Data Protection

General information on the processing of personal data relating to your studies at IU

In the context of your studies at IU, IU is required to process data concerning your person. The purpose of this document is to inform you about our processing of your personal data when you enrol with and study at IU. If you are entering into a student employment contract with IU, you will receive separate information concerning the data processing involved. You can find details concerning the processing of personal data in connection with the use of our website in the privacy policy for the site, which is available online. Data processing using online tools will be explained to you for the tools in question.

Data Controller and Data Protection Officer

IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt, Germany, („IU“), is responsible for the processing of your personal data. We have appointed Dr. Annette Demmel, SPB DPO Services GmbH, Unter den Linden 21, 10117 Berlin, as our Data Protection Officer.

Purpose of the processing

Your personal data will be processed for the following purposes:

  • Student administration, including matriculation; the execution of your course of study; the issue of ID cards and similar documents; the setting and collection of tuition fees; if necessary, attendance and absenteeism monitoring; the organisation of teaching (online events); registration for and participation in teaching events; the provision and distribution of teaching materials; the acceptance and distribution of academic services, including plagiarism checks; the conduct of examinations and issue of examination certificates or references; and other general administration and human resources processes which are necessary for the proper administration of teaching activities;
  • Student support
  • Statutory record-keeping, including accounting;
  • Internal and external audits;
  • The booking and execution of, and payment for other services;
  • The maintenance of compliance with legal notification and reporting requirements;
  • The provision of operational IT infrastructure, including hardware and software, telecommunications and electronic communications, including the Internet, mobile applications; remote access; online meetings; any technical facilities for teaching and learning and the sitting of examinations using software; licencing and licence control; the allocation of user rights; debugging and troubleshooting; the operation of a firewall and similar safety installations; URL and malware filtering and malware reporting; the tracking of media files copied onto removable media; a ticket system for requests and the help desk; the use of IT security software and monitoring of lawfulness of use to the extent permitted;
  • Internal audits to comply with statutory, regulatory and other corporate governance obligations and internal policies and to uncover any suspected crimes or misdemeanours, including the investigation of compliance violations.

Legal basis for the processing

Your personal data will be processed on the basis Art. 6 (1) (b) of the General Data Protection Regulation (‘GDPR’) for the execution of the study contract with you. Where we are obliged to comply with a statutory obligation to process your personal data, this will take place on the basis of Art. 6 (1) (c) GDPR, or, in cases where we transfer your personal data to another group company or other recipients in pursuance of our legitimate interests or those of a third party, we will undertake this on the basis of, and in accordance with, Art. 6 (1) (f) GDPR so that we can use shared operational infrastructure, for example, IT systems or online tools for teaching activities and examinations, including plagiarism checks. In exceptional cases where the processing of your personal data is not required to execute the study contract with you, but where we would nonetheless like to propose data processing of this kind, we will ask you separately for your consent pursuant to Art. 6 (1) (a). You will then be offered further information in this connection.


Access to our personal data will be limited exclusively to those employees and teaching staff of IU entrusted with the tasks described in the section entitled ‘Purpose of the processing’. Our group companies may additionally offer us IT services. We will gladly send you an overview of the group companies. Employees of these companies may have access to your personal data to the extent necessary for the fulfilment of the task. We also call on the assistance of external service providers for the operation of our IT infrastructure, including electronic communications and the operation of our website and access control.

In the context of the courses offered via the Internet including plagiarism checks, for example, online tutorials, we use various functions offered by external providers (hereinafter referred to as ‘Online Tools’) who will be given your name and information about your courses and their contents, including recordings of your voice and video recordings of your person. In these cases, your personal data will if necessary be transferred to countries outside the European Union, particularly the United States of America. We conclude standard EU contracts for data processing in third countries to ensure that these transfers are secure. If you would like to see such a contract, contact us at , and we will gladly provide you with a copy. You will find detailed information concerning the online tools used to process data here:

If you decide to work with us in the context of applying for a study place at a university or for the execution of your studies via WhatsApp, we process your personal data in this respect. Legal basis of this data processing by the IU is your benefit of our WhatsApp channels in accordance with Art. 6 para. 1 sentence 1 lit. b) DSGVO. Data processing by WhatsApp is governed by the Privacy Policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for users within European Union, respectively WhatsApp Inc. for all other Users. You can find the Privacy Policy at

If you decide to communicate with us via live chat or chat bot for the purpose of execute your studies, we will process your IP address, the date and time of any messages, as well as your name and topics and information that you make accessible via live chat or chat bot. Data processing practices via Live Chat or Chat Bot are governed by LogMeIn Ireland Ltd, Bloodstone Building, 1st Floor Bloodstoney Road Sir John Rogerson's Quay Dublin 2. The privacy policy is available at

Data categories

We process the following data categories:

Master and contact data

  • Name
  • Date of birth
  • Sex
  • Nationality
  • Identity card or passport number and country or authority of issue
  • Photographs
  • Private address
  • Private contact information

If you use our WhatsApp channel, we process information from your status messages and the date and time of delivered messages. If you use the live chat or chat bot, we also process information that you provide via the live chat or chat bot.

Information on the study contract

Details relating to enrollment, the execution and completion of the study course:

  • Course of studies
  • Details from application procedures, for example, curriculum vitae
  • Entry and exit date
  • Vocational training and career
  • Qualifications and certificates or degrees
  • Competencies
  • Course participation
  • Attendance and absenteeism records
  • Academic performance
  • Performance assessment
  • Examination record
  • Examination assessment
  • Bank account or other payment data
  • Access control and security monitoring data

Insurance data

  • Information on care, health, labour and social insurance
  • Information on any further mandatory or voluntary insurance policies

Information relating to the IT infrastructure

  • Usage data from the operational IT infrastructure, including electronic means of communication, for example, Internet, phone and intranet
  • Login information, such as date or time, websites used, data transmitted and received, courses booked and attended
  • Recordings of your voice and video recordings of your person in the context of the implementation of courses or sitting of examinations over the Internet

How long will your personal data be stored?

Your personal data will be stored for the duration prescribed by law or determined by us in respect of fulfilment of the task. To find out more about the duration of storage for individual data categories, please email us at

Your rights

You can contact IU either in writing or by email at in order to exercise the following rights:

  • To check or review information concerning your data,
  • To receive a copy of your personal data,
  • For the rectification or erasure of data or restriction of processing, including the right to complete incomplete or incorrect data by providing supplementary information,
  • The right to withdraw consent to processing,
  • You can receive the data you have provided in a structured, conventional and machine-readable format and transfer this data to another controller where you have given your consent to processing, or where this processing is based on a contract.

You also have the right to complain to a supervisory authority in respect of the processing of your personal data.

Why is your personal data collected?

QS Rating