July 22, 2026
The protection of your personal data is important to Compellio S.A. ("Compellio", "we", "us"). This Privacy Policy informs you about how personal data is processed when you use the Innovation Manager service ("Service") and about the rights available to you.
The following information applies to registered users and to visitors who access the Service without registering an account. The Service is delivered over the web and is accessible at https://app.innovation-manager.io.
The processing of your personal data is always carried out in accordance with the General Data Protection Regulation ("GDPR") and applicable national data-protection law, including the law of the Grand Duchy of Luxembourg.
The controller within the meaning of the GDPR is:
Compellio S.A.
21 Rue Glesener
L-1631 Luxembourg, Luxembourg
For any question regarding this policy, or to exercise your rights, you can contact us at privacy@innovation-manager.io.
This policy is based on the terminology of the GDPR. For your convenience, the main terms are explained below:
We obtain personal data in the following ways.
You provide personal data when you register (first name, last name and email address), when you complete optional profile information, when you submit a project or work within the Service (including content and files you upload), and when you apply to an open call through a public application form.
Certain data is generated automatically when the Service is accessed, including from visitors who do not register an account: your IP address, the information contained in system logs (which may include the browser and operating-system type and the pages accessed), and the date of your most recent login, which is used to administer and secure your account.
To deliver and secure the Service, components provided by third parties are integrated into the application. When these load, limited technical data — in particular your IP address — is disclosed to the relevant provider. Profile images are displayed through a third-party service using a pseudonymised identifier.
The processing of your personal data may be based on the following legal bases:
We do not profile our users, do not use analytics or advertising technologies, and do not currently collect payment or financial data through the Service.
Where we rely on our legitimate interests, we have carried out and documented a balancing assessment and concluded that our interest is not overridden by your rights and freedoms; a summary is available on request. You may object as described in section 5.
Where you provide personal data relating to other people through the Service, you are responsible for ensuring that you are entitled to do so.
Some of the providers we use, or the corporate groups to which they belong, are established outside the European Economic Area (EEA), including in the United States and the United Kingdom; the place of processing for each named provider is indicated in the sub-processor table in section 4.6. Where personal data is transferred outside the EEA, it is protected by appropriate safeguards, in particular the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses. You can request details of the safeguard applied to a specific transfer using the contact details in section 1.
We retain personal data only for as long as it is needed for the purposes described in this policy.
Account and project data are retained for as long as your account remains active. Because project history is kept so that collaborators retain access, data is not deleted automatically; it is deleted when you request deletion of your account and we have verified your identity. Deletion requests are handled manually, and data cannot be recovered once your account is deleted.
Detailed system logs are kept for up to 15 days and are then aggregated; logs relating to suspicious activity or errors may be kept longer where necessary for security. Records that we are required to keep by law, such as accounting records, are retained for the period required by the applicable law.
We apply appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration and loss. These include access controls on a need-to-know basis, encryption of personal data in transit, and further technical and organisational security measures. Where we engage service providers, we conclude data-processing agreements with them as required by Art. 28 GDPR. We keep our security measures under review.
For each processing activity we set out the data concerned, the purpose, the legal basis and the storage period, together with the providers involved. The specific providers named below are listed, with their place of processing, in the sub-processor table in section 4.6.
Providing your name and email address is necessary to create an account; if you do not provide it, we cannot create your account or provide the Service.
The organisation that publishes a given open call is identified on the application form at the point of submission.
The Service uses Google Maps features and content to provide location suggestions. When you interact with these features, your data is processed by Google in accordance with the Google Privacy Policy (https://policies.google.com/privacy).
We share personal data with service providers acting as our processors, and only as needed to provide, secure and support the Service. The providers below are engaged as processors under data-processing agreements.
In addition, we use processors in the following categories, whose specific identities are available on request: infrastructure and server-management services (United States); email and support services (European Union and the United States); system monitoring (servers in the European Union, with a group entity in the United States); incident alerting (Germany); and issue tracking and bug resolution (European Union data residency, with a group entity outside the EEA).
A complete, up-to-date list of our sub-processors, including those referred to above by category, is available on request at the contact details in section 1.
The Service relies on the third parties to offer location-suggestions, load required scripts and assets, and display profile images. The recipients below act as independent controllers, and are responsible for their own processing under their own privacy policies.
The Service uses only cookies and similar technologies needed to operate and secure the application: session and authentication cookies, used to keep you logged in and to maintain your session, and security cookies, used to protect the Service against automated abuse and to record that a security check has been completed. These cookies are necessary to run and secure the Service, so we rely on our legitimate interests (Art. 6 (1) lit. f) GDPR) to set them; you can object as described in section 5. We do not use advertising, marketing or web-analytics cookies.
If you wish to exercise any of the rights below, please contact us at privacy@innovation-manager.io or support@innovation-manager.io. Requests are free of charge and are answered as soon as possible and in any event within one month, a period that may be extended by two further months for complex or numerous requests. We may need to verify your identity before acting, and requests that require the deletion of data are handled manually.
You have the right to obtain confirmation as to whether personal data concerning you is being processed.
You have the right to obtain information about the personal data we hold about you, and a copy of that data.
You have the right to obtain the rectification of inaccurate personal data concerning you and to have incomplete data completed.
You have the right to obtain the erasure of personal data concerning you where one of the grounds provided for by law applies.
You have the right to obtain the restriction of processing where one of the conditions provided for by law is met.
You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller.
You have the right to object, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 6 (1) lit. f) GDPR). Where you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
You have the right to lodge a complaint with a supervisory data protection authority. For Luxembourg, the Commission Nationale pour la Protection des Données (CNPD).
This Privacy Policy is currently valid and has the status July 2026 (Version 11.0). We may amend it where we further develop the Service, or where legal or regulatory requirements change; prior versions remain accessible. Further details concerning the collection or processing of personal data may be requested from us at any time using the contact details in section 1.
Your personal data may also be used by Compellio for the establishment, exercise or defence of legal claims, and may be disclosed where we are required to do so at the request of public authorities.
