have provided so far in a draft and send it to you by post. If you complete the online application for recognition/credit of prior academic achievements via the website, we collect your contact data, including name and postal address, email address, telephone number, desired course of study, information on your previous education, and on your previous professional career, information on other qualifications, evaluations, training and work references. The legal basis for this is Art. 6 para. 1 S. 1 lit. b) DSGVO. You will receive detailed information about the processing of your personal data during the registration and recognition process. Access to your personal data is granted to those employees who are entrusted with the support of applicants in the Enrolment Office or the Admissions Office of IU. Personal data that you provide in the course of registering for a degree programme will be stored for the duration of your studies and in accordance with statutory retention periods (as per the German Fiscal Code and the German Commercial Code for a period of six to ten years). Data collected in the context of an application for the possible recognition/credit of prior learning will be stored for twelve months from the date of the application. If no enrolment takes place within this period, the application including all documents will be deleted. For further information, please refer to the information on data protection for students, which you will receive together with the documents to register for a degree programme.

10 APPLICATIONS PORTAL FOR STUDENTS

Registration for the Applications Portal

As part of your online application to study, the Applications Portal (hereinafter referred to collectively as the "applications portal") will be made available to you for use with functionalities such as uploading your data and documents and describing your knowledge and skills. If you decide to use other functions, such as if you want to participate in an information session or an interview, these activities take place outside the application portal. You will receive information on the data processing carried out in this case separately. If you register for the application portal, we use the so-called double opt-in procedure, i.e. you will receive an e-mail with which you must confirm that you are the owner of the e-mail address. Please note that this is purely a precautionary measure and that sending a confirmation e-mail to you has no legal effect. Once you have given the appropriate confirmation, you will be given access to our application portal. The legal basis for this processing involves sending your application to us in accordance with Art. 6 para. 1 S. 1 lit. b) DSGVO.

To make the onboarding process as easy as possible for you, in particular, to give you a good overview of the status of your application or missing documents at any time, to facilitate the selection of a practice partner, to request help or to enable you to change your details, we use the onboarding tool of Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits"). For this purpose, Product Fruits creates screen views from the personal data you have provided to us as part of the application process, which you can use. Employees of IU also have the option of accessing aggregated statistics generated from the activities of applicants. A reference to an individual person in this context cannot be established. IU uses these statistics to monitor how many applicants abandon the application process or how long an average application process takes. The legal basis for the use of Product Fruit is our legitimate interest in providing you with a user-friendly application portal on the one hand and optimising our internal processes and personnel planning on the other hand, in accordance with Art. 6 para. 1 S. 1 lit. f) DSGVO. Only those employees of IU who are responsible for the allocation of study places have access to your personal data.

We store your personal data in our CRM system from Salesforce, Floor 26, Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England, from which Product Fruits creates the above-mentioned views. In this respect, it may occasionally happen that employees of the service provider gain access to your data if, for example, errors in the system need to be rectified. For this purpose, we have concluded data protection contracts with the service providers in accordance with Article 28 of the GDPR; the EU standard contractual clauses are included in the contract with Salesforce. We will be happy to send you a copy of the EU standard contractual clauses upon request. We process your personal data for as long as you save your profile in our applications portal. If we find that you have registered for the applications portal but have not logged in for more than 12 months, we will send you an email informing you that we will delete your data after 4 weeks if you do not log in again.

Uploading your documents

If you upload your application documents to the applications portal, we will also process the following categories of personal data in addition to the data mentioned in the server log files:

• Your first and surnames,

• Your contact details, such as address, telephone number, e-mail address,

• your curriculum vitae,

• an application photo, if you attach one,

• your references,

• your letter of motivation,

• In particular, proof of internships, voluntary work, portfolios with work samples, language certificates, etc.

We process the above-mentioned data as part of your application, namely to determine whether you meet the requirements and whether we can offer you the desired academic place. The legal basis for this processing is Art. 6 para. 1 S. 1 lit. b) DSGVO, i.e. the processing is necessary for the implementation of pre-contractual measures, which takes place at the request of the person in question. Only those employees of IU who are responsible for the allocation of study places have access to your personal data. Your data will be processed in the Federal Republic of Germany. We also store your personal data in our CRM system. In this context, it may occasionally happen that employees of the service provider gain access to your data, e.g. if errors in the system need to be corrected. In such a case, your data may also be processed outside the EU. For this purpose, we have concluded a data protection contract with the service provider in accordance with Art. 28 DSGVO, which includes the EU standard contractual clauses. You have the right to obtain a copy of the EU Standard Contractual Clauses; for this please contact datenschutz@iu.org. We also use various other service providers to assist us with our application portal. In this context, employees of these service providers who, for example, host our website, may have access to your personal data as part of their job function. If our IT service providers process personal data, we have concluded a data protection contract with them in accordance with Art. 28 DSGVO. Additionally, employees of advisory service providers, such as law firms and/or tax advisors, who are legally bound to secrecy, may have access to your personal data. We process your data for the duration of the application process. If you are offered a place at the university, we will process the documents you have submitted for the duration of your studies and possibly beyond. You can find more information in the data protection information for students. If we are unable to offer you a place, we will continue to process documents containing your personal data for six (6) months from the date of sending the rejection letter, after which we will delete your data, unless you have given us your consent to keep your documents for one (1) year from the date of receipt of your consent, in which case we will delete your data only at the end of the year or within two (2) weeks of receiving your revocation.

Registration for an info session

If you click on the "Info session" field, you will be taken to another website via a hyperlink. The data processing then carried out is governed by the data protection information which you can view on the website. If you register for an info session, we will process the following data

• your first and surname

• your telephone number/email address and

• the data described in the context of the server log files

to conduct an info session with you.

We process the aforementioned data to invite you to an information session. The legal basis for this processing is Art. 6 para. 1 S. 1 lit. b) DSGVO. Only those employees of IU who are responsible for conducting the info sessions have access to your personal data. If we hold an info session online, we will send you a link to the provider's privacy policy together with the participation link. Your personal data will be processed, stored and deleted as described under "Uploading your documents".

Interview

If you have uploaded your documents in full, we may invite you to an interview. In this context, we process the categories of data described in section I. In addition, we will also process

• your e-mail address

• your telephone number

• the date agreed with you and

• the data described in the context of the server log files.

We process your data to conduct an interview with you to determine whether we can offer you a place at the university. The legal basis for this processing is Art. 6 para. 1 S. 1 lit. b) DSGVO, i.e. the processing is necessary to carry out pre-contractual measures in response to your request. Only those employees of IU who are responsible for conducting the interview, who supervise applications for university places and who participate in such an interview will have access to your personal data. If we hold the interview online, we will send you a link to the provider's privacy policy together with the participation link. Your personal data will be processed, stored and deleted as described under "Uploading your documents".

Conclusion of contract and enrolment

If we are able to offer you a place at the university, we process the data described in the server log files and the data mentioned under "Uploading your documents" so that you can conclude an education contract with us and enrol. You will receive information on how we process the personal data of our students when we send you the education contract.

11 USE OF OUR BLOG

Our blog publishes a variety of topics related to IU. If you participate in a discussion or publish a contribution yourself, we process the data described in the server log files and your name and a photo of you to introduce you. The legal basis for this processing is your consent according to Art. 6 para. 1 S. 1 lit. a) DSGVO. You can revoke your consent at any time with effect for the future. We will then delete your blog post within two weeks of receiving your revocation. Please bear in mind that posts and your photo may be stored locally on blog readers' devices and that we cannot delete locally stored data. We recommend that you use a pseudonym instead of your real name. Please bear in mind that your posts are visible to everyone worldwide. We reserve the right to delete contributions if they are objected to by third parties as being illegal. Our employees who maintain the website will have access to your personal data.

12 RECRUIT FRIENDS

Through our site, you can recruit friends to study with you and receive rewards for doing so. For this purpose, we process your name and e-mail address, as well as the data entered by your friend. You can create a personalised link via our website and send it to your friend. This e-mail contains an affiliate link; this in turn contains a pseudonymised referral code in the URL. If your friend clicks on the link, he or she will be directed to a website form for sending information material. The form is used to query whether your acquaintance was recruited by you. The processing is carried out in accordance with Art. 6 Par. 1 S. 1 lit. f) DSGVO to protect our legitimate interest in acquiring new customers. The purpose of the processing is to reward customer acquisition. Employees of IU who are responsible for the customer acquisition programme have access to your personal data. We process your personal data for the period of time determined by IU to fulfil its tasks. We comply with the retention obligations under commercial and tax law.

13 WEB ANALYTICS SERVICES

Our website uses analysis services which we use to collect information about our website, provided that you have consented to the setting of corresponding cookies. The data obtained with the help of analysis services, such as the origin of visitors or the time they spend on our website, provide us with information about visitor behaviour on our website. With the help of this data, we can not only eliminate weaknesses but also improve the efficiency of our website. Further information on the analysis services used on our website is provided below. For information on the processing of personal data by the cookies set in this context, such as the storage period of the cookies, please refer to our cookie settings.

13.1 GOOGLE ANALYTICS AND GOOGLE SIGNALS

We use Google Analytics to gain an overview of the behaviour of website visitors and our digital marketing. Google Analytics allows us to collect and analyse data that is specifically relevant to IU, for example, how far visitors scroll, which buttons are clicked, etc. Google Analytics also helps us to analyse the behaviour of visitors to our website. Google Analytics also helps us to collect, for example, demographic characteristics such as age, gender and interests, geographical characteristics such as language and location, and technical characteristics such as device type, browser and operating system, search history, YouTube history and data from Google partner websites. This data not only helps us to optimise our website but also allows us to see how the respective sessions of visitors have concluded (e.g. pure website visit, request for info material, registration for studies). Google Analytics also helps us to identify which website a user enters and through which channel the user arrives (e.g. via a paid or unpaid advertisement, a Google search, a Facebook post or direct access to the website). This information allows IU to see which marketing channels are working and which are not. Google Analytics also allows us to identify user paths, i.e. where users go on our website, whether they return to the homepage and how many users are there at any given time. With the help of this information we can, for example, recognise whether the bouncing of a large number of users is due to a technical defect on the website. The above data gives us a good overview of our website and how it is used. Even though we collect data from users, we cannot draw any conclusions about your identity from this data, as we receive reports from Google Analytics that are based on aggregated data sets.

Since we have also activated the Google Signals service offered by Google, i.e. so-called cross-device tracking, your above-mentioned data is analysed across devices and used for the purpose of personalising advertising. Google can thus recognise whether you visit our website first via a smartphone and later via a laptop. We ourselves only receive reports with anonymous data from which we can recognise patterns in the behaviour of users. Google Signals is active if you have a Google account and are logged in to it when you visit our website. Furthermore, you must have agreed to " Personalised Advertising" with Google. If you do not wish to have cross-device tracking, you must deactivate " Personalised advertising" in your Google account. With the help of Google Signals, we can launch cross-device remarketing campaigns. This means that we also show you our advertising on third-party websites. You have the option to view or delete your data stored on Google under "My activities".

Information on the provider, the cookies set, the legal basis, international data transfers and storage times of the cookies can be found in our cookie-settings.

13.2 MOUSEFLOW

We use Mouseflow to analyse user behaviour on our website, provided that you have consented to the setting of corresponding cookies. Mouseflow observes website users, records session videos and uses these videos to show how users behave on the website (e.g. how far they scroll). Mouseflow does not collect any clear data for this purpose (e.g. if you enter data in a contact form, this is not collected by Mouseflow because the fields of the contact form are hidden). Mouseflow also allows us to create so-called heat maps of website usage. These are summarised data on all visitors that help us to evaluate scroll-click and mouse behaviour. Mouseflow also shows us exactly at which point in a form users have stopped filling in. This usage data analysis gives us an insight into how our website is used but does not allow us to draw any conclusions about you personally. We receive reports from Mouseflow that are based on aggregated data sets. Information on the provider, the cookies set, the legal basis, international data transfers and storage times of the cookies can be found in our cookie-settings.

13.3 CONTENTSQUARE

We use Contentsquare to analyse user behaviour on our website, provided that you have consented to the setting of corresponding cookies. Contentsquare collects interaction data of your visit to our website (such as dwell time, clicks or scrolling). Using this data, which we process in pseudonymised form, we gain insight into the way our website is used and can base measures for optimising user-friendliness or develop marketing measures on this. Information on the provider, the cookies set, the legal basis, international data transfers and storage times of the cookies can be found in our cookie-settinhgs.

14 GOOGLE TAG MANAGER

This website uses Google Tag Manager ("GTM"), a service provided by Google Ireland Ltd ("Google"), whose registered office is Gordon House, Barrow Street, Dublin 4, Ireland. Through the GTM, tags such as code snippets or pixels are used on our website through a so-called container, which places a kind of placeholder in the source code and in which the tools to be used are stored without IU having to intervene in the source code of our website. Employing the GTM, tools can be used on one's website without having to include them in the source code. Instead, only the code of the GTM has to be integrated and then the GTM can be used as a central place to start or switch off the desired tools. The GTM then works on the website by a defined usage behaviour triggering a so-called trigger, so that a tag (i.e. a pixel tag, web beacon or HTML code) for the tool is then played out. The GTM collects the relevant data for the built-in tool and forwards it to the tool. Information on the tools used on our website that are loaded via the GTM can be found in the cookie-settings. In this context, it therefore not only happens that the data categories described for the respective tools are transmitted to the respective providers of the tools; in addition, Google Ireland Ltd. also receives information about your usage behaviour on our website. Since many of the tool providers are located in countries outside the EU, we would like to refer you to the description of the respective tools if you would like to receive information on the transfer mechanisms concluded by IU. IU has also concluded a processing agreement with Google Ireland Ltd. which includes EU standard contractual clauses. You can view the main content of the agreement by visiting https://policies.google.com/privacy/frameworks?hl=de. IU uses the GTM to deploy not only statistical tools but also marketing tools. Accordingly, the GTM is a statistical and marketing tool and the use of the GTM is based on your consent according to Art. 6 (1) S. 1 lit. a) DSGVO, which you may revoke at any time with future effect by sending an email to datenschutz@iu.org.

15 CUSTOMER LIST MATCHING

We use tools to match customer lists with various advertising providers to target customers who may have an interest in our products. To do this, we import into the advertising account that we have created with an advertising provider, e.g. Facebook, a list of names, email addresses, date of birth, gender and, where applicable, address details of our customer:s and hash them, i.e. we generate a shorter, numeric value or key of fixed length. The advertising provider compares this list in the hashed form with its database and, based on this, selects customers to whom our ads are displayed when they use the advertising provider's products, such as a search engine, a social media platform, a streaming platform or a communication service. In the event of a match of customer data, these are added to our account as successfully matched customers.

The legal basis for the processing is your consent in accordance with Art. 6 Para. 1 S. 1 lit a) DSGVO. Your personal data in connection with the use of customer list matching with advertising providers will be stored by the respective provider for the duration of the matching of the customer list and then deleted. The use by IU is for the duration of your consent. On the part of IU, only employees of IU who are responsible for the relevant area have access to your personal data. We currently use the following services:

Google Customer Match: Your personal data will be transferred to Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland; Alphabet Inc. and Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. To the extent that your personal data is transferred to Google in the USA, this is done based on a contract that IU has concluded with Google for this purpose and which incorporates the EU standard contractual clauses. You can view the main content of the agreement at https://policies.google.com/privacy/frameworks?hl=de and https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en. Further information is available at https://support.google.com/adwordspolicy/answer/6299717?hl=de. Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/. You can edit the personal data and privacy settings under Google "My Account": https://myaccount.google.com/intro?hl=de

Facebook Custom Audience: Your personal data will be transferred to Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland. To the extent that your personal data is transferred to Facebook, Inc, 1 Hacker Way, Menlo Park, CA 94025, in the USA, this is done based on an agreement that IU has concluded for this purpose with Facebook or Facebook within the group of companies and which incorporates the EU standard contractual clauses. You can view the main content of the agreement at https://www.facebook.com/legal/terms/dataprocessing and https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en. Further information is available at https://www.facebook.com/legal/terms/customaudience.

Microsoft Customer Match: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. To the extent that your personal data is transferred to the USA, this is done based on an agreement which IU has concluded with Microsoft for this purpose and which incorporates the EU standard contractual clauses. You can view the main content of the agreement at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?year=2021 and https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en. Further information is available at https://privacy.microsoft.com/de-de/privacystatement.

16 SOCIAL MEDIA

To increase our reach, we maintain online social media presence on Facebook, Instagram, LinkedIn and YouTube. Clicking on a link embedded in our website will take you to the relevant page: Facebook: https://www.facebook.com, Instagram: https://www.instagram.com/, LinkedIn: https://de.linkedin.com/, YouTube: https://www.youtube.com/. Plugins of these social networks are integrated into our website. When you visit our website, a direct connection is established between your browser and the server of the social network via the plugins. The social network thereby receives the information that you have visited this website with your IP address. If you are logged into your account with the social network, the social network can assign your visit to this website to your user account. Details on data collection (purpose, scope, further processing, use) as well as your rights and setting options can be found in the data protection information of the social network. The deletion of your personal data by the social network takes place as described in the respective privacy policy. If there is a joint responsibility with Instagram or Facebook, the contract on joint responsibility shall be applicable. You can find the contract at https://www.facebook.com/legal/terms/page_controller_addendum). For more information on the respective responsibilities, please see the Facebook Page Insights Supplement. (https://www.facebook.com/legal/terms/page_controller_addendum) The legal basis for processing the data is Art. 6 (1) S. 1 lit. f) DS-GVO. Our legitimate interest in this respect is to increase the reach of our online presence on social media channels. The purpose of the processing is to increase our presence on the internet. Employees of IU who are active in the management of the social media channels and, if applicable, employees of the respective provider have access to the data. Your personal data will be transferred to the companies listed below in the USA or can be accessed from there. Further information on the protection of international data transfer can be found in the section "Transfers of personal data to third countries". Information on data processing can be found at: LinkedIn (LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland) -Privacy Policy https://www.linkedin.com/legal/privacy-policy, Opt-Out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) -Privacy Policy/Opt-Out: http://instagram.com/about/legal/privacy. Facebook (Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) - Privacy Policy (Opt-Out: https://www.facebook.com/about/privacy/legal_bases). YouTube (Google Ireland Limited Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland, Privacy Policy: https://policies.google.com/privacy Opt-Out: https://adssettings.google.com/authenticated.). We process your personal data for the period of time determined by IU concerning the fulfilment of the task. We base this on the retention obligations under commercial and tax law.

17 CLOUDINARY

On our website, we use a so-called Content Delivery Network ("CDN") of Cloudinary Ltd, 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA ("Cloudinary"). A CDN is an online service that is used in particular to load large media files (such as graphics, page content or scripts) through a network of regionally distributed servers connected via the Internet and display them on our website. The use of the CDN helps us to optimise the loading speeds of our website. The processing is carried out in accordance with Art. 6 para. 1 S. 1 lit. f) DSGVO based on our legitimate interest in a secure and efficient provision, as well as improvement of the stability and functionality of our website. We have concluded a data protection contract with Cloudinary (Data Processing Addendum, available at https://cloudinary.com/gdpr/dpa) which includes EU standard data protection clauses. For more information, please see Cloudinary's privacy policy at: https://cloudinary.com/privacy.

18 SURVEYS ON THE WEBSITE

During your visit to our website, we may ask you, via a window that opens, whether you knew us before you visited our website. For this purpose, we collect the data mentioned in the server log files. If you answer the question, we also process your answer. This information is evaluated in aggregated form based on our legitimate interest according to Art. 6 (1) S. 1 lit. f) DSGVO to be able to track the effectiveness of our marketing measures. We store information in this context for the duration specified by IU to fulfil the task and delete the data thereafter.

19 RIGHTS OF THE AFFECTED PERSONS

You may contact IU either in writing or by email at datenschutz@iu.org to exercise the following rights:

• Access to your data to control and verify it,

• obtain a copy of your personal data,

• rectification, erasure or restriction of processing, this includes the right to complete incomplete or inaccurate data by supplementary communication,

• Right to object to processing: please note that in accordance with Art. 21 DSGVO, you have the right to object to the processing of personal data processed by us on the basis of legitimate interests as defined in Art. 6 (1) S. 1 lit. f) DSGVO; a right to object to the processing insofar as it is based on grounds relating to your particular situation; insofar as the objection is to the processing of personal data for the purposes of direct marketing, you have a general right to object without the requirement to specify a particular situation,

• You may receive your provided data in a structured, commonly used and machine-readable format and transfer this data to another controller, provided that you have given your consent to the processing or the processing is based on a contract.

• If you have given us your consent to process your personal data, you can revoke this consent at any time with effect in the future.

You also have the right to complain to a supervisory authority in connection with the processing of your personal data. To exercise this right, you can contact the authority responsible for your place of residence or the authority responsible for the registered office of IU in Thuringia: The Thuringian State Commissioner for Data Protection, Häßlerstraße 8, 99096 Erfurt.

20 AUTOMATED DECISION-MAKING AND PROFILING

With the exception of the services described in the context of Google Analytics and Google Signals, your personal data will not be used by IU for profiling purposes. By visiting our website, we place cookies from the various providers, provided you have given your consent in this regard. Through the cookies that you have allowed, data is generated as described in the server log files. This data is brought together and combined by IU with the help of a Google solution. For this purpose, IU has concluded a processing agreement with Google, with registered offices at Gordon House, Barrow Street, Dublin 4, Ireland, which includes EU standard contractual clauses. If we receive information about you through our website, for example, because you ask us to send you information material or contact us, then we store your data and combine it with the data generated by cookies. Additionally, we receive reports from Google Analytics with data that we also combine with your data. For more information, please see the section on Google Analytics. With the help of your consent regarding the data generated via our website, we store this data in a CRM solution. We analyse the data to see whether you are only interested in a course of study we offer or whether you have also applied and improve your data record with corresponding information. We store this profile created about you in a Salesforce solution from the provider Salesforce, with its registered office at Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England. The legal basis for the data processing carried out here is your consent in accordance with Art. 6 (1) S. 1 lit. a) DSGVO, which you can revoke at any time with future effect by contacting datenschutz@iu.org.

21 WHY IS YOUR PERSONAL DATA COLLECTED?

You may choose not to provide us with your personal data or to provide us with incomplete personal data. In such a case, for instance, if you prevent the storage of a cookie, this may prevent you from using all the functionalities of the website.

22 COMMUNICATION WITH JOURNALISTS AND PRESS REPRESENTATIVES

IU processes from representatives of the press and journalists their names, contact details, information about professional activities and the content of the communication for the purpose of press and public relations work and direct communication. The legal basis for the processing of personal data is Art. 6 par. 1 lit. f) GDPR. The legitimate interest for the processing is the implementation of public relations and press work, which is why we maintain a press distribution list. For the email press distribution list we use the services of Meltwater (Meltwater Deutschland GmbH, Rotherstraße 22, 10245 Berlin). You may unsubscribe from the press distribution list by clicking on the link that is included at the end of each email. We have entered into a data processing agreement with Meltwater in accordance with Art. 28 GDPR.

For the provision of a user-friendly newsroom and for the publication of press content, we use PressPage (PressPage B.V., Joan Musykenweg 22, 1096 CJ Amsterdam). We provide a contact form on our website that you can use to get in touch with us. For this purpose, we process the mandatory information requested there (first and last name, e-mail address, medium) as well as other optional information that you provide to us. We also use PressPage to manage your request. We have entered into a data processing agreement with PressPage in accordance with Art. 28 GDPR.

Employees involved in public and press relations have access to the data. We process the personal data for the period in which we occasionally provide press representatives and journalists with information. We delete contact data upon request or after we have become aware that an activity for the press or in the area of public relations is no longer being carried out.

You'll find all of the important information about your study programme and IU International University of Applied Sciences in your personal brochure.