This Privacy Notice explains how your personal data is processed in connection with the use of this website and the provided functionalities, such as the menu for ordering information, a blog and search functions (hereinafter collectively referred to as the „Website“).

This Website uses SSL or TLS encryption for security and to protect the transmission of personal data and other confidential content (e.g. orders or inquiries submitted to the data controller). You can recognize an encrypted connection by the string “https://” and the lock symbol in your browser line. 

1 Data Controller and Data Protection Officer

This Website is operated by IU Group N.V., Square Ambiorix 10, BE-1000 Bruxelles („IU Group“). IU Group is the data controller for the processing of your personal data.

IU Group processes your personal data on a subject-related basis in joint controllership with other companies belonging to the Group (all with their registered office at Mülheimer Straße 38, 53604 Bad Honnef, Germany, unless otherwise stated). Activities in connection with the operation of the IU International University are carried out in joint controllership with IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt ("IU"), also with regard to its study programs including getting into contact and the provision of information; if you are enrolled in or interested in a medical or psychological study program, processing is executed in addition in joint controllership with IU Medical School GmbH, Große Bleiche 14-20, 55116 Mainz („IU Medical School“). For central services within the Group, such as controlling, accounting and personnel administration, office, process and quality management, purchasing and sales, as well as other services, the aforementioned companies receive support of IU Corporate Services GmbH, which is jointly responsible for data processing; IU IT Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, with regard to the provision of the operational IT infrastructure including hardware and software, telecommunication and electronic communication; IU Examination Service GmbH for services in the field of examination supervision; IU Marketing Service GmbH as well as IU Sales Services GmbH, Ridlerstr. 57, c/o IU Group NV, 80339 Munich, for services in the area of marketing and sales (this also includes marketing via this website and the operation of the applicant portal for students); IU Commercial 1 GmbH for the management of the online campus and IU Commercial 2 GmbH for the management of the campus locations and with regard to the campus programs; IU Student Services GmbH together with the respective GmbH that exists for the respective location and is named after its city name, e.g. IU Dortmund GmbH or IU Bonn GmbH, for the support of prospective students and students, in particular student advising.

IU Group has appointed Dr. Annette Demmel, SPB DPO Services GmbH, Unter den Linden 21, 10117 Berlin, annette.demmel@spb-dpo-services.com, as its data protection officer for the aforementioned companies.

You can contact IU Group either in writing or per email at datenschutz@iu.org.

2 Data Collection When Visiting the Website

​When using our Website for informational purposes only, i.e. if you do not register or otherwise transmit information to us, we only collect data that your browser transmits to our server (so-called „Server Log Files“). When you access our Website, we collect the following data, which is technically necessary in order to display the Website for you:

• Our Website visited
• Date and time of access
• Quantity of data transmitted in byte
• Source/reference from which you reached the page
• Browser used
• Operating system used
• IP address used

The processing takes place in accordance with Art.6(1)(b) of the General Data Protection Regulation (“GDPR”) on the basis of your use of our Website and our interest in improving the stability and functionality of our Website in accordance with Art.6(1)(f) GDPR.

We process your data in order to provide you with a functional website, retain the data for the duration specified by IU for this purpose and delete your data thereafter.

Only employees of IU who are responsible for maintaining the Website receive access to your personal data.

We use third-party services on our Website. Further information about these services and the related data processing is found in this Privacy Policy or the cookie settings.

3 Cookies

Depending on your browser settings and whether you have given us your consent, cookies may be used when you visit this Website in order to extend the functionality of the Website and make it more convenient for you to use. Cookies are small text files that are stored on your computer. Most of the cookies used by IU are deleted from your hard drive at the end of the browser session („Session Cookies”). In addition, IU uses so-called permanent cookies („Persistent Cookies”), which remain on your device in order to recognize you the next time you visit the Website. If cookies are used, they collect and process to an individual extent certain user information such as browser and location data, IP address values and as described in the Server Log Files. Persistent cookies are automatically deleted after a specified period of time, which may differ depending on the cookie.

An overview of the cookies used and the duration of the respective cookie storage can be found in the cookie settings in our Cookie Consent Tool.

If personal data is also processed through individual cookies used by us, the processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our Website (so-called „Necessary Cookies”) or in accordance with Art. 6(1)(a) GDPR on the basis of your consent for all other cookies (marketing and analysis cookies).

Please note that you can configure your browser in such a way that you are informed about the use of cookies and can decide individually whether to accept or to refuse to accept them in certain cases or in general. Each browser differs in the way it manages cookie settings. Cookie settings are described in the help menu of each browser, which explains how you can change your cookie settings.

Please note that if you do not accept cookies, the functionality of our Website may be limited. 

4 Cookie Consent Tool

​​This website uses a so-called cookie consent tool of Usercentrics GmbH, Rosental 4, 80331 Munich, Germany (the „Cookie Consent Tool“) to obtain consent to the use of cookies and cookie-based applications that require consent.

By integrating a corresponding JavaScript code, users are shown a banner when they access our Website, in which consent for certain cookies and/or cookie-based applications can be given by ticking the appropriate box.

The Cookie Consent Tool blocks the use of all cookies requiring consent until the respective user grants the corresponding consent by ticking the appropriate box. This ensures that cookies of this type are only placed on the user’s device if consent has been granted.

In order for the Cookie Consent Tool to be able to clearly assign page views to individual users and to individually record, log and store the consent settings chosen by the user for a session duration, certain user information, as described in the Server Log Files and including the IP address, is collected by the Cookie Consent Tool when our Website is accessed, transmitted to servers of the Cookie Consent Tool and stored there. For further details, please refer to the information provided in each case in the Cookie Consent Tool.

The data processing carried out by the Cookie Consent Tool takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in a legally compliant, user-specific and user-friendly consent management for cookies and thus our legitimate interest in our Website being lawfully designed.

We have concluded a data processing agreement with Usercentrics GmbH, which obligates Usercentrics GmbH to protect the data of visitors to our Website and to refrain from disclosing such data to third parties.

We process your data for this purpose for the duration of your session and delete your data thereafter, unless you have given your consent to the use of cookies, in which case we process your data for the duration specified for each cookie.

For further information on the use of data by Usercentrics GmbH, please refer to Usercentrics’ Privacy Policy at https://usercentrics.com/privacy-policy/. 

5 Contact (e.g. by email)

​​If you contact us by e-mail, we process the information necessary to answer your contact requrest, e.g. your e-mail address, the information you provide and the date and time of the contact. If you also provide us with your name and other personal data, we also process these.

If you conduct an online meeting with us, we additionally process your name displayed, if applicable your profile picture, preferred language, date, time, meeting ID, if applicable your phone number, as well as exchanged texts, audio and video data. To handle our communications, we use Microsoft 365, Microsoft Teams, both services are provided by Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA ("Microsoft") and Zoom Video Communications, Inc., 55 Almaden Boulevard, Suite 600, San Jose, CA 95113, USA („Zoom“).

The legal basis for this processing is Art. 6 (1)(b) GDPR. We process your data in order to respond to your inquiry. Your personal data will be retained in each case for the period determined by IU in order to perform the task and will be deleted thereafter. This is based on the retention periods under commercial and tax law. Only employees of IU who are responsible for responding to contact requests will receive access to your personal data.

We have concluded data processing agreements with Microsoft and Zoom based on the EU Standard Contractual Clauses. You can access the EU Standard Contractual Clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en. For more information on data processing by Microsoft, please visit https://privacy.microsoft.com/de-de/privacystatement and for Zoom https://explore.zoom.us/en/privacy/. 

5.1 Free Call-Back Service

​​If you use our free call-back service, we will process your first and last name, your email address, if applicable, your telephone number, the desired call-back time (date and time) and a message to us in order to call you back about the matter you have specified. The legal basis for this processing is Art. 6(1)(b) GDPR. If we do not reach you by telephone and you have given us your consent to do so in accordance with Art. 6(1)(a) GDPR, we will contact you by email. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. Only employees of IU who are responsible for handling corresponding inquiries receive access to your data. As part of our telephone customer support, we may occasionally record telephone calls for training and quality control purposes. Should this be the case, you will be informed about this separately and can give your consent in this regard.

Except for to the transfers of usage data to the USA described in connection with Google Analytics, IU will not transfer your personal data to a third country outside the EU. Any other transfer will only take place if IU is required to do so by law or by the authorities or if the transfer is necessary in the context of your use of the website. 

5.2 WhatsApp

If you decide to communicate with us via WhatsApp as part of your application for admission or during your studies, we will process your personal data, such as your telephone number, your picture, your status information and your name if you provide us with this information. In addition, we process any personal data that you communicate to us via WhatsApp. In this regard, we recommend that you only provide us with the information that is absolutely necessary to answer your request and refrain from providing any additional information. Whether you use WhatsApp is up to you, and you can receive the same information by phone, electronically and/or regular mail. 

IU processes your personal data in order to communicate with you. The legal basis for this data processing by IU is your use of our WhatsApp channels in accordance with Art. 6(1)(b) GDPR.

You can withdraw your consent to the processing of your personal data at any time. The withdrawal can be made via the specified contact options. The declaration of withdrawal does not affect the lawfulness of the processing carried out so far.

The data processing by WhatsApp is governed by the Privacy Policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, which can be found at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy.

WhatsApp is a telecommunications service offered by WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, and a company of Facebook Inc.

Access to your personal data is granted to those IU employees who manage our WhatsApp channels. IU uses a software solution of the provider Messenger People, which does not require an app installation. Even if the use of the software solution largely excludes access to data by WhatsApp, it cannot be ruled out that employees of WhatsApp or Facebook may also receive access to your personal data. Likewise, it cannot be ruled out that your data will be stored on WhatsApp servers in the United States of America. For this purpose, a contract that incorporates the EU standard contractual clauses has been concluded. You can find further information in this regard in WhatsApp’s Privacy Policy, if applicable. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. 

5.3 Online Chat (Bold360)

IU uses a live chat service provided by the company Genesys Telecommunications Laboratories GmbH, Joseph-Wild-Straße 20, 81829 Munich („Genesys“). The online chat is carried out by means of a chat bot, which can help with questions on operational issues. Chat bots are programs that simulate an online guided dialogue. This means that you are chatting with a computer program rather than an employee. Alternatively, you can use the live chat as a contact form to chat with our employees almost in real time. For this purpose, we process your first and last name in addition to the data mentioned under Server Log Files. If you enter your email address, we also process this data.

Depending on the course of the conversation with our employees, you may provide additional personal data during the chat. If this is the case, then we also process this personal data about you. The type of data processed largely depends on your request. The processing of your personal data takes place on the basis of Art. 6(1)(b) GDPR in order to respond to your request. By using the online chat function, cookies are placed on your device. You can find further information in this regard in our cookie settings.

Your personal data and the history of the live chat are retained in each case for the period determined by IU in order to perform the task and is then deleted. This serves to prevent you from having to provide extensive explanations about the history of your inquiry should you contact us with a further inquiry.

For further information about the data processing performed by the chat bot, please refer to Genesys’ Privacy Policy at https://help.mypurecloud.com/articles/genesys-cloud-privacy-policy/.

Except for to the transfers of usage data to the USA described in connection with Google Analytics, IU will not transfer your personal data to a third country outside the EU. Any other transfer will only take place if IU is required to do so by law or by the authorities or if the transfer is necessary in the context of your use of the website.

5.4 Typeform

We use typeform provided by TYPEFORM SL, C/Bac de Roda, 163 (Local), 08018 Barcelona, Spain (“Typeform”) for some contact forms. You can tell that we use Typeform because “Typeform” is displayed as a logo at the bottom right of the screen. Typeform allows us to provide you with an easy way to contact us.

For this purpose, we share the following personal data with Typeform:

• Email address*
• First name*
• Last name*
• Telephone number

Mandatory fields are marked with *.

Typeform is a recipient of your personal data and acts as a processor for us, which is why we have concluded a data processing agreement with Typeform. The legal basis for these processing operations is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent to the processing of your personal data at any time. The withdrawal can be made via the specified contact options. Your data will be processed until your request has been answered. By withdrawing your consent, the legality of the processing that has taken place so far will not be affected.

The data is retained exclusively for the purpose of transmitting and responding to requests. The mandatory data is used for assigning and responding to your requests. You can also choose not to provide us with your personal data using such a contact form. Alternatively, you can contact us at the email address provided in this Notice.

In addition to the data mentioned above, Typeform collects the following personal data with the help of cookies: Information about your device (IP address, device information, operating system, browser settings). Furthermore, usage data is collected, such as the date and time when you used the contact form. Further information can be found at: https://help.typeform.com/hc/en-us/articles/360029581691-What-happens-to-my-data.

For further information regarding objection and deletion options in relation to Typeform, please refer to: https://admin.typeform.com/to/dwk6gt​. 

6 Online information events

​If you register to participate in an online information event via our Website, then we process your first and last name and your email address in addition to the data mentioned under Server Log Files. We process your data on the basis of Art. 6(1)(b) GDPR in order to send you an invitation to our online information event. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. You will receive information on the processing of your data by the provider of the video conferencing tool when you receive the invitation. 

7 Request for Free Info Brochure

If you request information material to be sent to you electronically, we will process your title, first and last name, email address, telephone number (if applicable) and details of the subject of the requested information in order to provide you with the information material. The legal basis for this processing is Art. 6(1)(b) GDPR. If we do not reach you by email and you have provided us with your consent in accordance with Art. 6(1)(a) GDPR, we will contact you by telephone. Access to your data will be granted to those employees who are responsible for managing and processing such requests as part of their job.

To collect your personal data described above, we use Google Lead Form Ads, an application provided by Google Ireland Ltd. ("Google"), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. The information you enter in the form to request information material may be transferred to a Google server in the US. The data entered in the form is encrypted and stored by Google for up to 60 days. Only the IU has access to this data. To secure this data transfer, the IU has entered into a data processing agreement with Google, which includes EU Standard Contractual Clauses. You can access the EU Standard Contractual Clauses at https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX:32021D0914&locale=en.

Except for the transfers of usage data to the USA described in connection with Google Analytics, IU will not transfer your personal data to a third country outside the EU. Any other transfer will only take place if IU is required to do so by law or by public authorities or if the transfer is necessary in the context of your use of the Website. Your personal data will be retained in each case for the period determined by IU in order to perform the task and then deleted. 

8 Enrollment for Studies

If you enroll to study with us via the Website, we process your name, address, contact information, details of your previous education in the form of certificates, letters of recommendation and a curriculum vitae, desired course of study and payment data, such as account information, as well as data required for the preparation and executing the educational contract concluded with you.If you decide to cache your online application and complete it at a later date, we will send you a link to the storage location to your email address where we will retain the incomplete application for you for 30 days to access for completion. If you wish to receive a study contract by postal mail, we will use your data to summarize the information you have provided so far in a draft and send it to you by postal mail.

If you fill out the online application for recognition/credit for previous achievements via the Website, we collect your contact data, including name and postal address, email address, your telephone number, desired course of study, information on your previous education and your previous professional career, information on other qualifications, evaluations, training and work references.

The legal basis in this regard is Art. 6(1)(b) GDPR. You will receive detailed information on the processing of your personal data during the registration and recognition process. Access to your personal data is granted to those employees who are responsible for supporting applicants in the Enrollment Office or the Admissions Office of IU.

Except for to the transfers of usage data to the USA described in connection with Google Analytics, IU will not transfer your personal data to a third country outside the EU. Any other transfer will only take place if IU is required to do so by law or by the authorities or if the transfer is necessary in the context of your use of the website.

Personal data that you provide in the course of enrolling for a course of study will be retained for the duration of your studies and in accordance with statutory retention periods (for a period of six to ten years under the German Fiscal Code and the German Commercial Code). Data collected in the context of an application for possible recognition/credit of prior achievements will be stored for twelve months from the date of submission of the application. If matriculation does not take place during this period, the application together with all documents will be deleted.

For further information, please refer to the privacy notice for students, which you will receive with the documents to enroll in a degree program. 

9 Applicant portal for students

​Registration with the Applicant Portal

As part of the online application for admission, you will be able to use the applicant portal (hereinafter collectively referred to as the („Applicant Portal“) and its functionalities, such as uploading your data and documents and describing your knowledge and skills. If you use other functionalities, such as if you want to participate in an information session or an applicant interview, then these activities take place outside the Applicant Portal. You will receive information on the data processing that takes place in this case separately.

If you register for the Applicant Portal, we use the so-called double opt-in procedure, i.e. you will receive an email with which you must confirm that you are the email address owner. Please note that this is purely a precautionary measure and that sending a confirmation email to you has no legal effect. Once you have provided the appropriate confirmation, you will be granted access to our Applicant Portal. The legal basis for this processing is the sending of your application to us in accordance with Art. 6(1)(b) GDPR.

In order to make the onboarding process as easy as possible for you, in particular to provide you with a good overview of the status of your application or missing documents at any time, to facilitate the selection of a practice partners, to request help or to enable you to change your information, we use the onboarding tool of Product Fruits s.r.o., Rozdelovska 1999/7, 169 00 Prague 6, Czech Republic ("Product Fruits"). Product Fruits creates user journeys for you by visualizing the personal data you have provided to us as part of the application process. In addition, IU employees may access aggregated statistics generated from the activities of applicants. Howevere, no reference to an individual person can be made in this process. IU uses these statistics to monitor how many applicants abandon the application process or how long an average application process takes. The legal basis for the use of Product Fruit is, according to Art. 6 para. 1 p. 1 lit. f) GDPR, our legitimate interest in providing you with a user-friendly application portal on the one hand and optimizing our internal processes and personnel planning on the other.

Only those employees of IU who are responsible for the admission will have access to your personal data. We store your personal data in our CRM system from Salesforce, Floor 26, Salesforce Tower, 110 Bishopsgate EC2N 4AY London, United Kingdom, from which Product Fruits creates the user journeys described above. In this respect, it may occasionally happen that employees of the service provider gain access to your data, e.g. if errors in the system need to be corrected. For this purpose, we have concluded data processing agreements with the service providers in accordance with Art. 28 GDPR; the EU standard contractual clauses are incorporated in the agreement with Salesforce. If you would like to receive a copy of the EU standard contractual clauses, please contact datenschutz@iu.org.

We process your personal data for as long as you save your profile in our Applicant Portal. If we find that you have registered for the Applicant Portal but have not logged in for more than 12 months, we will send you an email informing you that we will delete your data after 4 weeks if you do not log in again.

Uploading your documents

If you upload your application documents to the Applicant Portal, then we also process the following categories of data about you in addition to the data mentioned in the Server Log Files:

• Your first and last name,
• Your contact information, such as address, telephone number, email address,
• Your curriculum vitae,
• An application photograph, if you include one,
• Your certificates,
• Your cover letter,
• In particular, proof of internships, volunteer work, portfolios with work samples, proof of language skills

We process the aforementioned data as part of your application, specifically, to determine whether you meet the requirements and we can offer you the desired course of study. The legal basis for this processing is Art. 6(1)(b) GDPR, i.e. the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract.

Only those employees of IU who are responsible for admissions will receive access to your personal data. Your data will be processed in the Federal Republic of Germany. We also store your personal data in our CRM system. In this respect, it is possible that employees of the service provider may occasionally receive access to your data, for example, if errors in the system need to be corrected. In such a case, your data may also be processed outside the EU. For this purpose, we have concluded a data processing agreement with the service provider in accordance with Art. 28 GDPR, which incorporates the EU standard contractual clauses. You have the right to obtain a copy of the EU standard contractual clauses; in this regard, please contact datenschutz@iu.org.  

In addition, we also use various other service providers that assist us with our Applicant Portal. In this context, it is possible that employees of these service providers, who host our website, for example, may receive access to your personal data as part of their job function. If our IT service providers process personal data, we have entered into a data processing agreement with them in accordance with Art. 28 GDPR. Furthermore, employees of service providers providing consulting services, such as law firms and/or tax advisors, who are legally bound to secrecy, may receive access to your personal data.

We process your data for the duration of the application process. If you are accepted as a student, then we process the documents that you have submitted for the duration of your studies and possibly beyond. You will then receive more detailed information in the privacy notice for students. If we have not accepted you as a student, we will continue to process documents containing your personal data for a period of six (6) months from the date of sending the rejection letter and will delete your data thereafter, unless you have given us your consent that you want us to keep your documents for a period of one (1) year from the date of receipt of your consent; in such a case, we will not delete your data until the end of the year or within two (2) weeks from receipt of your withdrawal of consent.

Registering for an information session

If you click on the “Information Session” field, you will be taken to another website via a hyperlink. The data processing that takes place in this regard is governed by the privacy notice that you can view on the website.

If you register for an information session, we process the following data in order to hold an information session with you:

• Your first and last name
• Your telephone number/your email address and
• The data described in the context of the Server Log Files

We process the aforementioned data in order to invite you to an information session. The legal basis for this processing is Art. 6(1)(b) GDPR.

Only those employees of IU who are responsible for conducting the information sessions will receive access to your personal data. If we hold an information session online, we will send you a link to the provider’s privacy notice together with the participation link.

Your personal data will be processed, stored and deleted as described in section "Uploading your documents".

Participating in an interview

If you have uploaded your documents completely, we may invite you to an interview. In this context, we process the categories of data described in section I. In addition, we will then also process

• Your email address,
• Your telephone number,
• The appointment scheduled with you and
• The data described in the context of the Server Log Files.

We process your data in order to conduct an interview with you to determine whether we can accept you as a student. The legal basis for this processing is Art. 6(1)(b) GDPR, i.e. the processing is necessary in order to take steps at the request of the data subject prior to entering into a contract.

Only those employees of IU who are responsible for conducting the interview, who supervise applications for admission, and who participate in such an interview will receive access to your personal data. If we hold the interview online, we will send you a link to the provider’s privacy notice together with the link to participate.

Your personal data will be processed, stored and deleted as described in section "Uploading your documents".

Concluding a contract and matriculation

If we are able to accept you as a student, we will process the data described in the Server Log Files and the data mentioned in section "Uploading your documents" so that you can enter into an educational contract with us and enroll. You will receive information on how we process the personal data of our students together with the educational contract. 

10 Use of our blog

​​Different topics relating to IU are published on our blog. If you participate in a discussion or publish a contribution yourself, we process the data described in the Server Log Files as well as your name and photograph in order to introduce you. The legal basis for this processing is your consent in accordance with Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future. We will then delete your blog post within two weeks of receiving your withdrawal. Please bear in mind that posts and your photograph may be stored locally on blog readers’ devices and we have no way of deleting any locally stored data. We recommend that you use a pseudonym instead of your real name. Please keep in mind that your posts are visible to everyone worldwide. We reserve the right to delete contributions if third parties object that they are illegal. Our employees who maintain the Website will receive access to your personal data. 

Except for the transfers of usage data to the USA described in connection with Google Analytics, IU will not transfer your personal data to a third country outside the EU. Any other transfer will only take place if IU is required to do so by law or by public authorities or if the transfer is necessary in the context of your use of the Website. 

11 Web Analysis Services

​Our website uses analysis services in order to collect information about our website, provided you have consented to the setting of the corresponding cookies. The data obtained with the help of these analysis services, such as the location of the visitors or their length of stay on our website, gives us information about visitor behaviour on our website. With the help of this data, we can not only eliminate website issues, but also improve the efficiency of our website. Further information on the analysis services used on our website can be found below. For information on the processing of personal data by the cookies set for this purpose, such as the storage duration of the cookies, please refer to our cookie settings.

​

11.1 Google Analytics and Google Signals

​We use Google Analytics to get an overview of the behaviour of website visitors, and gain insights regarding our digital marketing efforts. Google Analytics allows us to collect and evaluate the data specifically relevant to IU, for example how far down a webpage was scrolled, which button was clicked, etc. Google Analytics also helps us, for example, understand user demographic characteristics such as age, gender and interests, geographic characteristics such as language and location, as well as technical characteristics such as device type, browser and operating system. With the help of this data we can not only optimise our website, but can also recognise how the respective user sessions ended (e.g. simple website visit, request for information material, application for studies). Google Analytics also helps us recognise which webpage a user is accessing and via which channel the users come to our website from (e.g. via a paid or unpaid ad, a Google search, a Facebook post or direct access to the website). With the help of this information, IU can identify which marketing channels are working and which are not. Google Analytics also allows us to recognise user paths, i.e. where users are moving on our website, whether they are going back to the start page and how many users access our website. With the help of this information, we can, for example, recognise whether the jumping off of a large number of users is due to a technical defect in the website. The above data gives us a good overview of our website and how it is used. Even if we collect user data, we cannot draw any conclusions about your identity from this data, as we receive reports from Google Analytics that are based on aggregated data sets.

Since we have also activated the Google Signals service offered by Google, i.e. so-called cross-device tracking, your data is analyzed across devices. Google can thus recognize whether you visit our website first via a smartphone and later via a laptop. We ourselves only receive reports with anonymous data from which we can recognize patterns in user behavior. Google Signals is active if you have a Google account and are logged into it when you visit our website. Furthermore, you must have agreed to "personalized advertising" with Google. If you do not want cross-device tracking, you must deactivate "personalized advertising" in your Google account. Google Signals allows us to launch cross-device remarketing campaigns. This means that we also show you our advertising on third-party websites.

Information on the provider, the cookies set, the legal basis for cookie collection, international data transfers and storage times of the cookies can be found in our cookie settings.

11.2 Mouseflow

​We use Mouseflow to analyse user behaviour on our website, provided you have consented to the setting of the corresponding cookies. Mouseflow observes website users, records session videos and uses these videos to show how users behave on the website (e.g. how far down they scroll). Mouseflow does not collect any clear data for this purpose (e.g. if you enter data in a contact form, Mouseflow does not collect this data because the fields on the contact form are hidden from it). Using Mouseflow, we can also create what is known as heat maps for website use. This is summarised data on all visitors that helps us evaluate scroll, click and mouse behaviour. Mouseflow also shows us exactly at which point in a form users have stopped filling out the form. This user data analysis gives us insights into the use of our website without being able to draw any conclusions about your identity, as we receive reports from Mouseflow based on aggregated data sets.

Information on the provider, the cookies set, the legal basis for cookie collection, international data transfers and storage times of the cookies can be found in our cookie settings.

11.3 Contentsquare

We use ContentsSquare to analyze usage behavior on our website, provided you have consented to the setting of corresponding cookies. Contentsquare collects interaction data of your visit to our website (such as duration of visit, clicks or scrolling). By means of this data, which we process in pseudonymous form, we gain insight into the way our website is used and can base measures for optimizing user-friendliness or develop marketing measures on this.​

Information on the provider, the cookies set, the legal basis, international data transfers and storage times of the cookies can be found in our cookie settings.

12 Google Tag Manager

​​This website uses Google Tag Manager („GTM”), a service provided by Google Ireland Ltd. („Google”), with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland. Through the use of GTM, tags such as code snippets or pixels are used on our own Website by means of a so-called container, which inserts a kind of placeholder into the source code and in which the tools that are to be used are stored without IU having to interfere with the source code of our Website. Using GTM, tools can be used on our own Website without having to include each of them in the source code. Instead, only the code of GTM has to be included, and then GTM can be used as a central place to launch or disable the desired tools.

GTM works on the Website when a defined user behavior triggers a tag (i.e. a pixel tag, web beacon, or html code) for the tool. GTM collects the relevant data for the built-in tool and forwards it to the tool. Information about the tools used on our Website that are loaded via GTM can be found here. In this context, not only are the data categories described for the respective tools transferred to the respective tool providers; Google Ireland Ltd. also receives information about your usage behavior on our Website. Since a large number of the tool providers are located in countries outside the EU, please refer to the description of the respective tools if you would like to receive information on the transfer mechanisms agreed with IU. IU has also entered into a data processing agreement with Google Ireland Ltd., which incorporates the EU standard contractual clauses. The main content of this agreement is available for review here: https://policies.google.com/privacy/frameworks?hl=en.

IU uses GTM to deploy not only statistical tools but also marketing tools. Accordingly, GTM is a statistics and marketing tool, and the use of GTM is based on your consent in accordance with Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future by sending an email to datenschutz@iu.org. 

13 A/B-Testing

​​This website uses a A/B testing tools. A/B testing consists of a performance comparison between two or more versions of a website. We test the efficiency of version “A” and version “B” by statistically analyzing, taking different indicators into account.

To enable A/B testing we place a cookie. This cookie contains information solely regarding the received version (“Cookie ID”) and your shortened IP address. The cookie processes no additional personal data. In accordance with Art. 5(3) ePrivacy Directive the placed cookie is for once not a consent-based cookie, as without the cookie the website could not be displayed and its placement is thereby absolutely necessary to provide a user with an explicitly requested service of the information society, namely displaying our website. We do not build user profiles by use of the cookie.

As part of A/B Testing, we determine the efficiency of different versions of our website, for example, how a different color design affects user behavior or a certain order or arrangement. If you decide to participate in A/B testing, we evaluate your usage behavior in anonymized form. For this purpose, we use your shortened IP address and your behavior on our site. We cannot establish a personal reference and we do not create any personal profiles.

Information on the provider, the cookies set, the legal basis for cookie collection, international data transfers and storage times of the cookies can be found in our cookie settings.

14 Customer list matching

We use tools to match customer lists with various advertising providers in order to more specifically target customers who may have an interest in our products. For this purpose, we import a list with names, email addresses, date of birth, gender and, if applicable, address data of our customers into our own advertising account that we have created with an advertising provider, e.g. Facebook, and hash it, i.e. we generate a shorter, numeric value or key with a fixed length. The advertising provider matches this list in the hashed form with its own database and, based on this, selects customers to whom our ads are displayed when they use the advertising provider's products, such as a search engine, a social media platform, a streaming platform or a communication service. In case of a match of customer data, they are added to our account as successfully matched customers.

The legal basis for processing is your consent in accordance with Art. 6 para. 1 a) GDPR. Your personal data in connection with the use of customer list matching with advertising providers will be stored by the respective provider for the duration of the matching of the customer list and is then deleted. IU will use the data for the duration of your consent. At IU, only employees of IU who are responsible for the relevant area have access to your personal data. We currently use the following services:

Google Customer Match: Your personal data will be transferred to Google Ireland Limited, Google Building Gordon House, 4 Barrow Street, Dublin D04 E5W5, Ireland; Alphabet Inc. and Google LLC, 1600 Amphitheatre Parkway Mountain View, CA 94043, USA. To the extent that your personal data is transferred to Google in the USA, this is done on the basis of an agreement that IU has concluded with Google for this purpose and in which the EU standard contractual clauses are included. You can view the main content of the agreement at https://policies.google.com/privacy/frameworks?hl=de and https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en. For further information, please visit https://support.google.com/adwordspolicy/answer/6299717?hl=de. Google's privacy policy can be found at: https://www.google.com/intl/de/policies/privacy/. You can edit your personal data and privacy settings under Google "My Account": https://myaccount.google.com/intro?hl=de  

Facebook Custom Audience: Your personal data will be transferred to Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin, D02, Ireland. Insofar as your personal data is transferred to Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, in the USA, this is done on the basis of an agreement that IU has concluded for this purpose with Facbook or Facebook within the group of companies and in which the EU standard contractual clauses are included. You can view the main content of the agreement at https://www.facebook.com/legal/terms/dataprocessing1 and https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en. Further information is available at https://www.facebook.com/legal/terms/customaudience

Microsoft Customer Match: Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA. To the extent that your personal data is transferred to the USA, this is done on the basis of an agreement that IU has concluded with Microsoft for this purpose and which incorporates the EU standard contractual clauses. You can view the main content of the agreement at https://www.microsoft.com/licensing/docs/view/Microsoft-Products-and-Services-Data-Protection-Addendum-DPA?year=20211 and https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en. Further information is available at https://privacy.microsoft.com/de-de/privacystatement 

15 Social Media

​Clicking on a link, such as to Facebook, Instagram, Twitter, YouTube, TikTok or LinkedIn, will take you to the respective websites of the different providers. Data processing on the respective website is governed by the privacy policy that applies there. IU has no influence on the data processing that takes place there.

16 Cloudinary

​​On our Website we use a so-called Content Delivery Network („CDN“) of Cloudinary Ltd., 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA („Cloudinary“). A CDN is an online service that is used in particular to load large media files (such as graphics, page content or scripts) through a network of regionally distributed servers connected via the Internet and display them on our Website. The use of the CDN helps us to optimize the loading speeds of our Website.

The processing takes place in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in a secure and efficiently functioning website as well as the improvement of the stability and functionality of our Website.

We have concluded a data processing agreement with Cloudinary (Data Processing Addendum, available at https://cloudinary.com/gdpr/dpa, which incorporates the EU standard contractual clauses.

Further information can be found in Cloudinary’s privacy notice at https://cloudinary.com/privacy. 

17 Survey questions on the website

​When visiting our Website, we may ask you via a window that opens whether you already knew us before visiting our Website. For this purpose, we collect the data specified in the Server Log Files. If you answer the question, we also process your answer. This information is evaluated in aggregated form on the basis of our legitimate interest in being able to track the effectiveness of our marketing measures in accordance with Art. 6(1)(f) GDPR.

We retain information in this context for the duration specified by IU in order to perform the task and delete the data thereafter.

Except for the transfers of usage data to the USA described in connection with Google Analytics, IU will not transfer your personal data to a third country outside the EU. Any other transfer will only take place if IU is required to do so by law or by public authorities or if the transfer is necessary in the context of your use of the Website. 

18 Rights of data subject

You can contact IU in writing or per email at datenschutz@iu.org in order to exercise the following rights:

• Access your data in order to check and verify this data;
• Obtain a copy of your personal data;
• Rectification, erasure or restriction of processing, which also includes the right to complete incomplete or incorrect data by providing a supplementary statement;
• Right to object to the processing; please note that pursuant to Art. 21 GDPR you have the right to object to the processing of personal data processed by us on the basis of legitimate interests pursuant to Art. 6 (1) (f) DSGVO; you have a right to object to processing insofar as this is done on grounds relating to your particular situation; insofar as the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right to object without the requirement to specify a particular situation,
• You can receive your provided personal data in a structured, commonly used and machine-readable format and transmit this data to another controller, provided that you have given your consent to the processing or the processing is based on a contract;
• If you have given us your consent to process your personal data, you can withdraw this consent at any time with effect for the future.

You also have the right to lodge a complaint with a supervisory authority with regard to the processing of your personal data. To exercise this right, you can contact the authority responsible for your place of residence or for the location of the IU in Thuringia: Der Thüringer Landesbeauftragte für den Datenschutz, Häßlerstraße 8, 99096 Erfurt, or in case of complaint concerning the data processing through IU Medical School, you may contact: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz.

19 Automated decision-making and profiling

​Except for the services described in the context of Google Analytics and Google Signals, your personal data will not be used by IU for automated decision-making.

When visiting our Website, we place cookies from various providers, provided you have given your consent in this regard. By means of the cookies that you have allowed in each case, data is generated as described in the Server Log Files. This data is consolidated and combined by IU with the help of a Google solution. For this purpose, IU has concluded a data processing agreement with Google, with its registered office at Gordon House, Barrow Street, Dublin 4, Ireland, which incorporates the EU standard contractual clauses. If we receive information about you through our Website, for example, because you ask us to send you informational materials or contact us, then we store your data and combine it with the data generated by cookies. In addition, we receive reports from Google Analytics with data that we also combine with your data. For further information, please refer to the section on Google Analytics.

With the help of your consent regarding the data generated via our website, we store it in a CRM solution. We analyze the data to determine whether you are only interested in a course of study offered by us or whether you have also applied, and we add the relevant information to your data record. We store this profile created about you in a salesforce solution provided by Salesforce, with its registered office at Floor 26 Salesforce Tower, 110 Bishopsgate EC2N 4AY London, England.

The legal basis for this data processing is your consent in accordance with Art. 6(1)(a) GDPR, which you can withdraw at any time with effect for the future by contacting datenschutz@iu.org.