Privacy Policy for Students at the IBA International Business Academy

When You Apply to the IBA

When you apply to the IBA, we process the following personal information about you: [name, contact details, date of birth, education, course participation, evaluations, etc.] In addition, we process your CPR number for identification purposes.

We do not process any sensitive personal information about you.

We do not access criminal records, and consequently do not generally process information regarding criminal offences.

Purpose and Legal Basis

Our purpose for processing your personal data is to manage your application and determine whether or not you may be admitted to the IBA.

Moreover, your data will be used anonymously for statistical purposes, such as compiling tables of our students’ educational background, age, grade point average, completion rates, etc.

The processing of your personal data is carried out when necessary, and for the following purposes:

• In order to fulfill a contract to which you are a party (i.e. regarding your admission to the IBA), as set out in article 6(1)(b) of the GDPR.
• In order to fulfill a legal obligation (such as the reporting of certain information to the SU Board), as set out in article 6(1)(c) of the GDPR.
• In order to pursue a legitimate interest, or more specifically in cases where the interest of the IBA is considered to be of great importance, such as in providing relevant educational offers, the administration of courses, etc., as set out in article 6(1)(f) of the GDPR.

In certain cases, we may also obtain your consent to the processing of your personal data in accordance with article 6(1)(a) of the GDPR.

The processing your CPR number is due to legal requirements, more specifically § 11(2)(1) of the Data Protection Act.

We may disclose your CPR number in situations where it is considered to be a natural part of IBA proceedings, or when otherwise necessary in order to ensure that you can be uniquely identified. Disclosure may also be made to public authorities, if they so request.

Information Regarding Criminal Offences

We will only process information about (potential) criminal offences in cases where we suspect a criminal offence committed in a study-related context. In such cases, the processing will be based on our legitimate interest in protecting IBA and preventing criminal offences from taking place.

When You Are a Student at the IBA

When you are a student at the IBA, we process the following personal information about you: [name, contact details, date of birth, education, course participation, evaluations, your photo, personality tests, grades, etc.]

As part of the student administration, certain categories of sensitive personal data may also be processed in some cases, relating primarily to health, such as medical certificates, long-term illness, and sick leave.

We also process your CPR number for identification purposes.

We do not access criminal records prior to your admittance, and consequently do not generally process information regarding criminal offences.

Purpose and Legal Basis

The purpose of processing your personal data is to manage your course of study.

The processing of your personal data is carried out when necessary, and for the following purposes:

• In order to fulfill a contract to which you are a party (i.e. regarding your admission to the IBA), as set out in article 6(1)(b) of the GDPR.
• In order to fulfill a legal obligation (such as the reporting of certain information to the SU Board), as set out in article 6(1)(c) of the GDPR.
• In order to pursue a legitimate interest, or more specifically in cases where the interest of the IBA is considered to be of great importance, such as in the administration of your course of study, class evaluation, etc., as set out in article 6(1)(f) of the GDPR.

In certain cases, we may also obtain your consent to the processing of your personal data in accordance with article 6(1)(a) of the GDPR.

The processing of your sensitive personal data will only take place in the following cases:

• In any case where you have given your explicit consent, in accordance with article 9(2)(a) of the GDPR.
• In any case where the processing is deemed necessary for compliance with obligations relating to employment, health or social law, as well as specific rights, in accordance with article 9(2)(b) of the GDPR.
• In any case where the processing is deemed necessary for the establishment, exercise or defense against legal claims, in accordance with article 9(2)(f) of the GDPR.

The processing your CPR number is due to legal requirements, more specifically § 11(2)(1) of the Data Protection Act.

We may disclose your CPR number in situations where it is considered to be a natural part of the IBA proceedings, or when otherwise necessary in order to ensure that you can be uniquely identified. Disclosure may also be made to public authorities, if they so request.

Information Regarding Criminal Offences

We will only process information about (potential) criminal offences in cases where we suspect a criminal offence committed in a study-related context. In such cases, the processing will be based on our legitimate interest in protecting IBA and preventing criminal offences from taking place.

Photos

The photo that was uploaded or taken of you during your enrolment at the IBA will be stored in the student administration systems and used internally for your student card and the class overview.

Situational photos from class or other student environments may be used for marketing purposes, e.g. in brochures or on the website. This is owing to our legitimate interest in promoting our educational activities, as set out in article 6(1)(f) of the GDPR.

Photos may also be taken at graduation. These photos may be published in print and digital media on the basis of the same legitimate interest as mentioned above. You are not required to have your photo taken.

If we require a photo of you, you will be contacted in order to obtain your consent.

Personality Tests for Educational Purposes

In cases where personality tests are considered a natural part of a course, they are carried out on the basis of our legitimate interest in ensuring the best possible educational courses, as set out in article 6(1)(f) of the GDPR. The results will usually be discussed in class.  However, any student may contact their instructor in order to request an exemption from personality tests. This request will be granted, given that the request is made at the beginning of the course.

The instructor will delete all test results immediately upon completing the course.

Projects and Assignments

The projects and assignments you hand in during your studies will be stored in Wiseflow, our digital exam system.

Projects and exam papers are permanently stored in the Urkund system, which is designed to check for plagiarism. If the submitted project is confidential (e.g. made in collaboration with a company), it may be removed from Urkund after having been checked for plagiarism.

When uploading your project to Wiseflow, you must decide whether or not to permit its publication. This is voluntary.

Journal Record Regarding Your Study – “The Student Record”

The IBA creates a record for you in our system of records. The purpose of this record is to preserve and document affairs regarding your studies. This may include documents pertaining to SU, absences, complaints and warnings. Any correspondence with you on these subjects is also stored within the system.

Processing of Personal Data After Completion of Studies

In as much as the IBA is obliged to continuously adapt our courses to the labor market, you may receive an email or phone call after having completed your studies. In such cases, you will be asked to participate in questionnaires and interviews regarding your current employment situation and relevant educational offers.

Disclosure of Your Personal Data

In certain cases, your personal data may be disclosed to third parties. For example, your UNI-Login is disclosed to praktikportalen.dk, in order for you to be set up as a user. Moreover, any information regarding sick leave is disclosed to your local municipality (given that you are part of a support scheme). And lastly, relevant information is provided to the SU Board for their use in allocating SU.

Furthermore, we have engaged certain data processors to perform a number of tasks on our behalf. These data processors will have access to your personal data. However, they may only lawfully access and process your personal data on our behalf in order to accomplish such specific tasks as determined by IBM. Data processors may be, for example, providers of personality tests, digital exam systems and other IT solutions.

Transfer of Your Personal Data to Countries Outside EEA

In the event that your personal data should be transferred to a country outside the EU/EEA, we will provide adequate data protection by entering into standard EU contracts with the recipient, or by targeting recipients that are subject to particular certification mechanisms, or are otherwise based in so-called “safe” countries, approved by the European Commission.

Duration of Storage

We will store your personal data for as long as is necessary to fulfil the purposes described above, including the full duration of your time as a student at IBA. Nevertheless, your personal data will be updated regularly, and we recommend that you inform us if you change your address, obtain a new phone number, etc. Data which are no longer necessary to fulfill the purposes described above are deleted on a continuous basis.

Unsuccessful applications are kept for [insert number of years], starting from the date of application.

Successful applications are kept for as long as the person is a student at the IBA, and for [insert number of years] after the completion of their studies.

Personal data of previous students are kept for [insert number of years], starting from the date on which the student either graduated or left the IBA.

Grades are kept in the student administration system for 30 years after the completion of studies, in accordance with [insert relevant law].

In cases where an appeal is pending, the time of erasure will be extended until the appeal has been concluded.

Your Rights

As the data subject, you have a number of rights which may be exercised at any time by contacting our DPO. You can send an email to DPO@herningsholm.dk, or call +45 25 42 48 24 or +45 25 42 48 18.

You have the right to know about all your personal data that we collect and process, as well as the right to receive a copy of it. Moreover, you have the right to object to the way we process your personal data; to request the revision or erasure of data that you believe to be inaccurate or outdated, etc.; and to request more restricted processing of your personal data. Some of the aforementioned rights require the fulfillment of certain conditions in the data protection legislation.

As the data subject, you also have the right to data portability, provided the fulfillment of certain conditions in the data protection legislation. The right to data portability means that you have the right to receive, in an organized, accessible and machine-readable format, the personal data concerning yourself that has been submitted to us, where the processing is carried out automatically, and the legal basis for the processing is by consent or by contract. Moreover, if technically possible, you have the right to have your personal data transferred to another controller.

You have the right at any time to object to the processing of your personal data for direct marketing purposes.

As you have given your consent to the processing of your personal data, you nevertheless have the right to withdraw your consent at any time. The withdrawal of your consent does not, however, affect the lawfulness of the processing prior to the withdrawal. Upon withdrawal, the processing of your personal data will cease and your personal data will be deleted, unless there is a legitimate basis for continued storage, e.g. for purposes of documentation.

Questions and Complaints

If you have any questions regarding this Privacy Policy, wish to exercise any of the rights mentioned above, or disagree with the way we process your personal data, please contact our DPO at

DPO@herningsholm.dk, or by calling +45 25 42 48 24 or +45 25 42 48 18.

You may also appeal to the Danish Data Protection Agency, which is the Danish authority responsible for supervising the processing of personal data. Contact details are available on their website, at www.datatilsynet.dk.

Changes to the Privacy Policy

This Privacy Policy will be updated and amended at regular intervals, or when necessary due to changes in data protection legislation and practice. Consequently, we recommend that you keep yourself informed.

Last edited:

September 27, 2022