General information on the processing of personal data in connection with your studies at the IU

As part of your study or continuing education program at IU, it is necessary for IU to process personal data about you. This document informs you about the processing of your personal data on the occasion of the admission and implementation of your studies or continuing education with IU. If you enter into a student employment relationship with IU, you will receive separate information about your data processing in this respect. For details on data processing when using our website, please refer to the website privacy statement available on the website. Data processing through online tools will be explained to you in the corresponding tools.

Responsible person and data protection officer

IU Internationale Hochschule GmbH, Juri-Gagarin-Ring 152, 99084 Erfurt, ("IU"), is responsible for the processing of your personal data. IU has appointed Dr. Annette Demmel, SPB DPO Services GmbH, An der Buche 4, 13465 Berlin, annette.demmel@spb-dpo-services.com as data protection officer. You can contact the IU either in writing or by e-mail at datenschutz@iu.org.

Purpose of processing

Your personal data will be processed for the following purposes:

• Participant or student administration, including enrollment if necessary, implementation of continuing education or studies, issuance of ID cards and similar documents, setting and collection of tuition or continuing education fees, checking attendance and absences if necessary, organization of teaching operations (online and virtual events), registration and participation in courses, provision and distribution of learning material, receipt and distribution of continuing education or study achievements including plagiarism checks, conducting examinations and issuing examination certificates, testimonials or certificates, other general administrative and personnel processes necessary for the proper administration of the course. including plagiarism checks, conducting examinations and issuing examination certificates, testimonials or certificates, other general administrative and personnel processes that are necessary for the proper handling of teaching operations.;
• Provide continuing education or study support, including interview services;
• maintenance of records required by law, including accounting;
• internal and external auditing;
• Booking, execution and accounting of any services;
• Fulfillment of statutory notification and reporting obligations;
• Providing operational IT infrastructure including hardware and software, telecommunications and electronic communications, including the Internet, mobile applications, remote maintenance access, online meetings, other technical facilities for teaching and learning and taking exams using software, licensing and license control, assignment of user rights, debugging and troubleshooting, operation of a firewall and similar security devices, URL and malware filtering and malware reporting, tracking of files copied to removable media, ticket system for inquiries and help desk, use of IT security software and monitoring of lawful use to the extent permitted;
• Internal audits to ensure compliance with legal, regulatory, and other corporate governance obligations and internal policies, and in the event of suspected criminal or regulatory violations, to uncover these, including investigation.

Legal basis for processing

Your personal data will be processed on the basis of Art. 6 (1) b) of the General Data Protection Regulation ("DS-GVO") for the performance of the contract with you. Where we are required to process your personal data to fulfill a legal obligation, we will do so based on Art. 6 (1) c) DS-GVO, or in cases where we transfer your personal data to another group company or to other recipients for the purposes of legitimate interests pursued by us or a third party, we will do so on the basis of and in accordance with Art. 6 (1) f) DS-GVO in order to use common operational infrastructure, e.g. IT systems, or online tools for teaching and examinations, including plagiarism control. In exceptional cases, where the processing of your personal data is not necessary to carry out the continuing education or study relationship with you, but we would like to propose such processing to you, we will separately ask you for your consent according to Art. 6 para. 1 a). You will then receive more detailed information in this context.

If you decide to communicate with us via WhatsApp for the purpose of conducting your studies or continuing education, we will process your personal data to this extent. The legal basis for this data processing by IU is your use of our WhatsApp channels based on Art. 6 (1) p. 1 lit. b) DSGVO. Data processing by WhatsApp is governed by the privacy policy of WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, for users within the European Union, or WhatsApp Inc. for all other users. The Privacy Policy is available at https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy.

If you decide to communicate with us via live chat or chat bot for the purpose of further education or studies, we will process your name, email address, date and time of delivered messages as well as topics and information that you make available via live chat or chat bot. The legal basis for this data processing by IU is your use of our chats according to Art. 6 para. 1 p. 1 lit. b) DSGVO. Data processing by the live chat and chat bot is governed by the privacy policy of Genesys Telecommunications Laboratories B.V. with registered seat in Gooimeer 6 - 02, 1411 DD Naarden, Netherlands. The privacy policy is available at https://help.mypurecloud.com/articles/genesys-cloud-privacy-policy/.

Receiver

Only employees and teaching staff of IU who are entrusted with activities described in the section 'Purpose of processing' have access to your personal data. In addition, our group companies may provide IT services for us. We will be happy to send you an overview of the group companies. Employees of these companies may have access to your personal data to the extent necessary to perform their tasks. Furthermore, we use the help of various external service providers to operate our IT infrastructure, including electronic communication, the operation of our websites, and administration.

As part of the further education or study offer via the Internet, including plagiarism control, e.g. online tutorials, we use various functions of external providers (hereinafter referred to as "online tools"), which receive your name, details of your courses and their content, including recordings of your voice and video recordings of your person. In this process, your personal data is transferred to countries outside the European Union, in particular to the United States of America. We contractually secure the transfer by concluding the EU standard contracts for data processing in third countries. We will be happy to provide you with a copy if you contact us at datenschutz@iu.org. Detailed information on data processing by the online tools can be found next to the start button of the respective online tool.

If you use the WhatsApp channel of the IU to communicate with us, in addition to employees of WhatsApp and the IU, employees of our contractual partner MessengerPeople GmbH, which manages the WhatsApp channel, will also have access to your personal data. In this context, it is certainly not excluded that your personal data is stored on WhatsApp servers in the USA. More information on this can be found in WhatsApp's privacy policy https://www.whatsapp.com/legal/?lg=de&lc=DE&eea=1#privacy-policy

Data categories

We process the following categories of data:

Master and contact data

• Name
• Date of birth
• Sex and Gender
• Nationality
• ID card number or passport number and issuing country or authority
• Photographs
• Private address
• Private contact details
• If you use our WhatsApp channel, details from your status messages as well as date and time of delivered messages
• If you use the live chat or chat bot, we also process information that you make available via the live chat or chat bot

Information on the contractual relationship (only for study programs)

• Details in connection with the commencement, implementation and completion of further education or studies
• Continuing education program or course of study
• Details from application procedures, e.g. resume
• Entry and exit date
• Professional training and career
• Qualifications and certificates or degrees
• Competencies
• Course participation
• Continuing education or study credits earned
• Performance Evaluation
• Audit services rendered
• Audit assessment
• Account details or other payment data

Insurance data

• Information on care, health, labor and social insurances
• Details of other compulsory or optional insurances

Information in connection with the IT infrastructure

• Usage data of operational IT infrastructure including electronic means of communication, e.g. Internet, telephone and intranet
• Login information such as date or time, pages used, data transmitted and received, courses booked and attended.
• Recordings of your voice and video recordings of you in the course of conducting courses or taking exams over the Internet

How long will your personal data be stored?

Your personal data will be stored for the period required by law or for the period we determine in order to perform our duties. Details on the storage period of individual data categories can be found on request at datenschutz@iu.org.

Your rights

You may contact us either in writing or by email datenschutz@iu.org to exercise the following rights:

• Information on your data in order to control and verify it,
• Obtain a copy of your personal information,
• Rectification, erasure or restriction of processing, this also includes the right to complete incomplete or incorrect data by supplementary communication,
• Right to object to processing,
• You can receive your provided data in a structured, common and machine-readable format and transfer this data to another controller, provided that you have given your consent to the processing or the processing is based on a contract.

You also have the right to lodge a complaint with a supervisory authority in connection with the processing of your personal data. To exercise this right of complaint, you can contact the supervisory authority responsible for your place of residence or the supervisory authority responsible for the IU: The Thuringian State Commissioner for Data Protection and Freedom of Information, Häßlerstraße 8, 99096 Erfurt.

Why is your personal data collected?

We need your personal data to carry out the contractual relationship with you. You have the option to refrain from providing your personal data or to provide us with incomplete information. However, this may mean that we are unable to carry out the contractual relationship with you. Please note that as an internationally active company, we have to enable our students or participants to take part in courses partly, sometimes exclusively, via the Internet using online tools. For this purpose, we use the services of various software providers, particularly in the United States of America or in other countries

outside the European Union. You will find more detailed information on the processing of personal data by online tools next to the start button of the online tool in each case.

Automated decision making and profiling

Your personal data will not be used for automated decision making.