Privacy Policyof the International University of Sarajevo

II.1. Purposes of Processing

Depending on the category of data subjects, the University processes personal data in particular for the following purposes:

• Conducting the teaching process and providing educational services, including the application and enrollment of candidates, organization and delivery of classes (including online classes), attendance records, assessment of knowledge, organization of examinations, issuance of diplomas, certificates, and other public documents, and maintaining alumni records.
• Fulfilling legal obligations, including maintaining prescribed records concerning students, employees, research projects, financial operations, and other records that the University is required to maintain.
• Administrative and organizational operations of the University, including human resources management, financial operations, planning of teaching activities, quality assurance, accreditation procedures, and internal management.
• Communication with students, employees, and other interested parties, including delivering notifications, decisions, competition results, information on scholarships and extracurricular activities, and responding to inquiries.
• International cooperation and mobility programs, including the implementation of Erasmus+, double diploma programs, student and academic mobility, and the exchange of data with partner institutions in accordance with the law and concluded agreements.
• Participation in international and domestic projects, grants, and funding programs, including the exchange of data with donors, partner universities, and competent institutions to the extent necessary for project implementation.
• Scientific and research activities, whereby personal data of research participants shall be processed exclusively for scientific and research purposes, in accordance with the Law on the Protection of Personal Data and applicable ethical standards.
• Promotion of the University and informing the public, including the publication of information concerning the academic, scientific, and other achievements of the University and its students, as well as photographs and audiovisual recordings from public events, where there is an appropriate legal basis for such processing, including the consent of the data subject where such consent is required by law.

II.2. Categories of Personal Data

Depending on whether the individual is an employee, student, contractual party as a natural person, business associate as a natural person, or otherwise, the University collects, processes, uses, and analyzes the following categories of personal data:

• Identification data: first and last name, address, national identification number (JMBG), date and place of birth, sex, citizenship, identity card/passport number, etc. These data are necessary for recording students and employees, issuing public documents, and fulfilling legal obligations.
• Contact information: telephone/mobile phone number, residential address, and email address. The University collects the aforementioned data for the purpose of communication with students, employees, candidates applying for employment or student admission calls, or for other purposes.
• Student status and academic performance data: student identification number, study program and cycle, year of study, examinations passed and grades obtained, ECTS credits earned, enrollment data for semesters/academic years, research project results, final/graduate theses, etc. This information is processed for the purpose of providing education and monitoring students’ academic progress, issuing certificates of student status and diplomas, organizing classes, and conducting evaluations.
• Other personal data provided by the data subject upon establishing and/or during the employment, upon enrollment in a study program and/or during studies, or when establishing other types of contractual/business relationships, such as data contained in an identity card, CV, bank account details, professional qualifications, other knowledge and skills, previous employment information, and previously completed education. For employees, these data are necessary for human resources management at the University and for fulfilling the employer’s legal obligations.
• Electronic data and user accounts: usernames for access to the Student Information System, E-Campus information system and online learning platforms, passwords, and data concerning activities on such systems. These data are collected for the purpose of enabling and monitoring participation in distance learning and the use of the University's digital services.
• Special categories of personal data: racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, as well as the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or a person’s sex life or sexual orientation, data concerning health fitness, information from criminal records, which the University may collect on the basis of applicable legal provisions or the consent of the data subject, etc.
• Data collected through video surveillance systems, which are processed for the purpose of protecting persons, property, and University premises, and ensuring the safe conduct of the teaching and work processes.
• Photographs and audio/video recordings in which students, teaching staff, or visitors appear. Such data are collected on an appropriate legal basis and with due respect for the right to privacy.

a) Upon Enrollment in Study Programs

In accordance with the conditions and provisions of the public call for enrollment in study programs, the personal data of prospective students contained in applications and other supporting documents submitted during the enrollment procedure shall be collected for the purpose of acquiring student status, i.e. for the purpose of demonstrating that the criteria for entering into a study agreement have been fulfilled.

In this regard, the University processes personal data through records of candidates applying for enrollment in first study cycle, integrated first and second study cycle, second study cycle, and third study cycle programs, as well as double diploma programs.

b) Data of Students, Employees, External Associates, Users, and Visitors of the University

In accordance with the Law on Higher Education, other laws and bylaws, and the general acts of the University, the University carries out its higher education activities, as well as professional and scientific/artistic research activities, through the processing of the following personal data:

• records of persons employed at the University;
• records of the calculation and payment of salaries to employees of the University;
• records of calculated and paid income from occasional independent activities and other self-employed activities, as well as calculated and paid taxes and contributions;
• records of injuries at work;
• student registry records of students enrolled in undergraduate/first study cycle and integrated first and second study cycle programs, graduate/second study cycle programs, and third study cycle students enrolled in doctoral studies;
• records of diplomas issued for all three cycles of study;
• records of examination results and other study obligations;
• other records prescribed by laws and bylaws, as well as by the general acts of the University.

c) Scientific/Artistic Research

Within the scope of scientific research/artistic research activities, personal data are collected for research purposes in compliance with recognized ethical standards for scientific/artistic research and the application of the University’s Code of Ethics.

d) Library

The use of the University library services is available to students and employees of the University. In this context, the student/employee smart card is scanned, and records are maintained regarding the borrowing, reservation, and return of library materials.

e) Video Surveillance

The University, on the basis of its legitimate interest, uses a video surveillance system for the purposes of optimizing the protection and security of students, employees, and third parties present on the University premises, as well as the security of the facilities and protection of the University’s property. Personal data contained in video surveillance records are processed for these purposes.

f) Website and Automated Processing of Personal Data

The University uses information and communication technologies and digital information resources (hardware, software, access to the internal network, and the Internet) in its operations.

The University website – www.ius.edu.ba – may be used without providing any personal data..

In the course of automated processing of personal data through email, information systems, and other platforms used by the University, data are processed and stored for the purposes of official correspondence and for the purposes for which the respective information system or platform at the University has been established. The University shall not share personal data with any third party or permit third parties to access such data. In the course of automated processing of personal data, the University ensures organizational measures for the protection of personal data, such as maintaining password confidentiality, secure downloading and storage of documents received via email or other sources, compliance with technical instructions when installing, using, and maintaining equipment for the protection of personal data, and other appropriate measures, in accordance with a specific general act.

The University does not offer online services to children under the age of 16. If you are under the age of 16, please do not disclose your personal data to us, including your name, address, telephone number, or email address, without the consent of your parent, adoptive parent, guardian, or legal representative. If we become aware that we have collected or received personal data of a child under the age of 16 without the authorization of the holder of parental responsibility, we shall erase such data without undue delay. If you have information that the personal data of a child under the age of 16 have been provided to us, please contact us by email at: dpo@ius.edu.ba.

If our website contains links to other websites or social media pages, our Privacy Policy does not apply to such websites or pages. We recommend that you read the privacy policies and terms of each website and social media platform you visit, particularly those on which you provide personal data.