0 PRIVACY NOTICE

0.1 Data Protection Information for Websites

​​​This Privacy Notice explains how your personal data is processed in connection with the use of this website and the provided functionalities, such as the menu for ordering information, a blog and search functions (hereinafter collectively referred to as the „Website“), and other processing operations described below.

This Website uses SSL or TLS encryption for security and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries submitted to the data controller). You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser line.

0.2 Data Protection Information for Use of Safe (IU File Sharing Portal)

This Privacy Notice explains how your personal data is processed in connection with the use of Safe, IU’s portal for file sharing (hereinafter referred to as „Website“). 

This Website uses SSL or TLS encryption for security and to protect the transmission of personal data and other confidential content. You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser line.

1 GENERAL

1.1 Data Controller and Data Protection Officer

This Website is operated by IU Group N.V., Square Ambiorix 10, BE-1000 Bruxelles („IU Group“). IU Group is the data controller for the processing of your personal data.

IU Group processes your personal data on a subject-related basis in joint controllership with other companies belonging to the Group (all with their registered office at Ridlerstraße 47, 80339 Munich, Germany, unless otherwise stated).

• Activities in connection with the operation of the IU International University are carried out in joint controllership with IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt ("IU"), also with regard to its study programs including getting into contact and the provision of information.

• For central services within the Group, such as controlling, accounting and personnel administration, office, process and quality management, purchasing and sales, as well as other services, the aforementioned companies receive support of IU Corporate Services GmbH, Baunscheidstr. 17, 53113 Bonn and IU Corporate Functions GmbH, Ridlerstraße 57, 80339 Munich, which are jointly responsible for data processing;

• IU IT Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, with regard to the provision of the operational IT infrastructure including hardware and software, telecommunication and electronic communication;

• IU Examination Service GmbH for services in the field of examination supervision; IU Marketing Service GmbH as well as IU Sales Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, for services in the area of marketing and sales (this also includes marketing via this website and the operation of the applicant portal for students);

• IU Commercial 1 GmbH for the management of the online campus and IU Commercial 2 GmbH for the management of the campus locations and with regard to the campus programs;

• IU Student Services GmbH together with the respective GmbH that exists for the respective location and is named after its city name, e.g. IU Köln GmbH or IU Hamburg GmbH, for the support of prospective students and students, in particular student advising.

We can provide you with excerpts from the joint controller agreement. If you would like to receive an excerpt, please contact datenschutz@iu.org.

IU Group has appointed Dr. Annette Demmel, SPB DPO Services GmbH, An der Buche 4, 13465 Berlin, annette.demmel@spb-dpo-services.com, as the data protection officer for the aforementioned companies.

You can contact IU Group either in writing or per email at datenschutz@iu.org.

1.2 Recipients

Unless otherwise described in the context of a certain processing, only those IU employees, who are responsible for performing a specific task have access to your personal data. In addition, employees who are responsible for operating our IT systems may have access to some of your personal data as part of their job, e.g., administering an application or performing IT security control tasks. Our employees are obligated to maintain the confidentiality of all personal data.

In the course of our business activities, we rely on the support of various service providers, in particular for the aforementioned purposes as well as for the operation of our IT systems. If the service providers we use have access to personal data, we have entered into the necessary agreements to protect your personal data; in particular, we have concluded data processing agreements in accordance with Art. 28 GDPR, in which we oblige our service providers to maintain confidentiality. Furthermore, banks may receive personal data for the purpose of processing payments, or lawyers, tax advisors and auditors may receive personal data in the course of their work for us. In some cases, we transmit personal data due to legal obligations. In the event of a suspected criminal offense or during investigative proceedings, data may be transmitted to the police and public prosecutor’s office. For further information about who has access to your personal data when using the individual applications, please refer to the description of the respective application.

1.3 Transfers to Third Countries

If we transfer data to service providers in so-called third countries, this is described for the respective application. Some of these third countries do not have an adequate level of data protection. An overview of third countries for which an adequate level of data protection has been confirmed by the EU Commission can be found here: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en. Particularly in the case of data transfers to the USA, there is a risk that your personal data will be processed by the authorities there for control and monitoring purposes without you becoming aware of this or having sufficient legal remedies available to you. We routinely safeguard transfers to third countries by using the so-called EU standard contractual clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. If some providers use binding internal corporate rules for data protection or the transfer is secured because a company is certified according to the Data Privacy Framework (see https://www.dataprivacyframework.gov/s/program-overview), this is explained in the individual applications. If the use of individual applications is optional or alternatives are available, we point this out and - if you do not want to use the alternatives - process your personal data in such cases only on the basis of your separate consent to legitimize the data transfer in accordance with Art. 49 (1) a) GDPR.

1.4 Consent

If you have given your consent to a processing activity, you may withdraw this consent at any time with effect for the future without providing a reason. For this purpose, please use the methods for contacting IU mentioned above or change the switch settings if you have given your consent via the selected switch settings.

1.5 Retention

It is our general policy to delete your data as soon as it is no longer needed for the required purpose and if there are no retention obligations. We usually delete your personal data within a short period of time, e.g. within a few months after the conclusion of any counseling. Unless special circumstances regarding deletion are described for the respective application, we process your personal data in accordance with the various retention periods under university or funding law for up to 15 years or in accordance with retention periods under tax and commercial law for a period of six to ten calendar years after the conclusion of a transaction or after the end of the contract. If you object to any processing under Art. 21 (2) GDPR, we will delete your data  without delay, but no later than one month after your objection, unless otherwise required by law or if we are obligated to block the data. If the processing takes place on the basis of your consent and you withdraw your consent or the processing ends for other reasons, we will process the information necessary to prove that consent had previously been granted, i.e. date, time, details of the granting and subject of the consent, for a period of three years after the processing based on consent ends.

2 Data Collection When Visiting the Website

​When using our Website for informational purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called „Server Log Files“). When you access our Website, we collect the following data, which is technically necessary in order to display the Website for you:

·       Our Website visited

·       Date and time of access

·       Quantity of data transmitted in byte

·       Source/reference from which you reached the page

·       Browser used

·       Operating system used

·       IP address used

The processing takes place in accordance with Art. 6(1)(b) of the General Data Protection Regulation (“GDPR”) on the basis of your use of our Website and our interest in improving the stability and functionality of our Website in accordance with Art. 6(1)(f) GDPR.

We process your data in order to provide you with a functional website, retain the data for the duration specified by IU for this purpose and delete your data thereafter.

Only employees of IU who are responsible for maintaining the Website receive access to your personal data.

We use third-party services on our Website. Further information about these services and the related data processing is found in this Privacy Policy or the cookie settings [Insert Hyperlink to cookie settings].

3 Cookies

​Depending on your browser settings and whether you have given us your consent, cookies may be used when you visit this Website in order to extend the functionality of the Website and make it more convenient for you to use. Cookies are small text files that are stored on your computer. Most of the cookies used by IU are deleted from your hard drive at the end of the browser session („Session Cookies”). In addition, IU uses so-called permanent cookies („Persistent Cookies”), which remain on your device in order to recognize you the next time you visit the Website. If cookies are used, they collect and process to an individual extent certain user information such as browser and location data, IP address values and as described in the Server Log Files. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

An overview of the cookies used and the duration of the respective cookie storage can be found in the cookie settings in our Cookie Consent Tool [Insert Hyperlink to cookie settings].

If personal data is also processed through individual cookies used by us, the processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our Website (so-called „Necessary Cookies”) or in accordance with Art. 6(1)(a) GDPR on the basis of your consent for all other cookies (marketing and analysis cookies).

Please note that you can configure your browser in such a way that you are informed about the use of cookies and can decide individually whether to accept or to refuse to accept them in certain cases or in general. Each browser differs in the way it manages cookie settings. Cookie settings are described in the help menu of each browser, which explains how you can change your cookie settings.

Please note that if you do not accept cookies, the functionality of our Website may be limited.

4 Cookie Consent Tool

​​This website uses a so-called cookie consent tool of Usercentrics GmbH, Rosental 4, 80331 Munich, Germany (the „Cookie Consent Tool“) to obtain consent to the use of cookies and cookie-based applications that require consent.

By integrating a corresponding JavaScript code, users are shown a banner when they access our Website, in which consent for certain cookies and/or cookie-based applications can be given by ticking the appropriate box.

The Cookie Consent Tool blocks the use of all cookies requiring consent until the respective user grants the corresponding consent by ticking the appropriate box. This ensures that cookies of this type are only placed on the user’s device if consent has been granted.

In order for the Cookie Consent Tool to be able to clearly assign page views to individual users and to individually record, log and store the consent settings chosen by the user for a session duration, certain user information, as described in the Server Log Files and including the IP address, is collected by the Cookie Consent Tool when our Website is accessed, transmitted to servers of the Cookie Consent Tool and stored there. For further details, please refer to the information provided in each case in the Cookie Consent Tool.

The data processing carried out by the Cookie Consent Tool takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in a legally compliant, user-specific and user-friendly consent management for cookies and thus our legitimate interest in our Website being lawfully designed.

We have concluded a data processing agreement with Usercentrics GmbH, which obligates Usercentrics GmbH to protect the data of visitors to our Website and to refrain from disclosing such data to third parties.

We process your data for this purpose for the duration of your session and delete your data thereafter, unless you have given your consent to the use of cookies, in which case we process your data for the duration specified for each cookie.

For further information on the use of data by Usercentrics GmbH, please refer to Usercentrics’ Privacy Policy at https://usercentrics.com/privacy-policy/.

5 Contact (e.g. by email)

If you contact us by e-mail, we process the information necessary to answer your contact request, e.g. your e-mail address, the information you provide and the date and time of the contact. If you also provide us with your name and other personal data, we also process these.

If you conduct an online meeting with us or request consultation with regard to the studies, we additionally process your name displayed, if applicable your profile picture, preferred language, date, time, meeting ID, if applicable your phone number, as well as exchanged texts, audio and video data. To handle our communications, we use Microsoft 365, Microsoft Teams, both services are provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") and Zoom Video Communications, Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA („Zoom“).

The legal basis for this processing is Art. 6 (1)(b) GDPR or Art. 6 (1)(a) GDPR for such information that is not absolutely necessary for the meeting and that you provide to us voluntarily. We process your data in order to respond to your inquiry or conduct a consultation. Your personal data will be retained in each case for the period determined by IU in order to perform the task and will be deleted thereafter. This is based on the retention periods under commercial and tax law. Only employees of IU who are responsible for responding to contact requests will receive access to your personal data.

We have concluded data processing agreements with Microsoft and Zoom based on the EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. For more information on data processing by Microsoft, please visit https://privacy.microsoft.com/de-de/privacystatement and for Zoom https://explore.zoom.us/en/privacy/.

5.1 Free Call-Back Service

​If you use our free call-back service, we will process your first and last name, your email address, if applicable, your telephone number, the desired call-back time (date and time) and a message to us in order to call you back about the matter you have specified. The legal basis for this processing is Art. 6(1)(b) GDPR. If we do not reach you by telephone and you have given us your consent to do so in accordance with Art. 6(1)(a) GDPR, we will contact you by email. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. Only employees of IU who are responsible for handling corresponding inquiries receive access to your data. As part of our telephone customer support, we may occasionally record telephone calls for training and quality control purposes. Should this be the case, you will be informed about this separately and can give your consent in this regard.

5.2 WhatsApp

Communication prior to an application

​If you decide to communicate with us via WhatsApp prior your application or as part of your application for admission or during your studies, we will process your personal data, such as your telephone number, your picture, your status information and your name if you provide us with this information. In addition, we process any personal data that you communicate to us via WhatsApp. In this regard, we recommend that you only provide us with the information that is absolutely necessary to answer your request and refrain from providing any additional information. We use a chat bot based on artificial intelligence in our WhatsApp channel. The functionality and data processing of this is described in the following section. Whether you use WhatsApp is up to you, and you can receive the same information by phone, electronically and/or regular mail.

Communication After Application

We use WhatsApp to provide you with information through an additional channel regarding events, schedule changes, room changes, modifications to your course of study, and individual information, including those provided by the student secretariat. The legal basis for processing is Article 6(1)(a) of the GDPR, your consent to the use of WhatsApp. To this extent, we process your personal data such as your phone number, image, status information, and your name if you provide it to us. Additionally, we process any personal data you transmit to us via WhatsApp.

Data processing

IU processes your personal data in order to communicate with you. The legal basis for this data processing by IU is your use of our WhatsApp channels in accordance with Art. 6(1)(a) GDPR.

You can withdraw your consent to the processing of your personal data at any time. The withdrawal can be made via the specified contact options. The declaration of withdrawal does not affect the lawfulness of the processing carried out so far.

The data processing by WhatsApp is governed by the Privacy Policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, which can be found at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy.

WhatsApp is a telecommunications service offered by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and a company of Meta Inc.

Access to your personal data is granted to those IU employees who manage our WhatsApp channels. IU uses a software solution of the provider Twilio, which does not require an app installation. Even if the use of the software solution largely excludes access to data by WhatsApp, it cannot be ruled out that employees of WhatsApp or Meta may also receive access to your personal data. Likewise, it cannot be ruled out that your data will be stored on WhatsApp servers in the United States of America. WhatsApp LLC and Meta are certified under the Data Privacy Framework. You can find further information in this regard in WhatsApp’s Privacy Policy, if applicable. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted.

If we use a chatbot based on artificial intelligence or another artificial intelligence in our WhatsApp channel that processes your personal data, we will inform you of this in advance within the WhatsApp channel. The exact functionality of the chatbot and the associated data processing is described in more detail in the following section.

 Here is the English translation:

5.3 ChatBot

IU uses an AI-powered chatbot on its website that helps with questions about operational matters and studying. Chatbots are programs that simulate an online dialogue and generate responses using artificial intelligence. This means that you are not chatting with an IU employee, but with an artificial intelligence. The underlying AI technology for the chatbot is provided by ElevenLabs, Inc., 169 Madison Ave #2484, New York, NY 10016, USA ("ElevenLabs").

When using the text chat, we process the following categories of personal data: timestamp, IP address or location data, chat history, a user identifier (User ID), and the Google Click Identifier (GCLID). If you identify yourself in the chat, we additionally process your name, your email address, and — if you request a callback — your phone number. If you use voice mode, we additionally process a transcript of your voice input. The data collected in the chat is not used to train AI models.

The legal basis for processing in the text chat is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR in conjunction with § 25(1) TDDDG (German Telecommunications-Telemedia Data Protection Act). You may withdraw your consent at any time with effect for the future via the cookie settings. Access to your personal data is granted to those IU employees who are responsible for handling inquiries.

ElevenLabs processes your data on servers within the European Union. We have entered into a data processing agreement with ElevenLabs. Further information on data processing by ElevenLabs can be found at https://elevenlabs.io/privacy-policy. Your personal data is stored for the period determined by IU with regard to fulfilling its tasks, and is deleted thereafter. To safeguard any possible data transfers to the USA, ElevenLabs is also certified under the Data Privacy Framework.

5.4 Telephone AI Voice Assistant (Inbound Calls)

When you contact us by phone, your call may first be answered by an AI-powered voice assistant, which serves as the first point of contact for simple inquiries and, if needed, transfers you to an employee. If you interact with an AI during a call, you will be informed at the start of the conversation that you are speaking with an AI voice and not a natural person. You may opt out of interacting with an AI at any time and speak with an IU employee instead. The underlying AI technology is provided by ElevenLabs, Inc., 169 Madison Ave #2484, New York, NY 10016, USA ("ElevenLabs"). For the technical connection and routing of the telephony, we use the service Twilio provided by Twilio Ireland Limited, 78 Sir John Rogerson's Quay, Dublin 2, D02 R296, Ireland ("Twilio").

During the call, we process the following categories of personal data: your phone number, the timestamp of the call, the audio data of your voice input, a transcript of the conversation, the content of your inquiry, and a case/reference identifier. If you identify yourself or provide this information to us, we additionally process your name, your email address where applicable, and — if you request a callback — an alternative callback number. The data collected during the call is not used to train AI models.

The legal basis for the processing is Art. 6(1) sentence 1 lit. b) GDPR, insofar as your inquiry concerns the initiation or performance of a study contract, and otherwise Art. 6(1) sentence 1 lit. f) GDPR, in order to safeguard our legitimate interest in efficient telephone accessibility and automated initial processing of your inquiries. Call recording only takes place with your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, about which you will be separately informed at the beginning of the call. You may withdraw your consent at any time with effect for the future. Access to your personal data is granted to those IU employees who are responsible for handling inquiries. Your personal data is stored for the period determined by IU with regard to fulfilling its tasks, and is deleted thereafter.

ElevenLabs processes your data on servers within the European Union. As part of the telephony handled via Twilio, data may be transferred to Twilio Inc., 101 Spear Street, 5th Floor, San Francisco, CA 94105, USA. We have entered into a data processing agreement pursuant to Art. 28 GDPR with both ElevenLabs and Twilio. Further information on data processing is available from ElevenLabs at https://elevenlabs.io/privacy-policy and from Twilio at https://www.twilio.com/en-us/legal/privacy. To safeguard any possible data transfers to the USA, both ElevenLabs and Twilio are certified under the Data Privacy Framework.

5.5 Unibuddy

IU uses a live chat provided by Unibuddy Ltd, Third Floor, 20 Old Bailey, London EC4M 7AN, United Kingdom ("Unibuddy").  The live chat is conducted by students or other individuals who can provide information on the topics requested. To use Unibuddy, you are required to create an account with Unibuddy in accordance with Unibuddy's terms of use and privacy policy. When using Unibuddy, IU processes your name, email address, phone number (if you provide it), and the time of your request in its Salesforce CRM system, provided by Salesforce, Floor 26, Salesforce Tower, 110 Bishopsgate EC2N 4AY London, United Kingdom, and in this way can determine whether you have previously made an inquiry to IU and whether and when your inquiry was answered. The EU Commission has issued an adequacy decision for the United Kingdom. To safeguard potential data transfers to the US, Salesforce is certified under the Data Privacy Framework. The processing of your personal data is carried out with your consent on the basis of Art. 6 para. 1 lit. a) GDPR. You can withdraw your consent at any time by addressing to the specified contact options. The withdrawal does not affect the lawfulness of the processing that has taken place to date.

Access to your personal data will be granted to those IU employees who are in charge of the live chat via Unibuddy. When transferring your data from Unibuddy to our CRM system, it may be stored in the United States of America. For this purpose, a contract has been concluded that includes the EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. In each case, your personal data will be stored for the period of time determined by the IU with regard to the performance of the task and then deleted. For more information on data processing by Unibuddy, please refer to Unibuddy's privacy policy, which can be found at https://unibuddy.com/privacy-policy/.

5.6 Typeform

​We use Typeform provided by TYPEFORM SL, C/Bac de Roda, 163 (Local), 08018 Barcelona, Spain (“Typeform”) for some contact forms. You can tell that we use Typeform because “Typeform” is displayed as a logo at the bottom right of the screen. Typeform allows us to provide you with an easy way to contact us.

For this purpose, we share the following personal data with Typeform:

·       Email address*

·       First name*

·       Last name*

·       Telephone number

Mandatory fields are marked with *.

Typeform is a recipient of your personal data and acts as a processor for us, which is why we have concluded a data processing agreement with Typeform. The legal basis for these processing operations is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent to the processing of your personal data at any time. The withdrawal can be made via the specified contact options. Your data will be processed until your request has been answered. By withdrawing your consent, the legality of the processing that has taken place so far will not be affected.

The data is retained exclusively for the purpose of transmitting and responding to requests. The mandatory data is used for assigning and responding to your requests. You can also choose not to provide us with your personal data using such a contact form. Alternatively, you can contact us at the email address provided in this Notice.

In addition to the data mentioned above, Typeform collects the following personal data with the help of cookies: Information about your device (IP address, device information, operating system, browser settings). Furthermore, usage data is collected, such as the date and time when you used the contact form. Further information can be found at: https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data.

For further information regarding objection and deletion options in relation to Typeform, please refer to: https://admin.typeform.com/to/dwk6gt.

6 Online Information Events AND STUDENT COUNSELING

​6.1 Study counseling

If you request study counselling, we process the following categories of personal data: Name, contact data, time and date of contact, various counseling data, possibly data on your origin, health or income. The purpose of the processing is to provide advice to prospective students about studying and university entrance qualifications. The processing is carried out pursuant to Art. 6 par. 1 (b) GDPR for the conclusion of a study contract. With regard to special categories of personal data, processing is based on your express consent pursuant to Art. 9 par. 2 (a) GDPR. Access to your personal data is granted to employees of the IU who are active in the area of student advising. We process your personal data for the period of the study counseling.

6.2 Appointment booking for study counseling (optional – excluding academy)

For the purpose of simplified appointment booking for student advising, we use the service Calendly, offered by Calendly, LLC, 88 N Avondale Road #603, Avondale Estates, GA 30002, USA ("Calendly"). When using the service, in addition to the time slots and information you provide in the appointment booking, we process your display name, email address, preferred language, and date, time of use. The legal basis for the processing of your personal data is your consent pursuant to Art. 6 par. 1 a) GDPR. We would like to provide you with a user-friendly and efficient appointment booking option and require your consent for this, as your data will be transferred to the USA; the USA has a lower level of data protection compared to Europe and there may not be sufficient legal protection against data access by government agencies. The connection to Calendly is only established if you use the offered booking function, which you are not obliged to do. Alternatively, you can choose other contact options to make an appointment. Access to your data is granted to IU employees who provide student advising and activate slots in Calendly. IU has entered into an order processing contract with Calendly. Calendly is certified under the Data Privacy Framework.

6.3 Appointment booking for study counseling (obligatory – academy)

For the purpose of scheduling appointments for mandatory academic advising, we use the service Calendly, offered by Calendly, LLC, 88 N Avondale Road #603, Avondale Estates, GA 30002, USA ("Calendly"). When using the service, we process your first and last name, email address, and telephone number. In addition to the time slots and the information you provided during the appointment booking, we also process your preferred language, as well as the date and time of use. The legal basis for processing your personal data is the performance of pre-contractual measures in accordance with to Art. 6 par. 1 b) GDPR. IU employees who conduct academic advising and manage slots in Calendly will have access to your data. IU has signed a data processing agreement with Calendly. Calendly is certified under the Data Privacy Framework.

6.4 General information events

If you register to participate in an online information event via our Website, then we process your first and last name and your email address in addition to the data mentioned under Server Log Files. We process your data on the basis of to Art. 6 par. 1 b) GDPR in order to send you an invitation to our online information event. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. You will receive information on the processing of your data by the provider of the video conferencing tool when you receive the invitation.

We will store information about your completed registration in your browser and, by using a cookie, information in the fields you populated subject to your consent, so that you can use the pre-filled fields when you register again and you will be shown for which event you are already registered. We process your data on basis of Art. 6 (1) (a) GDPR. You can withdraw your consent for the local storage in the browser and the processing of your data for the purpose of pre-filling the fields separately at any time with future effect. You can declare your withdrawal by using the cookie consent tool and declare it by emailing datenschutz@iu.org.

6.5 Virtual Open Campus Events

If you register to participate in a Virtual Open Campus Event via our website, we will process the necessary information for the event, including your first and last name and your email address, in addition to the data mentioned in the server log files. If you also provide us with your phone number, we will process that information as well. We process your data based on Art. 6 par. 1 b) GDPR, or Art. 6 par. 1 a) GDPR for any information that is not strictly necessary for participation in the event and that you voluntarily provide to us. We process your data to send you a personalized invitation to our virtual Open Campus Event and to provide you with advice. Your personal data will be stored for the period defined by the IU based on the fulfillment of specific tasks and will be deleted thereafter.

To conduct the virtual Open Campus Events, we use “gather.town,” a service provided by Gather Presence Inc., 2261 Market St #4095 San Francisco, CA 94114 (“Gather”). Gather is certified under the Data Privacy Framework. You can find information about the processing of your data by the provider Gather here, and you will receive it with the invitation.

6.6 Information events for practice partner search

If you register via our website to participate in an information event for practice partner search, we process your first and last name and your e-mail address, in addition to the data mentioned under the server log files. We process your data with your consent on the basis of Art. 6 par. 1 a) GDPR in order to send you an invitation to our info event. The event is booked via MS Bookings; please see data protection information in the Application/Schedule Booking section. The processing of your data to conduct the event and send you the results is based on Art. 6 par. 1 f) GDPR due to our legitimate interest in facilitating your search for practice partners. The lists of participants generated on the occasion of the event for sending the results are deleted 24 hours after the event. The list compiled for you is visible to the responsible study advisor for the duration of the advisory process.

7 Newsletter

​​With your consent, you can subscribe to our newsletter, which we use to inform you about current interesting offers concerning 1) our degree programs, discount campaigns on tuition fees and study-related information events 2) information about entrepreneurship 3) alumni, discount campaigns for alumni and other activities for our graduates 4) event and publication information from members of the research network. We will personalize such information, based on your interests as well as your previous use of our website and our offers, provided that you have given us separate consent to do so via the cookie selection. You can withdraw your consent to receive the newsletter at any time. You can withdraw your consent by clicking on the link located at the end of the newsletter or by sending an email to abmeldung@iu.org.

If you register to receive our newsletter, we use the so-called double opt-in procedure: after receiving your registration, we send an email to the specified email address. In this email we ask you to confirm that you wish to receive the newsletter. If you confirm your registration to our newsletter, we store your email address, IP address and the time of registration and confirmation. The purpose of this processing is to be able to prove your registration and, if necessary, to clarify any possible misuse of your personal data. The legal basis for this processing is your consent in accordance with Art. 6(1)(a) GDPR. In order to send you our newsletters, we use the services of external service providers, some of which are located outside the EU. In such situations, we conclude data processing agreements that incorporate EU Standard Contractual Clauses. You can obtain a copy of these clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. We store your consent for three years after the end of the year in which you withdraw your consent.

8 FREE INFO BROCHURE, FINANCING CHECK, CV-GENERATOR

8.1 Request for Free Info Brochure

​If you request information material to be sent to you electronically, we will process your title, first and last name, email address, telephone number and address (if applicable) and details of the subject of the requested information in order to provide you with the information material. The legal basis for this processing is Art. 6(1)(b) GDPR. If we do not reach you by email and you have provided us with your consent in accordance with Art. 6(1)(a) GDPR, we will contact you by telephone. Access to your data will be granted to those employees who are responsible for managing and processing such requests as part of their job.

8.2 Financing Check

We provide a financing check on our website which you may use to obtain information tailored to your personal situation on financing options for your studies. With your consent, we will save your entries and send you a code by email, which you can use to access your data again later. Legal basis for data processing is your consent in accordance with Art. 6 par. 1 a) GDPR, which you can revoke at any time with effect for the future by contacting datenschutz@iu.org.

IU employees who are responsible for supporting prospective students will have access to your personal data. We store your data, which we have received in connection with your financial check, in the software of our service provider Salesforce, Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England. The EU Commission has issued an adequacy decision for the United Kingdom. In exceptional cases, Salesforce employees, possibly also from the U.S., may have access to your personal data. IU has entered into a data processing agreement with Salesforce. Salesforce Inc. is certified in accordance with the Data Privacy Framework.

8.3 CV-Generator

If you use our CV generator, we will process your first name and surname, your e-mail address and, if applicable, your telephone number as part of the creation process. Within the CV generator, all information is optional; if you decide to enter it, we will process your title, first and last name, date of birth, contact details such as address, telephone number and e-mail address, information on previous school education, previous courses of study, professional career, other qualifications such as software skills, soft skills, awards, hobbies and interests. The legal basis for this processing is Art. 6 par. 1 b) GDPR. If we are not able to contact you by email and you have given us your consent to do so in accordance with Art. 6 par. 1 a) GDPR, we will contact you by phone. Those employees who are entrusted with the administration and processing of such requests as part of their work will have access to your data. If you have given us your consent to store the form data, you can resume the creation of your CV within seven days.

9 Enrollment for Studies

9.1 Enrollment via the Website

​If you register for a course of study via the website, we process your name, date of birth, nationality, address, contact information (including, for example, your phone number), details of your prior education in the form of certificates/transcripts, letters of recommendation and a CV, your desired program of study, and payment data such as account information, as well as data for the preparation and performance of the education contract concluded with you.

Please note that when uploading a copy of your official identification document, you must redact certain fields. Only the following details are required: surname, first name, date of birth, nationality, and the validity of the identification document. Please also redact the photograph. We additionally require information to verify whether you are eligible to study and that no enrollment barriers exist. Further information you may provide, for example in a CV, that is not strictly necessary to verify eligibility for higher education is voluntary. However, if you wish to have ECTS credits transferred and recognized, information about your previous educational stages is advantageous. We process the additional information in your CV in order to inform you of any possible recognition of prior educational achievements within the course of study and to advise you regarding your choice of study program. If you obtained your higher education entrance qualification through the Abitur, we do not necessarily require information about work experience. If you have completed vocational training or a degree in a field that has no connection or overlap with the desired program of study, we likewise do not require such information in that respect. Please bear in mind, however, that our study advisors have specialized knowledge regarding possible credit transfers that may seem unlikely to you but could nevertheless benefit you.

We process the data required to verify eligibility for higher education on the basis of Art. 6(1) sentence 1 lit. c) GDPR in conjunction with § 70(1) of the Thuringian Higher Education Act (Thüringer Hochschulgesetz) and IU's General Admission and Enrollment Regulations. Information additionally required for concluding the education contract, e.g., your bank details, is processed for the purpose of preparing the conclusion and performance of the education contract pursuant to Art. 6(1) sentence 1 lit. b) GDPR. Your additional voluntary information, which you provide for the purpose of receiving advice, is processed on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. You may withdraw your consent to the processing of the voluntary information at any time with effect for the future. Please use the contact channels of IU mentioned at the outset for this purpose.

Should you save your online application and finish it at a later date, we will send a link to your email address to the location where we store the incomplete information for 30 days so that you may complete it. If you wish to receive an education contract by post, we use your data to compile the information provided so far into a draft and send it to you by post.

If you complete the online application for recognition/credit transfer of prior achievements via the website, we collect your contact details, including name and postal address, email address, phone number, desired program of study, information about your prior education and career history, and information about other qualifications, assessments, and educational or employment certificates/references.

The legal basis for this is Art. 6(1) sentence 1 lit. b) GDPR. You will receive detailed information about the processing of your personal data as part of the registration and recognition process. Access to your personal data is granted to those employees who are responsible for supporting applicants in IU's enrollment office or admissions office.

We process the phone number you provide for carrying out multi-factor authentication in connection with your logins to our systems. This serves the purpose of maintaining adequate security measures in line with the current state of the art, which are intended to prevent unauthorized access both to our systems and to your user accounts with us, and thus ultimately to your data. As part of multi-factor authentication, when logging into our system you may receive a code via SMS to your phone number, which you can then enter in the login area to verify that this is an authorized access request. This processing is therefore carried out pursuant to Art. 6(1) sentence 1 lit. f) GDPR in order to safeguard our legitimate interest in the secure operation of our systems. To maintain the multi-factor authentication system, we make use of external IT service providers. Insofar as these providers are given access to personal data, we have entered into the necessary agreements to protect your personal data. Insofar as data is transferred to so-called third countries in this context, we have concluded the EU Standard Contractual Clauses (a copy of which is available at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=de) or the EU-US Data Privacy Framework applies (https://www.dataprivacyframework.gov/s/program-overview).

Personal data that you provide in connection with registering for a course of study is stored for the duration of your studies and in accordance with statutory retention periods (six to ten years pursuant to the German Fiscal Code (Abgabenordnung) and the German Commercial Code (Handelsgesetzbuch)). Data collected as part of an application for the possible recognition/credit transfer of prior achievements is stored for twelve months from the date the application is submitted. If no enrollment takes place within this period, the application, including all supporting documents, is deleted.

For further information, please refer to the privacy notice for students, which you receive together with the documents for registering for a course of study.

9.2 Further Information on the Use of Artificial Intelligence in the Application Process

We review your study application documents with the assistance of artificial intelligence. In doing so, we use ChatGPT, a product of OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA ("OpenAI"). We use a protected version in which input data is not used to train OpenAI and is processed solely for IU's purposes. Your application documents are made accessible to OpenAI and then checked to determine whether your documents are complete, appear plausible and coherent (e.g., whether the name on your certificates matches), and whether all admission requirements for the desired course of study are met. In the case of complete documents with a negative result, a full human review is carried out immediately. In the case of incomplete documents, an automated message is generated and sent to you, asking you to check the completeness of your documents. This message will indicate that it is an automatically generated message. In the case of a positive result, a further human review is carried out to ensure compliance with all applicable legal requirements. No automated decision-making or profiling takes place.

Other than the users we select to whom we grant access for the purpose of carrying out the application process, IT administration, or AI application support, no one is given access to your personal data through the use of OpenAI. After analysis of the application documents, your personal data in OpenAI is deleted within a few days. We use the protected version of OpenAI on servers within the EU, operated by Microsoft Ireland Operations Ltd, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland, with subprocessor Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). Microsoft is certified under the EU-US Data Privacy Framework (https://www.dataprivacyframework.gov/s/program-overview). Further information on safeguarding international data transfers can be found in the section "Transfers of personal data to third countries." Information on data processing by Microsoft can be found at: https://privacy.microsoft.com/en-us/privacystatement.

9.3 Reminders

We process your phone number in order to notify you of circumstances that may lead to early termination of the contract. We do this, among other reasons, to fulfill our transparency obligations and to avoid unnecessary disadvantages for you. The legal basis for the processing is Art. 6(1) sentence 1 lit. c) GDPR. For this purpose, we send messages via WhatsApp and make use of the service provider Twilio Inc, 101 Spear St FL 5, San Francisco, CA 94105, USA, as data processor. Twilio Inc. is certified under the Data Privacy Framework. Further information on data processing by Twilio Inc. is available at https://www.twilio.com/en-us/legal/privacy.

9.4 Use of Service Providers for Identity Verification

We process identification document data to protect ourselves against attempted fraud. For this purpose, we send a link to the IDnow platform, on which applicants undergo an identity verification process. In doing so, we check whether the ID data provided, in particular first name, surname, and date of birth, match the applicant's personal data. We also check, using the document number and issuing country, whether the document has already been used for registration. Access to your personal data is granted only to those IU employees responsible for checking identification documents. For this process, we use the service provider IDnow, IDnow GmbH, Auenstr. 100, 80469 Munich, Germany. Your data is processed within the European Economic Area. We have entered into a data processing agreement with the service provider pursuant to Art. 28 GDPR for this purpose. IDnow's privacy policy can be found here: https://www.idnow.io/de/datenschutzerklaerung/. The legal basis for this processing is Art. 6(1) sentence 1 lit. f) GDPR — our legitimate interest in preventing attempted fraud.

9.5 Visa Data of International Students

As part of our application process and student administration, we process visa data for international applicants and students. The processing of visa data serves to verify the authenticity and validity of the submitted visa in preparation for concluding the contract and for enrollment, as well as to carry out the study relationship (e.g., clarifying study-related attendance eligibility). For applicants in on-campus study programs, presentation of a valid visa is required as part of the admission and enrollment process. Without this information, the education contract cannot be performed and participation in academic operations cannot be enabled. For this purpose, we process the following visa details: date of issue, period of validity including expiry date, visa type, and the issuing authority (e.g., the responsible consulate). The legal basis for the processing is Art. 6(1) sentence 1 lit. b) GDPR, insofar as the processing is necessary for the initiation and performance of the education contract, in particular verification of authenticity and validity during the admission and enrollment process, and ensuring eligibility for study-related participation.

We also process visa data to remind you of upcoming visa renewals and to avoid study-related interruptions due to an expired visa, for study organization, for targeted information and reminders, for internal planning (including assessment of study-related risks due to expiring visas), and to create aggregated statistics, on the basis of Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interests lie in maintaining orderly academic operations, avoiding study-related disadvantages, and improving our services, in particular targeted support for students from certain countries with regard to residence status and deriving trends that we can respond to with our offerings.

Insofar as we are legally required in individual cases to provide information to authorities or submit data, we process or transmit the data on the basis of Art. 6(1) sentence 1 lit. c) GDPR in conjunction with the relevant statutory provisions.

Within the university, access to your data is granted only to those employees responsible for admissions and enrollment, the student registration office, and employees entrusted with visa matters. Data is transmitted to public authorities (e.g., immigration authorities) only where there is a legal obligation to do so. Your data is processed in a CRM solution provided by Salesforce, with registered office at Floor 26 Salesforce Tower, 110 Bishopsgate, EC2N 4AY London, England. We have entered into a data processing agreement with Salesforce. The EU Commission has issued an adequacy decision for the United Kingdom. To safeguard possible data transfers to the USA, Salesforce is certified under the Data Privacy Framework.

We use a submitted visa copy exclusively to verify authenticity and validity and delete it immediately after the review is completed; if the original document is presented on campus, no copy is made. We store the data taken from the visa for applicants who are not enrolled for a maximum of six months after conclusion of the application process. For enrolled students, storage continues until de-registration and for a further maximum of twelve months thereafter. Longer storage takes place only insofar and as long as this is necessary for the assertion, exercise, or defense of legal claims, or where statutory retention obligations preclude deletion.

10 APPLICANT PORTAL FOR STUDENTS

10.1 Registration for the Application Portal

As part of the online application for a course of study, you are provided with the application portal (hereinafter collectively referred to as the "Application Portal") for use, offering functionalities such as uploading your data and documents and describing your knowledge and skills. If you use other functions, such as participating in an information session or an interview, these activities take place outside the Application Portal. You will receive separate information about the data processing carried out in that context.

When you register for the Application Portal, we use the so-called double opt-in procedure, i.e., you receive an email with which you must confirm that you are the holder of the email address. Please note that this is purely a precautionary measure, and sending you a confirmation email has no legal effect. Once you have provided the corresponding confirmation, you will be given access to our Application Portal. The legal basis for this processing is the submission of your application to us pursuant to Art. 6(1) sentence 1 lit. b) GDPR.

In order to make the onboarding process as simple as possible for you — in particular, to give you a clear overview at all times of the status of your application or any missing documents, to facilitate the selection of a practice partner, to request help, or to enable you to change your information — we use the onboarding tool from Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits"). Further information can be found in the section "Use of Product Fruits in our Portals."

Access to your personal data is granted only to those IU employees responsible for allocating study places. We store your personal data in our CRM system from Salesforce, Floor 26, Salesforce Tower, 110 Bishopsgate, EC2N 4AY London, England, from which Product Fruits creates the views mentioned above. In this respect, it may occasionally happen that employees of the service provider gain access to your data, for example when system errors need to be fixed. The EU Commission has issued an adequacy decision for the United Kingdom. To safeguard possible data transfers to the USA, Salesforce is certified under the Data Privacy Framework.

We process your personal data for as long as you keep your profile saved in our Application Portal. If we determine that you have registered for the Application Portal but have not logged in for more than 12 months, we will send you an email informing you that we will delete your data after one month unless you log in again.

10.2 Uploading Your Documents

If you upload your application documents to the Application Portal, we process, in addition to the data mentioned in the server log files, the following categories of data about you:

• Your first and last name,

• Your contact details, such as address, phone number, email address,

• Your CV,

• An application photo, if you attach one,

• Your certificates/transcripts,

• Your letter of motivation,

• In particular, proof of internships, volunteer activities, portfolios of work samples, language certificates

The data mentioned is processed by us in connection with your application, namely to determine whether you meet the requirements and whether we can offer you the desired study place. The legal basis for this processing is Art. 6(1) sentence 1 lit. b) GDPR, i.e., the processing is necessary to carry out pre-contractual measures taken at the request of the data subject.

Access to your personal data is granted only to those IU employees responsible for allocating study places. Your data is processed within the Federal Republic of Germany. We also store your personal data in our CRM system. In this respect, it may occasionally happen that employees of the service provider gain access to your data, for example when system errors need to be fixed. In such a case, your data may also be processed outside the EU. We have entered into a data processing agreement with the service provider pursuant to Art. 28 GDPR for this purpose, which incorporates the EU Standard Contractual Clauses. A copy of the EU Standard Contractual Clauses is available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

In addition, we also make use of various other service providers who support us with our Application Portal. In this context, it may happen that employees of these service providers — for example, those hosting our website — gain access to your personal data in the course of their job functions. Where our IT service providers process personal data, we have entered into a data processing agreement with them pursuant to Art. 28 GDPR. It may also be the case that employees of advisory service providers, such as law firms and/or tax advisors, who are legally bound to confidentiality, gain access to your personal data.

We process your data for the duration of the application process. If you are offered a study place, we process the documents you submitted for the duration of your studies and possibly beyond. Further information will then be provided in the privacy notice for students. If we have not offered you a study place, we process documents containing your personal data for a further period of six (6) months from the date the rejection was sent, and delete your data thereafter, unless you have given us consent that you would like us to retain your documents for a period of one (1) year from receipt of the consent; in such a case, we will only delete your data at the end of that year, or within two (2) weeks of receiving your withdrawal of consent.

10.3 Registration for an Information Session

If you click the "Information Session" field, you will be taken via a hyperlink to a different website. The data processing carried out there is governed by the privacy notice that you can view on that website.

If you register for an information session, we process:

• Your first and last name

• Your phone number/email address, and

• The data described under server log files

in order to hold an information session with you.

The data mentioned is processed by us in order to invite you to an information session. The legal basis for this processing is Art. 6(1) sentence 1 lit. b) GDPR.

Access to your personal data is granted only to those IU employees responsible for conducting the information sessions. If we hold an information session online, we will send you a link to the provider's privacy policy together with the participation link.

Your personal data is processed, stored, and deleted as described under 10.2.

10.4 Applicant Interview

If you have fully uploaded your documents, we may invite you to an interview. In this context, we process the categories of data described in section 10.2. In addition, we then process:

• Your email address,

• Your phone number,

• The appointment arranged with you, and

• The data described under server log files.

We process your data in order to conduct an interview with you, which serves to determine whether we can offer you a study place. The legal basis for this processing is Art. 6(1) sentence 1 lit. b) GDPR, i.e., the processing is necessary to carry out pre-contractual measures taken at your request.

Access to your personal data is granted only to those IU employees responsible for conducting the interview, who support study place applications, and who participate in such an interview. If we hold the interview online, we will send you a link to the provider's privacy policy together with the participation link.

Your personal data is processed, stored, and deleted as described under section 10.2.

10.5 Conclusion of Contract and Enrollment

If we are able to offer you a study place, we process the data described under server log files as well as the data mentioned in 10.2, so that you can conclude an education contract with us and enroll. Information on how we process the personal data of our students will be provided to you upon transmission of the education contract.

10.6 Study Match Quiz

As part of our Applicant Portal, we offer you the opportunity to take the Study Match quiz. This is a mini online assessment center that can help you determine whether dual studies — a mix of theory and practice — are suitable for you. In this context, we ask about your preferences regarding study conditions via free text or multiple choice. We then process the answers you enter, which constitute personal data. We add your answers to your applicant profile in our CRM system. Access to your answers is granted to IU employees from the study advisory department. The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. We store the data for as long as your applicant or student profile exists. For the technical provision of Study Match, we use the provider Alpha Test (alpha-test GmbH, Dynamostraße 15, 68165 Mannheim). We have entered into a data processing agreement with Alpha Test pursuant to Art. 28 GDPR. The Study Match quiz serves only for your own orientation and decision-making assistance; it does not constitute profiling or automated decision-making, since the Study Match quiz has no legal effect on you and you may still decide, for example, to pursue a dual study program despite a possible contrary indication.

11 IU COMPANY PORTAL – PARTNER PORTAL FOR PRACTICE PARTNERS

The Company Portal offers companies and practice partners a platform through which they can find suitable dual-study students for open positions. There, you can report your needs and receive matches — i.e., applicants (from our B2C portal) — as search results based on your input. Furthermore, the Company Portal includes a news page and information about upskilling offerings that can help you retain your students longer within the company.

11.1 Login to the Company Portal

In order to use the IU Company Portal, you must log in. We send you an email including an access link, through which you can set a password. With these login credentials, you can log in to the IU Company Portal.

To provide the login, we use Auth0, an application from the provider Okta, Inc., 100 1st Street, San Francisco, CA 94105, USA. Further information on data processing by the respective providers is available from Auth0 at the following link: https://auth0.com/de. Please also read the notice on the setting of cookies by Auth0 on our consent management platform [insert hyperlink to consent management platform].

As part of the login, we process the following categories of personal data: first and last name, gender, display name, email address, and your display title. The legal basis for this processing is Art. 6(1) sentence 1 lit. b) GDPR, i.e., the processing is necessary to carry out (pre-)contractual measures taken at your request. The purpose of the processing is to enable the login and provide the IU Company Portal.

Access to your personal data is granted to IU employees responsible for administering the IU Company Portal, as well as employees of the respective providers of the applications used for this purpose. Your personal data may be transferred to, or accessible from, third countries. We have entered into a data processing agreement with Okta that incorporates the EU Standard Contractual Clauses. Further information on safeguarding international data transfer is available in the section "Transfer to third countries." Information on data processing by the respective application providers can be found in the section for the respective service. We process your personal data for as long as your account exists.

11.2 Use of the Company Portal

Once you have registered in the Company Profile, you can enter information about your company. In this context, we process the personal data of managing directors and specified email contacts. If your company's name is the actual name of a natural person, we also process this. In addition, we process payment data you provide, and in this context personal data such as the name of the account holder, if this is a natural person.

The legal basis for this data processing is Art. 6(1) sentence 1 lit. b) GDPR, i.e., the processing is necessary for the performance of contractual measures, namely the provision of the Company Portal.

If you create user accounts in our Company Portal that allow your employees to access the Company Portal, we process salutation, first and last name, email address, password, department, position, and phone number. The legal basis for this data processing is Art. 6(1) sentence 1 lit. f) GDPR — our legitimate interest in offering a user-friendly and efficient Company Portal.

If you sign up for notifications, such as our newsletter, the legal basis for this processing is Art. 6(1) sentence 1 lit. a) GDPR, your consent, which you may withdraw at any time with effect for the future.

Access to your personal data is granted only to those IU employees responsible for managing the Company Portal. Your data is stored in a CRM solution provided by Salesforce, with registered office at Floor 26 Salesforce Tower, 110 Bishopsgate, EC2N 4AY London, England. We have entered into a data processing agreement with Salesforce. The EU Commission has issued an adequacy decision for the United Kingdom. To safeguard possible data transfers to the USA, Salesforce is certified under the Data Privacy Framework.

We process your personal data required to provide your account, or which we receive additionally with your consent, for as long as the account exists and for a period of one month after deletion of the account. We delete usage data within seven days. We process payment data in accordance with commercial and tax law regulations for a period of six or ten years after the respective transaction.

If a contract is concluded between your company and a student, we process the personal data necessary for drafting the contract, such as company, payment, and user data, together with information on the training location, vacation entitlement, expense allowance, and coverage of the cost of a semester ticket. The legal basis for this processing is Art. 6(1) sentence 1 lit. f) GDPR — our legitimate interest in offering a user-friendly and efficient Company Portal.

If you wish to contact us, we process your name, your email address, and your inquiry; if you contact us via WhatsApp, we process your phone number instead of your email address. If you send us attachments, we also process these. The legal basis for this data processing is Art. 6(1) sentence 1 lit. b) GDPR, i.e., the processing is necessary to carry out (pre-)contractual measures taken at your request. We store your information for as long as necessary to process your inquiry and delete it thereafter.

In order to make the application or onboarding process as simple as possible for you, we use the onboarding tool from Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits"). Further information can be found in the section "Use of Product Fruits in our Portals." Your personal data is not processed for automated decision-making and/or profiling.

11.3 Use of Product Fruits in our Portals

In order to make the application or onboarding process as simple as possible for you, we use the onboarding tool from Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits").

For this purpose, Product Fruits creates screen views that you can use from the personal data you have provided to us as part of the application or onboarding process. IU employees also have the option of accessing aggregated statistics generated from users' activities. No connection to an individual person can be established in this process. IU uses these statistics to monitor how many users abandon the application or onboarding process, or how long an average process takes.

In order to use Product Fruits, cookies are set in your browser by Product Fruits, provided you have consented to this via our consent management platform. The legal basis for the processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR in conjunction with § 25 TDDDG. Further information on this and options for withdrawing your consent can be found in our cookie settings [insert hyperlink to cookie settings].

12 GENERAL INFORMATION ON USE OF THE ALUMNI PLATFORM

If you register via the website for the Alumni Platform, we process your name, email address, affiliation, chosen password, and information about your use of the Alumni Platform in order to provide the functionalities of the Alumni Platform, such as a member directory, a feed, or a search function. The Alumni Platform is operated by IU Group. The purpose of the processing is to give you the opportunity to stay in touch with other alumni and to be informed about our alumni offerings. The legal basis is Art. 6(1) sentence 1 lit. b) GDPR. If you choose to upload additional information about yourself to your profile, e.g., your photo, this is done on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. The same applies if you make certain personal data available for viewing by other participants of the Alumni Platform. You may withdraw your consent at any time with effect for the future by notifying us through the contact options mentioned at the beginning. Please note that we make use of an external service provider to operate the Alumni Platform, who processes your data in the USA. We have entered into a data processing agreement with the service provider pursuant to Art. 28 GDPR for this purpose, which incorporates the EU Standard Contractual Clauses. A copy of the EU Standard Contractual Clauses is available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

We process personal data required to provide your account, or which we additionally receive with your consent, for as long as the account exists and for a period of one month after deletion of the account. We delete usage data within seven days. We store your consent for three years after the end of the year in which the withdrawal occurs.

13 DATA PROCESSING WITHIN THE FRAMEWORK OF THE FIRSTBIRD EMPLOYEE REFERRAL PROGRAM

If you register for our Firstbird employee referral program, we process the following personal data: To create your user profile, we process name, email address, a self-selected password, employee ID, time zone, as well as location and area of activity. You also have the option to upload a photo of yourself to your profile, which is visible to other Firstbird users. If you select in the notification settings that you wish to receive notifications on certain topics at various intervals, we process your data to generate and deliver notifications according to your selection. If you refer a job, we process details of the referred position, date and time of the referral, and information about the chosen medium through which the link to the recommended position was shared.

If someone applies for an advertised position based on your referral, we process the fact that you made the corresponding referral. In the case of a successful application, we additionally process information about the bonuses credited to you, as well as information about the redemption of the bonuses. The legal basis for these processing activities is a usage relationship concluded with you regarding participation in Firstbird pursuant to Art. 6(1) sentence 1 lit. b) GDPR. Your personal data is processed by us for as long as your account is active, and deleted thereafter, unless bonuses have been credited to you. In that case, we process related information in Firstbird for three years from the end of the year of the last credit. Information on bonus payouts is retained for 10 years in accordance with tax law requirements.

Access to your personal data is granted to IU employees entrusted with managing the Firstbird employee referral program. IU makes use of various IT service providers, including firstbird GmbH, Gertrude-Fröhlich-Sandner-Str. 2-4, Spaces, Tower 9, 1100 Vienna, Austria, and has entered into a data processing agreement with the service provider pursuant to Art. 28 GDPR.

14 APPLICATIONS

14.1 Applications for Job Postings and Expressions of Interest via LinkedIn

If you apply to us for an advertised position, we process in particular the following categories of data about you:

• Your name, i.e., first and last name,

• Your address,

• Your phone number,

• Your email address,

• Details from your CV, in particular:

  • Educational history, highest school qualification, and final grade,

  • Information, certificates, and final grade regarding your (in-company or school-based) vocational training, and/or

  • Information, certificates, and final grade regarding your studies,

• Details of previous employers together with information on the area of activity,

• Information along with proof of further training, continuing education, and/or other qualifications,

• Other details provided by you, such as hobbies, foreign language skills, other information about special abilities, etc.

• Your salary expectations,

• Your photo,

• Your signature,

• Any letters of recommendation,

• And all information submitted with an application, together with other proof and documentation.

If you apply to us for a position via our website, we use the so-called double opt-in procedure, i.e., you receive an email with which you must confirm that you are the holder of the email address. Please note that this is purely a precautionary measure, and sending you a confirmation email has no legal effect. The legal basis for this processing is the submission of your application to us pursuant to Art. 6(1) sentence 1 lit. b) GDPR.

Insofar as you use the WhatsApp application function, the legal basis for the processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. You may withdraw your consent at any time with effect for the future. For applications via WhatsApp, we make use of the service provider PitchYou GmbH, Campusallee 9, 51379 Leverkusen ("PitchYou"), as data processor. Communication via WhatsApp is end-to-end encrypted. We use the WhatsApp Business interface to communicate with you. This means we do not create a contact directory that is transmitted to WhatsApp. If, during the communication, you decide against continuing, you may terminate the communication at any time and use an alternative communication channel. Your personal data will then be deleted within 24 hours. If you fully withdraw your application by issuing the corresponding command, all data stored with PitchYou up to that point will be deleted. Your data is only transmitted from PitchYou to IU once the application is complete. Application documents of rejected applicants are deleted no later than six months thereafter. PitchYou stores your data exclusively on servers in Germany. Only employees of PitchYou and IU responsible for applicant selection or administration have access to your data. Further information on data protection can be found here: https://www.pitchyou.de/datenschutz or https://www.whatsapp.com/legal/privacy-policy-eea.

If we receive your application or expressed interest in a position via LinkedIn, we process such data as you disclose on LinkedIn for application purposes. Your application data, which you upload via our Application Portal or which we transfer from LinkedIn into our Application Portal, is hosted in the EU by our service provider Workday Inc., 6110 Stoneridge Mall Road, CA 94588 Pleasanton ("Workday"). In exceptional cases, however, Workday employees may gain access to your personal data for the purposes of troubleshooting, support, and maintenance. For this reason, we have entered into a data processing agreement with Workday, which incorporates the EU Standard Contractual Clauses.

IU makes use of various other IT service providers who support us in providing our career websites through which you apply to us. Employees of such service providers — in particular of those who provide the portals we use, through which you have uploaded your application to us — may, in individual cases, gain access to your personal data for troubleshooting purposes.

We have entered into data processing agreements pursuant to Art. 28 GDPR with our service providers for this purpose. In this context, it may also happen that employees of the service provider entrusted with technical support gain access to your personal data from outside the EU. Workday is certified under the Data Privacy Framework.

It may also be the case that employees of advisory service providers, such as law firms, who are legally bound to confidentiality, gain access to your personal data.

If we offer you permanent employment at IU, we process your personal data as described in the privacy notice for employees. If we are unfortunately unable to further consider your application, we process your data for a period of six (6) months from the date the rejection was sent, and delete your data thereafter.

14.2 Data Processing During the Further Application Process

14.2.1 Application Videos

As part of the application process, you may be given the opportunity to record an application video or, for example, a teaching sample (hereinafter collectively referred to as "application video"). In doing so, we process the time and date of the recording, your voice and image, as well as information contained in the video, such as details from your narration or images in the background. We use the application video option to provide the persons involved in the hiring decision with an efficient way to get to know you. The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. You may withdraw your consent at any time with effect for the future by notifying datenschutz@iu.org.

Access to your personal data is granted only to those IU employees responsible for conducting the interview, as well as other persons involved in the hiring decision. This includes in particular our internal recruiters and, where applicable, members of an appointment committee. For the realization of application videos, IU makes use of VidCruiter Inc., 100 Cameron St, Moncton, NB E1C 5Y6, Canada, and has entered into a data processing agreement with the service provider pursuant to Art. 28 GDPR, which relies on the EU Commission's adequacy decision for Canada as a country with an adequate level of data protection. Your application video and the associated personal data are deleted no later than six months after the decision regarding hiring or rejection.

14.2.2 Cognitive Tests

As part of the application process, you may also be given the opportunity to take cognitive tests. In doing so, we process the time and date the test was taken, as well as your inputs and interactions during the test. We use cognitive tests to determine your suitability for the offered position. The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. You may withdraw your consent at any time with effect for the future by notifying datenschutz@iu.org.

Access to your personal data is granted only to those IU employees responsible for conducting cognitive tests as part of the application process. After these employees evaluate the tests, only summarized results are communicated to other parties involved in the further application process. For conducting cognitive tests, IU makes use of Aon Assessment GmbH, Großer Burstah 18-32, 20457 Hamburg, and has entered into a data processing agreement with the service provider pursuant to Art. 28 GDPR. Data collected as part of cognitive tests is deleted no later than six months after the test is conducted.

14.2.3 Appointment Booking

For the purpose of simplifying appointment booking for interviews, we use MS Bookings, a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). When using the service, in addition to the information you provide in the appointment booking, we process your display name, your email address, your preferred language, as well as the date and time of use. The legal basis for the processing of your personal data is Art. 6(1) sentence 1 lit. f) GDPR and our legitimate interest in offering a user-friendly and efficient appointment booking option. The connection to MS Bookings is only established if you use the offered booking function, which you are not obligated to do. Alternatively, you may choose other contact options to arrange an appointment. Access to your data processed via MS Bookings is granted to IU employees entrusted with selecting job applicants. We delete your data contained in MS Bookings no later than six months after the hiring decision or the decision to reject. MS Bookings is part of Office 365, for which IU has entered into a data processing agreement with Microsoft. Microsoft is certified under the Data Privacy Framework. Further information on data processing by Microsoft is available at https://privacy.microsoft.com/en-us/privacystatement.

14.2.4 Talent Pool for Applicants

If you would like your application documents to also be considered for other suitable job openings, you may give us your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR to include your documents in our talent pool. This consent for the additional use of your personal data for the talent pool is valid for a total period of 24 months. If, after this period, IU is interested in retaining your application documents further, it will contact you before the 24 months expire and ask you to renew your consent. If you do not renew your consent, IU is obligated to delete your data upon expiry of the period. We retain proof of previously given consent for three years.

Your consent to inclusion in the talent pool is voluntary. You may refuse your consent without giving reasons, without having to fear any disadvantages as a result. You may also withdraw your consent at any time without giving reasons, with effect for the future.

As part of an application process, your personal data is accessible to IU employees and teaching staff entrusted with tasks responsible for conducting the application process. Within the talent pool, employees of IU and of the companies named in the section "Controller and Data Protection Officer" who wish to fill an open position in their department ("Recruiters") may, with your consent, access your name and qualifications for as long as you are registered in the talent pool as a candidate interested in a position at IU. In addition, our group companies may provide IT services for us. Employees of these companies may have access to your personal data to the extent necessary to fulfill their tasks. Furthermore, we make use of various external service providers to operate our IT infrastructure.

To store your application data, IU uses a software solution from Workday, Inc. Your data is hosted in a data center within the European Union. Further information on Workday can be found in the following section.

14.2.5 Login for Applicants for Job Postings

If you apply to us for a job posting, you can create a user profile on our platform provided by Workday Inc., 6110 Stoneridge Mall Road, CA 94588 Pleasanton ("Workday"). For this purpose, we process your personal data, such as your full name, your self-chosen password, your email address, your contact details (such as address and phone number), together with the information contained in your application — as described under "Applications for Job Postings."

The legal basis for this processing is a usage relationship concluded with you for this purpose pursuant to Art. 6(1) sentence 1 lit. b) GDPR. We retain your personal data for as long as your application process is ongoing.

If you make use of the "Delete My Data" function, your user profile will be deleted early, i.e., your personal data will be deleted after one month. Once your application process is concluded, regardless of the reason, we will retain your personal data (i.e., your user profile) for a further period of six months and then delete it, unless you continue to use your access for other applications.

To provide you with this platform, we make use of Workday as our contractor. Your personal data is hosted in a data center within the European Union. In exceptional cases, however, employees of Workday, Inc. may gain access to your personal data for troubleshooting, support, and maintenance purposes. For this reason, we have entered into a data processing agreement with Workday. Workday is certified under the Data Privacy Framework.

15 DATA PROCESSING WHEN PURCHASING A CONTINUING EDUCATION COURSE

If you purchase a continuing education course via our web shop, we process, in addition to the data mentioned under server log files, your salutation, name, address, email address, phone number (optional), date and place of birth, nationality, and other uploaded documents (CV), the booked continuing education course, the purchase price together with payment terms, and the timestamp of the purchase, as well as data related to the use of an education voucher in cases where the continuing education is funded by the Federal Employment Agency or the Jobcenter.

If you use the option offered on the website to save your information for later completion of your application, we will send you an email link to complete your data and to upload further documents. We use a hash key in the URL to pre-fill the application form with the data you already entered as part of your expression of interest (salutation, first name, last name, phone number, email address). We store the data entered for later completion of the application for 30 days.

Access to your personal data is granted to IU employees entrusted with managing the continuing education course. IU makes use of various IT service providers, such as Salesforce, with registered office at Floor 26 Salesforce Tower, 110 Bishopsgate, EC2N 4AY London, England. The EU Commission has issued an adequacy decision for the United Kingdom. We store the data we receive in connection with your license purchase in Salesforce. In exceptional cases, employees of Salesforce may gain access to your personal data. IU has entered into a data processing agreement with Salesforce. Salesforce is certified under the Data Privacy Framework.

IU stores the aforementioned personal data for the duration of your continuing education course and in accordance with statutory retention periods under the German Fiscal Code for a period of ten years.

Your payment data is passed on by us to the payment service provider you selected for payment processing.

If you choose to pay via Stripe, payment processing takes place via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We transmit to Stripe the information provided as part of the order process, as well as name, address, account number, bank sort code, credit card number where applicable, invoice amount, currency, and transaction number.

Data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b) GDPR. The data transfer takes place solely for the purpose of payment processing; the data is deleted again once delivery has taken place, unless our service providers are themselves legally obliged to retain the data. Stripe processes your personal data in accordance with the contract you have concluded with Stripe. Further information on Stripe's data protection can be found at: https://stripe.com/de/privacy#translation.

If you choose to pay via PayPal, payment processing takes place via PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. We transmit to PayPal name, address, email address, phone and mobile number, and IP address. Data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b) GDPR. The legal basis for the data processing is Art. 6(1) sentence 1 lit. b) GDPR, since processing the data for payment via PayPal is necessary for the performance of the contract. The data transfer takes place solely for the purpose of payment processing; the data is deleted again once delivery has taken place, unless our service providers are themselves legally obliged to retain the data.

PayPal processes your personal data in accordance with the contract you have concluded with PayPal. PayPal may also pass on your data to third parties insofar as this is necessary to fulfill contractual obligations or where the data is to be processed on its behalf. PayPal's privacy policy can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.

16 DATA PROCESSING WHEN PURCHASING AN ADOBE LICENSE

If you purchase an Adobe license via our web shop, we process, in addition to the data mentioned under server log files, your name, address, email address, phone number (optional), the booked continuing education course, the purchase price together with payment terms, and the timestamp of the purchase.

Access to your personal data is granted to IU employees entrusted with managing Adobe licenses. IU makes use of various IT service providers, such as Shopify, the hosting provider of our web shop. We store the data we receive in connection with your license purchase in the shop management system of the Shopify shop. Your data is stored by Shopify International Ltd., with registered office at Victoria Buildings, 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32, Ireland ("Shopify"). In exceptional cases, employees of Shopify may gain access to your personal data. Shopify processes your personal data through its Irish subsidiary, Shopify International Ltd. Your data is also sent to other Shopify locations and to service providers that may be located in other regions, including Canada (where Shopify is headquartered) and the United States. The European Commission has determined that Canada offers a level of data protection equivalent to that of the EU. Insofar as Shopify sends your personal data to a country outside Canada, Shopify protects this data in accordance with the EU Standard Contractual Clauses. IU has entered into a data processing agreement with Shopify that incorporates the EU Standard Contractual Clauses. A copy of the EU Standard Contractual Clauses is available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

IU stores the personal data mentioned here for the duration of the license usage and in accordance with statutory retention periods (six to ten years pursuant to the German Fiscal Code and the German Commercial Code).

Your payment data is passed on by us to the payment service provider you selected for payment processing.

If you choose to pay via PayPal, payment processing takes place via PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. We transmit to PayPal name, address, email address, phone and mobile number, and IP address. Data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b) GDPR. The legal basis for the data processing is Art. 6(1) sentence 1 lit. b) GDPR, since processing the data for payment via PayPal is necessary for the performance of the contract. The data transfer takes place solely for the purpose of payment processing; the data is deleted again once delivery has taken place, unless our service providers are themselves legally obliged to retain the data.

PayPal processes your personal data in accordance with the contract you have concluded with PayPal. PayPal may also pass on your data to third parties insofar as this is necessary to fulfill contractual obligations or where the data is to be processed on its behalf. PayPal's privacy policy can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.

17 USE OF PAYMENT SERVICE PROVIDERS

We process your payment information for the purpose of payment processing, e.g., when you purchase and/or make use of a service and/or a license.

Your payment data is passed on by IU to the payment service provider you selected for payment processing. Further information can be found below.

17.1 PayPal

If you choose to pay via PayPal, payment processing takes place via PayPal (Europe) S.à.r.l. & Cie. S.C.A., 22-24 Boulevard Royal, 2449 Luxembourg. We transmit to PayPal name, address, email address, phone and mobile number, and IP address. Data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b) GDPR. The legal basis for the data processing is Art. 6(1) sentence 1 lit. b) GDPR, since processing the data for payment via PayPal is necessary for the performance of the contract. The data transfer takes place solely for the purpose of payment processing; the data is deleted again once delivery has taken place, unless our service providers are themselves legally obliged to retain the data.

PayPal processes your personal data in accordance with the contract you have concluded with PayPal. PayPal may also pass on your data to third parties insofar as this is necessary to fulfill contractual obligations or where the data is to be processed on its behalf. PayPal's privacy policy can be found at https://www.paypal.com/de/webapps/mpp/ua/privacy-full/.

17.2 Stripe

If you choose to pay via Stripe, payment processing takes place via Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. We transmit to Stripe the information provided as part of the order process, as well as name, address, account number, bank sort code, credit card number where applicable, invoice amount, currency, and transaction number.

Data processing is carried out on the basis of Art. 6(1) sentence 1 lit. b) GDPR. The data transfer takes place solely for the purpose of payment processing; the data is deleted again once delivery has taken place, unless our service providers are themselves legally obliged to retain the data. Stripe processes your personal data in accordance with the contract you have concluded with Stripe. Further information on Stripe's data protection can be found at: https://stripe.com/de/privacy#translation.

17.3 SEPA Direct Debit

If you wish to make payments via the SEPA direct debit procedure, we process the categories of data requested on the direct debit form (name, first name, address, name and location of your bank, IBAN, etc.) for the purpose of debt collection. The legal basis is the consent you have given pursuant to Art. 6(1) sentence 1 lit. a) GDPR. Once the SEPA mandate has been granted, we forward the data you provided to our house bank for the debiting of the selected direct debit amounts. Access to your personal data in connection with the direct debit procedure is granted to employees entrusted with payment processing. We also make use of the services of external IT service companies. We process your personal data within the EU, unless your account-holding institution is located outside the EU. Data used in connection with the direct debit procedure is stored for up to 10 years in order to fulfill statutory retention obligations under the German Fiscal Code. If you withdraw your consent to the use of the data before debiting occurs, we will delete the data upon receipt of the withdrawal.

17.4 Shopify Payments

If you choose to pay via Shopify Payments, payment processing takes place via Shopify Payments, 3rd Floor, Europa House, Harcourt Building, Harcourt Street, Dublin 2. If you choose a payment method offered via the payment service provider Shopify Payments, payment processing takes place via the technical service provider Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, to whom we pass on the information you provided as part of the order process together with information about your order (name, address, account number, bank sort code, credit card number where applicable, invoice amount, currency, and transaction number) pursuant to Art. 6(1) sentence 1 lit. b) GDPR. The data transfer takes place solely for the purpose of payment processing; the data is deleted again once delivery has taken place, unless our service providers are themselves legally obliged to retain the data. Further information on Shopify Payments' data protection can be found at the following web address: https://www.shopify.de/legal/datenschutz.

18 USE OF OUR BLOG

Various topics related to IU are published on our blog. If you participate in a discussion or publish a post yourself, we process the data described under server log files, as well as your name and a photo of you, in order to introduce you. The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. You may withdraw your consent at any time with effect for the future. We will then delete your blog post within two weeks of receiving your withdrawal. Please note that posts and your photo may be stored locally on the devices of blog readers, and we have no way of deleting locally stored data of this kind. We recommend that you use a pseudonym instead of your real name. Please note that your posts are visible to everyone worldwide. We reserve the right to delete posts if they are challenged by third parties as unlawful. Our employees who manage the website are given access to your personal data.

19 REFER A FRIEND

Through our page, you can refer acquaintances for a course of study and receive bonuses for doing so. For this purpose, we process your name and email address, as well as the data entered by your acquaintance. You can create a personalized link via our website and send it to your acquaintances. This email contains an affiliate link; this link, in turn, contains a pseudonymized referral code in the URL. If your acquaintance clicks the link, they are taken to a website form for requesting information material. The form asks whether your acquaintance was referred by you.

Alternatively, with your previously given consent, you can receive an email from us with information about the "bring a friend" program and tell your acquaintances about IU. When expressing interest via our website forms, people referred by you have the option to indicate the referral by you (i.e., your first name, last name, and email address). IU then checks whether it is a valid referral. We subsequently contact you by email.

The processing is carried out pursuant to Art. 6(1) sentence 1 lit. f) GDPR to safeguard our legitimate interest in acquiring new customers. The purpose of the processing is to reward customer referrals. Access to your personal data is granted to IU employees responsible for the customer referral program. We process your personal data for the period determined by IU with regard to fulfilling its tasks. In this regard, we apply the commercial and tax law retention obligations.

20 WEB ANALYTICS SERVICES

Analytics services are used on our website, which we use to gather information about our website, provided you have consented to the setting of the relevant cookies. The data obtained with the help of analytics services, such as the origin of visitors or their length of stay on our website, gives us insight into visitor behavior on our website. With the help of this data, we are able not only to remove weaknesses but also to make efficiency improvements to our website. Further information on the analytics services used on our website can be found below. Information on the processing of personal data through the cookies set in this context, such as the storage period of the cookies, can be found in our cookie settings [insert hyperlink to cookie settings].

20.1 Google Analytics and Google Signals

We use Google Analytics to gain an overview of the behavior of website visitors and our digital marketing. Google Analytics allows us to collect and evaluate data specifically relevant to IU, for example, how far users scrolled, which buttons were clicked, etc. Google Analytics also helps us collect, for example, demographic characteristics such as age, gender, and interests, geographic characteristics such as language and location, and technical characteristics such as device type, browser, and operating system, search history, YouTube history, and data from Google partner websites.

With the help of this data, we can not only optimize our website but also determine how the respective visitor sessions ended (e.g., a pure website visit, request for information material, registration for a course of study). Google Analytics also helps us determine which website users land on and via which channel users arrive (e.g., via a paid or unpaid ad, a Google search, a Facebook post, or a direct visit to the website). With the help of this information, IU can determine which marketing channels are working and which are not. Google Analytics also allows us to identify user paths, i.e., where users move on our website, whether they return to the homepage, and how many users there are. With the help of this information, we can determine, for example, whether a large number of users leaving the site is due to a technical defect on the website. Using the aforementioned data, we get a good overview of our website and how it is used. Even though we collect data about users, we cannot draw any conclusions about your identity from this data, since we receive reports from Google Analytics based on aggregated data sets.

This applies also and in particular to data collected in our contact forms (for example, when requesting information material, signing up for the newsletter, registering for online information events, participating in information sessions, and using application forms), which Google Analytics uses in hashed form to model website usage. The processed data, such as email addresses, phone numbers, names, and address data, is hashed using SHA256 before being sent. The matching of these hash values with Google accounts is carried out exclusively by Google.

Since we have also activated the service offered by Google called Google Signals — i.e., so-called cross-device tracking — your aforementioned data is analyzed across devices and used for the purpose of personalizing advertising. This allows Google to detect if you first visit our website via a smartphone and later via a laptop. We ourselves only receive reports with anonymous data, from which we can identify patterns in user behavior. Google Signals is active if you have a Google account and are logged into it while visiting our website. Furthermore, you must have consented to "personalized advertising" with Google. If you do not want cross-device tracking, you must deactivate "personalized advertising" in your Google account. With the help of Google Signals, we can launch cross-device remarketing campaigns. This means that we may also display our advertising to you on third-party websites. You have the option to view or delete your data at Google under "My Activity."

We use the data collected from Google Analytics for cross-platform analyses, and for this purpose we combine your collected data from Google Analytics with Meta Platforms Ireland Limited ("Meta"), 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland. Insofar as your personal data is transferred to Meta, Inc., 1 Hacker Way, Menlo Park, CA 94025, in the USA, this is done on the basis of a contract that IU has concluded with Meta, or with Meta within the corporate group, for this purpose. Meta is certified under the Data Privacy Framework. You can view the essential content of the agreement at https://www.facebook.com/legal/terms/dataprocessing. Further information is available at https://www.facebook.com/legal/terms/customaudience.

The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR.

Further information on Google Analytics and Google's privacy policy can be found here. You will also find there the option to assert your data subject rights (e.g., right to erasure) against Google Ireland Limited.

Information on the provider, the cookies set, the categories of data affected, the legal basis, international data transfers, the storage periods of the cookies, and the option to withdraw your consent or refuse to give consent can be found in our cookie settings [insert hyperlink to cookie settings]. Google LLC is certified under the Data Privacy Framework.

20.2 Mouseflow

We use Mouseflow to analyze usage behavior on our website, provided you have consented to the setting of the relevant cookies. Mouseflow observes website users, records session videos, and uses these videos to show how users behave on the website (e.g., how far they scroll). Mouseflow does not collect any plain-text data for this purpose (e.g., if you enter data into a contact form, it is not collected by Mouseflow, since the fields of the contact form are masked). Mouseflow also allows us to create so-called heatmaps of website usage. These are aggregated data on all visitors that help evaluate scroll, click, and mouse behavior. Mouseflow also shows us precisely at which point in a form users stopped filling it out. With the help of this usage data analysis, we gain insight into the use of our website without being able to draw conclusions about your identity. We receive reports from Mouseflow based on aggregated data sets. Mouseflow is certified under the Data Privacy Framework.

Information on the provider, the cookies set, the legal basis, international data transfers, and storage periods of the cookies can be found in our cookie settings [insert hyperlink to cookie settings].

20.3 Microsoft Clarity

We use Microsoft Clarity to analyze usage behavior on our website, provided you have consented to the setting of the relevant cookies. Microsoft Clarity collects interaction data from your visit to our website (such as test data, dwell time, clicks, or scrolling), diagnostic data, event data, and metadata. We mask URL data; nevertheless, personal data may still be processed within referrer URLs, insofar as the website includes this in a URL; further information on data processing can be found in Microsoft's documentation at https://learn.microsoft.com/en-us/clarity/setup-and-installation/clarity-data. With the help of this data, which we process in pseudonymized form, we gain insight into the type of usage of our website and can base measures to optimize usability, or develop marketing measures, on this. We also combine this data with aggregated data from our Google Ads campaigns within Clarity. The legal basis for this data processing is your consent pursuant to Art. 6(1) lit. a) GDPR. Microsoft is certified under the Data Privacy Framework. Information on the provider, the cookies set, the legal basis, international data transfers, and storage periods of the cookies can be found in our cookie settings [insert hyperlink to cookie settings].

20.4 Amplitude

To improve the quality and performance of our services, we use Amplitude, an analytics service provided by Amplitude Inc. ("Amplitude"), located at 201 3rd Street, Suite 200, San Francisco, CA 94103, USA.

Amplitude uses cookies and similar technologies to collect and analyze data about the use of our website. This data may include information about the device used to access the website, such as the IP address, browser type, operating system, and interactions with the website. This information is anonymized and aggregated in order to identify trends and improve the user experience.

By giving your consent, you agree that we may send data about your interactions to Amplitude for analytics purposes.

Further information on how Amplitude collects and uses data, as well as your rights regarding your data, can also be found in Amplitude's privacy policy at https://amplitude.com/privacy.

The legal basis for this data processing is your consent pursuant to Art. 6(1) lit. a) GDPR.

Insofar as Amplitude is used within the framework of technically necessary cookies, only anonymized and/or aggregated data is processed.

Further information on Amplitude, the cookies set, the legal basis, international data transfers, and storage periods of the cookies can be found here [insert hyperlink to cookie settings].

IU has also entered into a data processing agreement with Amplitude Inc. that incorporates the EU Standard Contractual Clauses. You may request the essential content of the agreement from us at datenschutz@iu.org. Amplitude is also certified under the Data Privacy Framework, on which further information is available here: https://www.dataprivacyframework.gov/s/program-overview.

20.5 CND Motion Media

To measure the impact of our TV advertising campaigns on visitor behavior on our website (so-called TV tracking), we use the service Motion Media Analytics from the provider CND Motion Media GmbH, Holzstr. 2, 80469 Munich ("CND").

For this purpose, a tracking script from CND is implemented on our website. This service works without the use of cookies or comparable storage technologies on your device. CND only collects statistical visitor events. The IP address that briefly arises during communication with CND's server is immediately and automatically anonymized. No permanent storage of personal data takes place by CND, so conclusions about your identity or household are excluded.

The processing is carried out on the basis of Art. 6(1) sentence 1 lit. f) GDPR to safeguard our legitimate interest in the statistical evaluation, optimization, and economic management of our advertising measures. We have entered into a data processing agreement with CND pursuant to Art. 28 GDPR, ensuring that data processing is carried out strictly in accordance with our instructions and in compliance with European data protection requirements.

You may object at any time, with effect for the future, to the processing of your data by CND. The easiest way to do this is via our cookie settings [insert hyperlink to cookie settings]. Alternatively, you can deactivate data collection directly with the provider at the following link: https://analytics.cnd-motionmedia.de/web/function/optout. Further information on data protection at CND can be found at: https://www.cnd-motionmedia.de/.

21 GOOGLE TAG MANAGER

This website uses Google Tag Manager ("GTM"), a service of Google Ireland Ltd. ("Google"), with registered office at Gordon House, Barrow Street, Dublin 4, Ireland. GTM allows tags, such as code snippets or pixels, to be used on the website itself via a so-called container, which places a kind of placeholder in the source code and in which the tools to be used are stored, without IU having to intervene in the source code of our website. Using GTM, tools can be used on the website without each being embedded in the source code. Instead, only the GTM code needs to be installed, after which GTM can be used as a central location to activate or deactivate the desired tools.

GTM works on the website in such a way that a defined usage behavior triggers a so-called trigger, so that a tag (i.e., a pixel tag, web beacon, or HTML code) is then delivered for the tool. GTM collects the relevant data for the integrated tool and forwards it to the tool. Information on the tools used on our website that are loaded via GTM can be found here [insert hyperlink to cookie settings]. In this context, it therefore not only happens that the data categories described for the respective tools are transmitted to the respective providers of the tools; in addition, Google Ireland Ltd. also receives information about your usage behavior on our website. Since a large number of the tool providers are located in countries outside the EU, we would like to refer you to the description of the respective tools if you would like information on the transfer mechanisms concluded by IU. IU has also entered into a processing agreement with Google Ireland Ltd. You can view the essential content of the agreement at https://policies.google.com/privacy/frameworks?hl=de. Google LLC is certified under the Data Privacy Framework.

IU uses GTM not only for statistics tools but also for marketing tools. Accordingly, GTM is a statistics and marketing tool, and its use is based on your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, which you may withdraw at any time with effect for the future by sending an email to datenschutz@iu.org.

22 CUSTOMER LIST MATCHING

We use tools to match customer lists with various advertising providers in order to more precisely target customers who might be interested in our products. For this purpose, we import a list of names, email addresses, dates of birth, gender, and, where applicable, address data of our customers into our own advertising account, which we have set up with an advertising provider, e.g., Facebook, and hash this data, i.e., we generate a shorter, numerical value or key of fixed length. The advertising provider matches this list in hashed form with its own database and, based on this, selects customers to whom our ads are shown when using the advertising provider's products, such as a search engine, a social media platform, a streaming platform, or a communication service. In the case of a match with customer data, these are added to our account as successfully matched customers.

The legal basis for the processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. Your personal data in connection with the use of customer list matching with advertising providers is stored by the respective provider for the duration of the matching of the customer list and deleted thereafter. Use by IU takes place for the duration of your consent. On IU's side, access to your personal data is granted exclusively to IU employees responsible for the relevant area. We currently use the following services:

Google Customer Match: Your personal data is transmitted to Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland; Alphabet Inc. and Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Insofar as your personal data is transferred to Google in the USA, this is done on the basis of a contract that IU has concluded with Google for this purpose, which incorporates the EU Standard Contractual Clauses. A copy of the EU Standard Contractual Clauses is available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. You can view the essential content of the agreement at https://policies.google.com/privacy/frameworks?hl=de. Google LLC is certified under the Data Privacy Framework. Further information is available at https://support.google.com/adwordspolicy/answer/6299717?hl=de. Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/. You can edit your personal data and privacy settings at Google "My Account": https://myaccount.google.com/intro?hl=de.

Facebook Custom Audience: Your personal data is transmitted to Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland. Insofar as your personal data is transferred to Meta, Inc., 1 Hacker Way, Menlo Park, CA 94025, in the USA, this is done on the basis of a contract that IU has concluded with Meta, or with Meta within the corporate group, for this purpose. Meta is certified under the Data Privacy Framework. You can view the essential content of the agreement at https://www.facebook.com/legal/terms/dataprocessing. Further information is available at https://www.facebook.com/legal/terms/customaudience.

Microsoft Customer Match: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. Insofar as your personal data is transferred to the USA, this is done on the basis of a contract that IU has concluded with Microsoft for this purpose. You can view the essential content of the agreement at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?year=2021. Microsoft is certified under the Data Privacy Framework. Further information is available at https://privacy.microsoft.com/en-us/privacystatement.

TikTok Advanced Matching: TikTok Technology Ltd., The Sorting Office, Ropemaker Place, Dublin 2, Dublin, D02 HD23, Ireland.

TikTok's privacy policy can be found here: https://www.tiktok.com/legal/page/eea/privacy-policy/de

Further information on TikTok is available in the separate section on TikTok itself.

LinkedIn: Your personal data is transmitted to LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, as well as to LinkedIn Corporation, 1000 W Maude Ave, Sunnyvale, CA 94085, USA. Insofar as your personal data is transferred to LinkedIn in the USA, this is done on the basis of a contract that IU has concluded with LinkedIn for this purpose, which incorporates the EU Standard Contractual Clauses. You can view the essential content of the agreement at https://de.linkedin.com/legal/l/dpa. LinkedIn is certified under the EU-U.S. Data Privacy Framework. Further information on data transfer to the USA is available at https://www.linkedin.com/help/linkedin/answer/a1343190/. LinkedIn's privacy policy can be found at: https://www.linkedin.com/legal/privacy-policy.

23 SOCIAL MEDIA

23.1 General

For the purpose of increasing our reach, we maintain social media presences on Facebook, Instagram, LinkedIn, and YouTube. If you click a link embedded in our website, you will be redirected to the respective page: Facebook: [link]; Instagram: https://www.instagram.com/; LinkedIn: https://de.linkedin.com/; YouTube: https://www.youtube.com/. Plugins from these social networks are integrated into our website. When you visit our website, the plugins establish a direct connection between your browser and the server of the social network. As a result, the social network receives the information that you visited this website using your IP address. If you are logged into your account with the social network, the social network can associate your visit to this website with your user account. Details on data collection (purpose, scope, further processing, use) as well as your rights and configuration options can be found in the privacy notices of the respective social network. Deletion of your personal data by the social network takes place as described in the respective privacy policy. Insofar as joint controllership exists with Instagram or Facebook, the agreement on joint controllership applies. You can find the agreement at https://www.facebook.com/legal/terms/page_controller_addendum. Further information on the respective responsibilities is available in the Facebook Page Insights Supplement (https://www.facebook.com/legal/terms/page_controller_addendum). The legal basis for the processing of the data is Art. 6(1) sentence 1 lit. f) GDPR. Our legitimate interest in this regard consists of increasing the reach of our online presence on social media channels. The purpose of the processing is to increase our presence on the internet. Access to the data is granted to IU employees involved in managing the social media channels, as well as, where applicable, employees of the respective provider. Your personal data is transmitted to, or is retrievable from, the companies listed below in the USA. Further information on safeguarding international data transfer can be found in the section "Transfers of personal data to third countries." Information on data processing can be found at: LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) – privacy policy https://www.linkedin.com/legal/privacy-policy, opt-out: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out. Instagram (Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA) – privacy policy/opt-out: http://instagram.com/about/legal/privacy. Facebook (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) – privacy policy (opt-out: https://www.facebook.com/about/privacy/legal_bases). Meta is certified under the Data Privacy Framework. YouTube (Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland), privacy policy: https://policies.google.com/privacy, opt-out: https://adssettings.google.com/authenticated. Google LLC is certified under the Data Privacy Framework. We process your personal data for the period determined by IU with regard to fulfilling its tasks. In this regard, we apply the commercial and tax law retention obligations.

23.2 TikTok

We use the social network "TikTok." On one hand, we create and publish videos on TikTok.

The purpose of the processing is to improve our online presence.

For our formats, we ask our creators for personal data in order to create captions from it. This includes, among other things, the description text of our formats and text within the published videos.

We collect the following categories of data from our creators: first name, field of study, study model, semester, motivation for studying.

Access to the data is granted to IU employees involved in managing the social media channels.

Upon publication of the videos, the data is transmitted to the companies listed below and stored on, or is retrievable from, servers in the USA, Malaysia, and Singapore.

Further information on safeguarding international data transfer can be found in the section "Transfers of personal data to third countries."

As service provider, we use TikTok Technology Limited ("TikTok," The Sorting Office, Ropemaker Place, Dublin 2, Dublin, D02 HD23, Ireland).

TikTok's privacy policy can be found here: https://www.tiktok.com/legal/page/eea/privacy-policy/de

We store the collected data on IU servers until the videos are published. After publication, we delete the data.

The legal basis for the data processing is Art. 6(1) lit. a) GDPR, your consent to the processing.

On the other hand, we also use TikTok for marketing campaigns.

The purpose of the processing is to improve our online presence. A cookie from the social network "TikTok" is integrated into our website. When you visit our website, the cookie establishes a direct connection between your browser and the server of the social network. As a result, the social network receives information that you visited this website. We use this information to present you with tailored information about our study programs.

Affected data categories include, among others: user content, page views, purchases or expressions of interest, content views, and event data. Further information can be found in the cookie settings [insert hyperlink to cookie settings].

The legal basis for the processing is your consent pursuant to Art. 6(1) lit. a) GDPR. You may withdraw your consent at any time via our cookie settings [insert hyperlink to cookie settings].

As service provider, we use TikTok Technology Limited ("TikTok"), The Sorting Office, Ropemaker Place, Dublin 2, Dublin, D02 HD23, Ireland.

TikTok's privacy policy can be found here: https://www.tiktok.com/legal/page/eea/privacy-policy/de

The data is transmitted to TikTok and stored on, or is retrievable from, servers in the USA, Malaysia, and Singapore. Further information on safeguarding international data transfer can be found in the section "Transfers of personal data to third countries."

If we hold a giveaway/sweepstakes, we process your personal data for the purpose of sending prizes: last name, first name, and address. Your data is stored on IU servers in Europe.

The legal basis is Art. 6(1) lit. b) GDPR, your participation in the respective giveaway. We delete your data as soon as it is no longer needed for the required purpose, namely your participation in the giveaway.

24 VIDEOS

24.1 Vimeo

We have embedded videos on our website that are stored on the Vimeo video platform. The video platform is operated by Vimeo LLC, 555 West 18th Street, New York, New York 10011, USA. With the help of a plug-in, we can show you interesting video material directly on our website. In doing so, the data described under server log files is transmitted to Vimeo. The legal basis is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, which you give by starting the video.

When you visit a website in which a Vimeo video is embedded, your browser connects to Vimeo's servers. In doing so, data is transmitted to Vimeo, and your data is stored on Vimeo's servers in the USA. IU has entered into a processing agreement with Vimeo for this purpose, which incorporates the EU Standard Contractual Clauses. A copy of the EU Standard Contractual Clauses is available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de. Vimeo uses your data, among other things, to improve its own service offerings and to show you advertising. Regardless of whether you have a Vimeo account or not, Vimeo collects data about you. Information on data processing at Vimeo can be found at https://vimeo.com/privacy.

If you have a Vimeo user account and are logged in while visiting our website, data about your visit will be linked to your Vimeo user account to form a user profile. If you wish to prevent this, we recommend logging out before visiting our website. You also have the right to object to such data processing at any time. To do so, we recommend adjusting your browser's cookie settings and the settings in our cookie tool.

Information on the cookies set in connection with Vimeo can be found in our cookie settings [insert hyperlink to cookie settings].

On our website, we provide videos that you can watch via the service "Vimeo." Vimeo is operated by Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA. After clicking the "Play video" button, a connection is established to Vimeo's servers. As a result, your IP address and the data stored in the server log files are transmitted to Vimeo's server, along with information about which of our pages you have visited. If you are logged into your Vimeo account at the time, Vimeo associates this information with your personal user account. You can prevent this association by logging out of your Vimeo user account and deleting the corresponding Vimeo cookies before using our website. Vimeo Inc.'s privacy policy can be viewed here: https://vimeo.com/privacy.

24.2 YouTube

On our website, we provide videos that you can watch via the service "YouTube." YouTube is operated by YouTube, LLC, 901 Cherry Ave. San Bruno, CA 94066 USA. After clicking the button to play the video, a connection is established to YouTube's servers.

Embedding via YouTube is done through framing. In this process, an HTML link provided by YouTube is inserted into the website's code, thereby creating a playback frame. The frame enables playback of the video, which is stored on YouTube's servers. We use YouTube in so-called enhanced privacy mode. Data collection via cookie activity only occurs after the video's playback function has been used. In order to play YouTube videos, we require your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. You can give this either via the cookie consent tool or by clicking the button to play the video. If you use YouTube, YouTube receives information that you are currently using our website. In doing so, IP address, browser information, the operating system and settings of the device used, the URL of the current website, previously visited websites if you followed a link, as well as information about the videos viewed, are transmitted to YouTube. If you are logged into your YouTube account, your data is associated with your YouTube profile. You can prevent this association by logging out of your YouTube user account and deleting the corresponding YouTube cookies before using our website. YouTube's privacy policy can be viewed here: https://policies.google.com/privacy, opt-out: https://adssettings.google.com/authenticated.

25 CLOUDINARY

On our website, we use a so-called content delivery network ("CDN") from Cloudinary Ltd., 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA ("Cloudinary"). A CDN is an online service that, in particular, helps large media files (such as graphics, page content, or scripts) be loaded through a network of regionally distributed servers connected via the internet and displayed on our website. The use of the CDN helps us optimize the loading speeds of our website. It may happen that your data is transferred to the USA for the purpose of providing the CDN.

The processing is carried out pursuant to Art. 6(1) sentence 1 lit. f) GDPR on the basis of our legitimate interest in the secure and efficient provision, as well as improvement of the stability and functionality, of our website.

We have entered into a data processing agreement (Data Processing Addendum) with Cloudinary, viewable at https://cloudinary.com/gdpr/dpa. Cloudinary is certified under the Data Privacy Framework.

Further information can be found in Cloudinary's privacy policy at: https://cloudinary.com/privacy.

26 Sentry, DataDog

In our offerings, we use the service Sentry. Sentry is operated by Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. We use Sentry to improve the technical stability of our offerings by monitoring system stability and identifying code errors. Further information on the processing of your personal data by Sentry is available at: https://sentry.io/privacy/. The processing is carried out pursuant to Art. 6(1) sentence 1 lit. f) GDPR to safeguard our legitimate interest in the secure operation of our offerings. Access to your data is granted to administrative IU employees, as well as employees of Sentry who are responsible for operating the application and who may have access to personal data in this context. Sentry is certified under the Data Privacy Framework. We process your personal data for the duration of the error analysis and delete it thereafter.

In our offerings, we use the service DataDog. DataDog is operated by Datadog, Inc., 620 8th Ave Fl 45, New York, NY 10018, USA. We use DataDog to improve the technical stability of our offerings by monitoring system stability and identifying code errors. Further information on the processing of your personal data by DataDog is available at: https://www.datadoghq.com/legal/privacy/. The processing is carried out pursuant to Art. 6(1) sentence 1 lit. f) GDPR to safeguard our legitimate interest in the secure operation of our offerings. Access to your data is granted to administrative IU employees, as well as employees of DataDog who are responsible for operating the application and who may have access to personal data in this context. DataDog is certified under the Data Privacy Framework. We process your personal data for the duration of the error analysis and delete it thereafter.

27 USE OF GOOGLE MAPS

We use Google Maps, a map service offered by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google Maps"), to display an interactive map and to create directions or assist in finding our campus or study locations and study advisory locations. We also use Google Maps to determine the nearest campus or study location based on your location. In order to display Google Maps to you, we require your consent pursuant to Art. 6(1) lit. a) GDPR, which you can give — if you have not already given it via the cookie consent tool — via the button in the Google Maps area. You can manage your cookie settings at any time here (hyperlink to cookie settings) and withdraw your consent with effect for the future.

When using Google Maps, information about your use (such as date and time of your visit, location information, URL, usage data, search terms, geographic location, and your IP address) is transmitted to and stored by Google. For this reason, we have entered into a processing agreement with Google. You can view the content of the agreement at https://business.safety.google/controllerterms/. If you are logged into your Google account, your data is associated with your Google profile. You can prevent this association by logging out of your Google user account and deleting the corresponding cookies before using our website. Once you access Google Maps, you are on a Google website; Google Maps' privacy policy and terms of use can be viewed here: https://policies.google.com/privacy?hl=de and https://www.google.com/intl/de_de/help/terms_maps.html. Google LLC is certified under the Data Privacy Framework.

28 SURVEYS AND QUESTIONNAIRES

28.1 Surveys on the Website

During your visit to our website, we may ask you, via a pop-up window, whether you already knew of us before visiting our website. For this purpose, we collect the data described under server log files. If you answer the question, we also process your answer. This information is evaluated in aggregated form on the basis of our legitimate interest pursuant to Art. 6(1) sentence 1 lit. f) GDPR, in order to understand the effectiveness of our marketing measures.

We store information in this context for the period determined by IU with regard to fulfilling its tasks, and delete the data thereafter.

28.2 Surveys

If you participate in a survey, we process your IP address, timestamp, and individual answers. The processing is carried out on the basis of your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR. You may withdraw your consent at any time with effect for the future by notifying us. Access to your personal data is granted only to IU employees involved in evaluating the surveys. To conduct the surveys, we use software provided to us by Qualtrics LLC, 333 W River Park Drive, Provo, UT 84604, USA. We have entered into a data processing agreement with Qualtrics. Qualtrics is certified under the Data Privacy Framework. Further information can be found in Qualtrics' privacy policy at: https://www.qualtrics.com/privacy-statement/. We store the data for a period of up to three months after evaluation of the survey and delete it thereafter.

29 COMPLAINTS PROCEDURE UNDER THE SUPPLY CHAIN ACT

IU provides a complaints procedure under the German Act on Corporate Due Diligence Obligations in Supply Chains ("Supply Chain Act"). Through this complaints procedure, you can confidentially or anonymously alert us to violations of human rights and environmental protection caused by us or one of our direct suppliers. The purpose of this data processing within the framework of the complaints procedure under the Supply Chain Act is to receive and investigate such reports of serious suspected cases.

For submitting a complaint via our online form, we use Microsoft Forms. Your personal data may be transmitted by Microsoft to Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"), in the USA. When data is transferred to the USA, there is a risk that your personal data may be processed by authorities there for control and monitoring purposes without your knowledge or without sufficient legal remedies being available to you. Microsoft is certified under the Data Privacy Framework. Information on data processing by Microsoft can be found at: https://privacy.microsoft.com/en-us/privacystatement.

If you yourself are the whistleblower, we have received your personal data directly from you. Depending on your information, this may involve processing, for example, your name, contact details, the circumstances of the report, or your observations. The legal basis for this processing is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, if you have given us your consent. Your consent pursuant to Art. 49(1) lit. a) GDPR is required for any possible data transfer to the USA through use of the form. You may withdraw your consent at any time with effect for the future by notifying us, without giving reasons.

It may also be the case that you yourself are not the whistleblower but rather another named person or an accused person. In such a case, we have received your data as part of a report made by a whistleblower. Depending on the content of the report, you may be affected insofar as your name, function, contact details, other factual information — including information regarding alleged legal violations — is processed. The legal basis for this processing is our fulfillment of legal obligations (namely under the Supply Chain Act) pursuant to Art. 6(1) sentence 1 lit. c) GDPR. Your personal data is generally made accessible only to those IU employees who need this data in order to ensure the purpose of the processing. Your identity as a whistleblower may only be disclosed to the persons responsible for receiving reports or for taking follow-up measures, as well as to persons supporting them in performing these tasks, if this is necessary, for example, for clarifying the facts.

If you are the accused party in a report or are otherwise named, your personal data may be transmitted to external third parties, such as the police, the public prosecutor's office, customs, or the Federal Office for Economic Affairs and Export Control (BAFA). The legal basis for this transmission is Art. 6(1) sentence 1 lit. c) GDPR.

IU processes personal data within the framework of this complaints procedure for a period of seven years from receipt of a report. If judicial and/or administrative proceedings occur, IU processes your personal data until the (legally binding/final) conclusion of the proceedings, which may extend beyond a period of seven years. If a report proves to be unfounded, IU deletes the corresponding reports without delay after determining that they are unfounded.

30 COMMUNICATION WITH JOURNALISTS AND PRESS REPRESENTATIVES

IU processes the names, contact details, information about professional activity, and the content of communications of press representatives and journalists for the purpose of press and public relations work and direct communication. The legal basis for the processing of personal data is Art. 6(1) sentence 1 lit. f) GDPR. The legitimate interest for the processing consists of conducting public relations and press work, which is why we maintain a press distribution list. For the email press distribution list, we use Meltwater (Meltwater Deutschland GmbH, Rotherstraße 22, 10245 Berlin). You have the option to unsubscribe from the press distribution list by clicking the link located at the end of each email. We have entered into a data processing agreement with Meltwater pursuant to Art. 28 GDPR.

To provide a user-friendly newsroom and to publish press content, we use PressPage (PressPage B.V., Joan Musykenweg 22, 1096 CJ Amsterdam). We also include a contact form on our website through which you can get in touch with us. For this, we process the mandatory information requested there (first and last name, email address, medium) as well as other optional information you provide to us. We also use PressPage to manage your inquiry. We have entered into a data processing agreement with PressPage pursuant to Art. 28 GDPR. Access to the data is granted to employees involved in public relations and press work. We process the personal data for the period during which we occasionally provide press representatives and journalists with information. We delete contact details upon request, or once we become aware that a person is no longer engaged in press or public relations activity.

31 REGISTRATION PORTAL FOR APPLICANTS FOR A PROFESSORSHIP AT IU

31.1 Registration for the Portal

As part of applying for a professorship at IU Internationale Hochschule GmbH, you are provided with the Registration Portal (hereinafter collectively referred to as the "Portal") for use, offering functionalities such as uploading your data and documents and describing your knowledge, skills, and work experience, for the purpose of reviewing the application for approval to use the professional title "Professor" during any employment at IU — i.e., whether, in the event of possible employment at IU Internationale Hochschule GmbH, you would be entitled to use the title "Professor" during the period of your employment at IU Internationale Hochschule GmbH (hereinafter the "Review Procedure").

Once you have logged into the Portal for the first time using your email address, which you provided to us during the application process, and a password you create, you will be given access to the Portal. The legal basis for this processing is the contract for use of the Portal, Art. 6(1) sentence 1 lit. b) GDPR.

We process your personal data for the period of your registration for the Portal and for three months thereafter. Access to your data is granted to IU employees involved in administering the Portal. For further information on the operation of the website, please see section 2.

31.2 Uploading Documents to the Portal

If you upload your documents to the Portal, we process, in addition to the data mentioned under server log files, the following categories of data about you:

• Your first and last name,

• Your contact details, such as address, phone number, email address,

• Your CV,

• An application photo, if you attach one,

• Your school and work certificates/references,

• Proof of internships, volunteer activities, portfolios of work samples, language certificates

The data mentioned is processed by us in connection with your application and the Review Procedure, namely to determine whether you meet the requirements and whether we can offer you approval to use the professional title "Professor" in the event of employment at IU Internationale Hochschule GmbH. The legal basis for this processing is Art. 6(1) sentence 1 lit. b) GDPR, i.e., the processing is necessary to carry out pre-contractual measures taken at the request of the data subject.

Access to your personal data is granted only to those IU employees responsible for the Review Procedure. Your data is processed within the Federal Republic of Germany. We also store your personal data in our CRM system. In this respect, it may occasionally happen that employees of the service provider gain access to your data, for example when system errors need to be fixed. In such a case, your data may also be processed outside the EU. We have entered into a data processing agreement with the service provider pursuant to Art. 28 GDPR for this purpose, which incorporates the EU Standard Contractual Clauses. A copy of the EU Standard Contractual Clauses is available here: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?locale=de.

In addition, we make use of various other service providers who support us with our Portal. In this context, it may happen that employees of these service providers — for example, those hosting our website — gain access to your personal data in the course of their job functions. Where our IT service providers process personal data, we have entered into a data processing agreement with them pursuant to Art. 28 GDPR. It may also be the case that employees of advisory service providers, such as law firms and/or tax advisors, who are legally bound to confidentiality, gain access to your personal data.

We process your data for the duration of the application and review process. If we offer you employment as a Professor at IU Internationale Hochschule GmbH, we process the documents you submitted for the duration of your employment relationship with IU and possibly beyond. Further information will then be provided in the privacy notice for employees. If we have not offered you a position, we process documents containing your personal data for a further period of six (6) months from the date the rejection was sent, and delete your data thereafter, unless you have given us consent that you would like us to retain your documents for a period of one (1) year from receipt of the consent; in such a case, we will only delete your data at the end of that year, or within two (2) weeks of receiving your withdrawal of consent.

31.3 Offer of a Contract

If we can offer you a position, we process your data so that you can conclude an employment contract with us. Information on how we process the personal data of our employees will be provided to you upon transmission of the employment contract.

32 DATA PROCESSING WHEN SHARING INFORMATION

Internal IU users can use this website to store a secret in a digital vault, or store a document in a digital storage room/vault for files. Internal users can also create a file portal and request file uploads. The link to retrieve the secret or the document, or the file portal, can be sent by the user themselves or automatically via email. In doing so, we process the first name, last name, email address, as well as the time and date of storage, and, where applicable, file name, format, and content, as well as the amount of data transmitted.

External users can submit a secret or a file, or upload a file to a file portal, by verifying their email address with a link. The secret or file is placed in the previously defined digital vault or digital storage room, or uploaded to the file portal, and a previously designated person within IU is notified. In doing so, we process the first name, last name, email address, as well as the time and date of storage, and, where applicable, file name, format, and content, as well as the amount of data transmitted.

The legal basis for this processing is Art. 6(1) sentence 1 lit. b) GDPR, i.e., the processing is necessary for the performance of a contract or pre-contractual measures. Insofar as you transmit unsolicited additional information, this is done on the basis of your consent, Art. 6(1) sentence 1 lit. a) GDPR.

To operate the website, we make use of the services of Microsoft Azure, a service of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft"). We have entered into a data processing agreement with Microsoft based on the EU Standard Contractual Clauses. The EU Standard Contractual Clauses can be accessed at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=de. We generally store your data within the EU. Further information on data processing by Microsoft is available at https://privacy.microsoft.com/en-us/privacystatement.

33 RIGHTS OF THE DATA SUBJECT

You may contact IU either in writing or by email at datenschutz@iu.org in order to exercise the following rights:

• Access to your data, in order to check and verify it,

• Receipt of a copy of your personal data,

• Rectification, erasure, or restriction of processing; this also includes the right to complete incomplete or incorrect data by means of a supplementary statement,

• Right to object to processing; please note that pursuant to Art. 21 GDPR, you have the right to object to the processing of personal data carried out by us on the basis of legitimate interests pursuant to Art. 6(1) sentence 1 lit. f) GDPR; a right to object to processing exists insofar as this occurs for reasons arising from your particular situation; insofar as the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right to object without needing to state a particular situation,

• You may receive your provided data in a structured, commonly used, and machine-readable format and transmit this data to another controller, provided you have given your consent to the processing or the processing is based on a contract.

• If you have given us your consent to the processing of your personal data, you may withdraw it at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority in connection with the processing of your personal data. To exercise this right, you may contact the authority responsible for your place of residence, or the authority responsible for IU's location in Thuringia: The Thuringian State Commissioner for Data Protection, Häßlerstraße 8, 99096 Erfurt.

34 AUTOMATED DECISION-MAKING AND PROFILING

With the exception of the processes described below, your personal data is not used by IU for profiling.

By visiting our website, we place cookies from various providers, provided you have given your consent in this regard. Using the cookies you have allowed, data is generated as described under server log files. This data is combined and merged by IU using a Google solution. IU has entered into a processing agreement with Google, with registered office at Gordon House, Barrow Street, Dublin 4, Ireland, for this purpose. Google LLC is certified under the Data Privacy Framework. If we receive information about you via our website, for example because you ask us to send information materials or contact us, we store your data and combine it with data generated by cookies. We also receive reports from Google Analytics with data that we likewise combine with your data. Further information can be found in the section on Google Analytics.

With the help of your consent regarding data generated via our website, we store this data in a CRM solution. We analyze this data to determine whether you are merely interested in a course of study we offer, or whether you have also applied, and enrich your data record with corresponding information. This profile created about you is stored in a Salesforce solution from the provider Salesforce, with registered office at Floor 26 Salesforce Tower, 110 Bishopsgate, EC2N 4AY London, England. The EU Commission has issued an adequacy decision for the United Kingdom. To safeguard possible data transfers to the USA, Salesforce is certified under the Data Privacy Framework.

The legal basis for the data processing carried out here is your consent pursuant to Art. 6(1) sentence 1 lit. a) GDPR, which you may withdraw at any time with effect for the future by contacting datenschutz@iu.org.

35 WHY IS YOUR PERSONAL DATA COLLECTED?

You are not obligated to provide us with your personal data, or you may provide it incompletely. In such a case, for example, if you prevent the storage of a cookie, this may mean that you are unable to use all the functionalities of the website.

35.1 In the Study Application Process or a Job Application

If you do not provide us with your personal data, or do not provide it completely, as part of a study application process or a job application, we may not be able to offer you a study place or participation in an application process.

35.2 In the Purchasing Process

If you do not provide us with your personal data, or do not provide it completely, as part of the purchasing process, we may not be able to offer you the purchase of licenses and continuing education courses.