Privacy Policy
Last updated: 30 October 2026
The controller of your personal data on the LT-IWS platform is LUKITECH j.d.o.o., Poljička cesta 5, 21000 Split, Croatia, tax ID (OIB) 82624892753, e-mail [email protected]. This Policy explains which data we collect, why, on which legal basis, how long we keep it and which rights you have under the General Data Protection Regulation (GDPR).
1. Data we process
- Account data: name, e-mail, password (stored as a hash), account type, country, phone, website, LinkedIn, bio, profile photo, company.
- Content you publish: innovations, photos, documents, video links, patents, awards, problems and ideas, proposed solutions, comments, Community forum topics, replies and reports, your forum nickname, co-innovator invitations; innovators' affiliation (association, school, company…); the innovators an investor follows.
- Payment data: invoice details (name/company, address, country, tax number), amount, order reference, PayPal transaction identifier. Card data is processed exclusively by the payment provider.
- Access data: which innovations or innovators you unlocked and until when; for innovators – which investor unlocked them.
- Innovation agents: the agent application (name, e-mail, phone, message, categories), acceptance of the Agent Rules, the collaboration records kept by the agent (which innovator or investor they worked with, the project phase and reports) and the innovator’s mark of what they are looking for (an investor, engineering help, a sponsor, a partner).
- Guests posting a problem or idea: name, e-mail and an e-mail confirmation token.
- Sponsorship requests: name or company name, e-mail, website, amount and the logo you send us by e-mail.
- Technical data: IP address and request time (abuse protection, rate limiting), the cookies described in the Cookie Policy, the administrator audit log.
- Messages you send through the contact form.
2. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Running your account, publishing innovations, investor access, sponsorship, order and access-expiry notifications | performance of a contract (Art. 6(1)(b) GDPR) |
| Issuing invoices and keeping accounting records | legal obligation (Art. 6(1)(c)) – Croatian Accounting Act and tax law |
| Showing the public part of listings and profiles, moderation, approving posts, abuse prevention, security | legitimate interest (Art. 6(1)(f)) – operating and protecting the Platform |
| Showing your e-mail address on your post to members with an active package; loading external video | consent (Art. 6(1)(a)) – a checkbox or the cookie dialog, withdrawable at any time |
| Answering contact-form enquiries | legitimate interest / steps at your request |
| Handling agent applications, the work of agents and oversight of their mediation (collaboration records and reports) | steps at your request before a contract and performance of the contract with the agent (Art. 6(1)(b)); legitimate interest in protecting members (Art. 6(1)(f)) |
3. Who sees your data
Public (all visitors): innovator name, photo, country, bio, expertise, the public part of innovations. Investor profiles are shown anonymously as "Investor #number" (type, country, focus areas, programs).
Members with a Limited or Full access package who unlocked you: for innovators – e-mail, phone, website, LinkedIn, affiliation, patent numbers and documents; for investors – name, company, e-mail, phone and website. An innovator unlocked by an investor also sees that investor's contact details.
Innovation agents (LUKITECH associates, ID AGT-number) with an active agent package: the contact details, affiliation, patent numbers and documents of every innovator; with the investors add-on also the name, company and contact details of every investor. Agents may use this data only to mediate (Agent Rules).
If an innovation agent works with you, your name and public ID may be listed on the agent's public profile under "Works with" (investors only as "Investor #number"); project phases and the agent's reports are visible only to the agent and the LT-IWS team.
Signed-in members with a confirmed e-mail: problems and ideas, proposed solutions and comments. Who the author is and their e-mail are shown only to members with an active package that unlocks that author's contact, and the e-mail only if the author allowed it.
On the IWS Community forum authors are shown only by their public ID (INO-, INV-, AGT-) and nickname, without names or contact details.
4. Recipients and processors
- the hosting provider where the Platform runs – data is stored within the EU
- Google Workspace (Google Ireland Ltd.) – sending e-mail notifications and business e-mail
- Stripe Payments Europe, Ltd. (Ireland) – card payment processing; card details are entered directly into Stripe's form and never pass through our server
- PayPal (Europe) S.à r.l. et Cie, S.C.A. – PayPal payment processing; it receives order and payer data under its own privacy policy
- YouTube (Google) and Vimeo – only if you play an embedded video on an innovation page
- our accountant and public authorities where the law requires
We do not sell data and do not use it for advertising. Where data leaves the EEA (e.g. Google, Stripe, PayPal), the transfer relies on the European Commission's standard contractual clauses or an adequacy decision.
5. Retention
- account and content: while the account is active; on deletion the profile is anonymised immediately
- orders, invoices and invoice details: 11 years from the end of the business year (Croatian Accounting Act)
- access data: while access lasts plus 2 years for handling complaints
- failed sign-ins and rate limits: up to 24 hours
- e-mail confirmation token: 7 days; password-reset token: 1 hour
- contact-form messages: up to 2 years
- agent applications that were not accepted: up to 1 year; agent collaboration records and reports: while the agent account is active plus 2 years
- administrator audit log: 2 years
6. Your rights
You have the right of access, rectification, erasure, restriction, data portability and the right to object to processing based on legitimate interest, as well as to withdraw consent without affecting earlier processing. Most data you can edit yourself in your profile; the account can be deleted in the settings.
Send requests to [email protected]. We reply within one month. If you believe we process your data unlawfully, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, Zagreb, azop.hr, or with the supervisory authority of your country of residence.
7. Security
Passwords are stored only as bcrypt hashes, the connection is encrypted (HTTPS), the session cookie is HttpOnly and Secure, administration access is restricted and administrator actions are logged. Changing your password signs out all devices.
8. Automated decisions and children
We do not carry out automated decision-making or profiling. The Platform is not intended for persons under 18.
9. Cookies
Necessary and functional first-party cookies are used without consent; external video (YouTube, Vimeo) loads only with the consent you give and withdraw in the cookie dialog. Details are in the Cookie Policy.
10. Changes
We may update this Policy; the date of the last change is shown at the top and registered users are notified of material changes by e-mail.