Privacy Policy

1. Who we are

IUS Community ("IUS Community", "we", "us") is a non-commercial, student-run online platform for students of the International University of Sarajevo ("IUS"), available at iuscommunity.com (the "Platform"). IUS Community is an independent student initiative and is not an official service of IUS unless IUS states otherwise in writing.

For the personal data described in this policy, the administrators of IUS Community act as the controller within the meaning of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Law on Personal Data Protection of Bosnia and Herzegovina ("BiH Law"). You can reach us at iuscommunity.info@gmail.com.

2. Scope of this policy

This policy applies to all personal data processed when you visit the Platform, create an account, or use its features (courses and notes, professor and course reviews, the student forum, the marketplace, direct messages and notifications). It does not apply to third-party websites that users link to, such as Google Drive folders shared as lecture notes; those sites have their own privacy policies.

3. Personal data we collect

We collect only what the Platform needs to work. Depending on how you use it, this includes:

We do not intentionally collect special categories of data (such as health, religion or political opinions). Please do not include such data, or personal data about other people, in reviews, posts or messages.

4. Why we use your data and our legal bases

• Providing the Platform and your account (registration, login, posting, messaging, marketplace): necessary to perform the agreement with you, GDPR Art. 6(1)(b).
• Verifying student status through an @student.ius.edu.ba or @ius.edu.ba address: necessary for the agreement and our legitimate interest in keeping student areas for students, Art. 6(1)(b) and (f).
• Security, abuse prevention and moderation (login limits, bans, reports, removing unlawful content): our legitimate interest in a safe and lawful platform, Art. 6(1)(f).
• Service emails (verification codes, password resets, reminders about unread marketplace messages, notifications): necessary for the agreement and our legitimate interest, Art. 6(1)(b) and (f).
• Optional data you choose to provide, such as a phone number, and sharing your contact details with another user in a conversation: your consent, Art. 6(1)(a), which you can withdraw at any time by removing the data from your profile.
• Legal obligations, such as responding to lawful requests from competent authorities: Art. 6(1)(c).

We do not sell personal data, we do not use it for advertising, and we do not make decisions about you based solely on automated processing.

5. Who can see your data

• Other users can see your username, role, points, badge and the content you publish. Professor and course pages are visible only to logged-in students.
• Your email address and phone number are not shown to other users. A phone number is shown to another user only if you accept that user's contact request in a conversation.
• Direct messages are visible only to the participants, and to administrators when a message is reported to them.
• Administrators can access account and content data where needed to operate, secure and moderate the Platform and to handle reports and requests.

6. Service providers and international transfers

We use the following providers (processors) to run the Platform. They process data only on our instructions and under their data processing terms.

Where data is transferred outside Bosnia and Herzegovina or the European Economic Area, we rely on adequacy decisions (including the EU-U.S. Data Privacy Framework for certified providers) or the European Commission's Standard Contractual Clauses offered by the provider.

Marketplace photos are stored by ImgBB at a public web address. Anyone who has that address can view the photo, even after the listing is removed from the Platform. Do not upload photos that show people, documents or other personal information.

7. How long we keep data

• Account data and content: for as long as your account exists.
• When you delete your account (Profile page) or an administrator deletes it, your account and the content linked to it (reviews, posts, replies, notes, listings, messages, notifications) are deleted from our database.
• Verification codes expire after 15 minutes and password-reset codes after 1 hour; expired codes and registrations that were never verified are removed automatically.
• Moderation records (such as ban reasons and reports) are kept while the account exists and as long as needed to handle the matter.
• Hosting request logs are kept by our hosting provider for a limited period under its own retention rules.
• Backups kept by our database provider may retain deleted data for a short period until they are overwritten.

8. Security

We apply technical and organisational measures appropriate to a small, non-commercial student platform, including encrypted connections (HTTPS), access restricted to administrators, server-side permission checks, separation of public and private data, limits on login attempts and request volumes, and moderation tools.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. You play an important part in protecting your account:

• Use a password you do not use on any other website or service.
• Keep your password confidential and log out on shared devices.
• Tell us immediately at iuscommunity.info@gmail.com if you believe your account has been accessed without your permission.

9. Personal data breaches

If we become aware of a personal data breach, we will:

1. take prompt steps to contain the breach and limit its effects;
2. assess the risk to the people affected;
3. notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, where the breach is likely to result in a risk to your rights and freedoms (GDPR Art. 33 and the corresponding provisions of the BiH Law);
4. inform affected users without undue delay where the breach is likely to result in a high risk to them, including what happened, the likely consequences and the steps they should take (GDPR Art. 34);
5. document the breach, its effects and the remedial action taken.

Our responsibility for a breach is determined by applicable law. The limitations set out in Section 15 of the Terms of Serviceapply to the extent permitted by that law.

10. Your rights

Subject to the conditions set out in the GDPR and the BiH Law, you have the right to:

• access the personal data we hold about you and receive a copy;
• rectify inaccurate data (you can edit your name and contact details on your Profile page);
• erase your data (you can delete your account on your Profile page);
• restrict or object to processing based on our legitimate interests;
• data portability for data you provided to us;
• withdraw consent at any time, without affecting processing that took place before withdrawal.

To exercise these rights, email iuscommunity.info@gmail.com from the address linked to your account. We will reply within one month, which may be extended where the law allows. We may need to verify your identity before acting on a request.

11. Cookies and local storage

We use only what is strictly necessary for the Platform to work:

• authentication cookies that keep you logged in and protect forms against cross-site request forgery;
• a local-storage entry that remembers if you hid the marketplace disclaimer.

We do not use analytics, advertising or tracking cookies.

12. Age

The Platform is intended for university students. You must be at least 16 years old to create an account.

13. Changes to this policy

We may update this policy to reflect changes to the Platform or the law. We will show the new effective date above and, for material changes, notify you on the Platform or by email and ask you to review the updated policy.

14. Contact and complaints

Questions about this policy or your data: iuscommunity.info@gmail.com.

You also have the right to lodge a complaint with a supervisory authority, in particular the Personal Data Protection Agency in Bosnia and Herzegovina (Agencija za zaštitu ličnih/osobnih podataka u BiH) or the data protection authority of the EU member state where you live or work. We would appreciate the chance to address your concern first.