GSMA Advance Privacy Notice

Date last updated: 21 May 2026

1. Who are we and what is the purpose of this privacy notice?

We are GSMA Services LLC, (“GSMA”, “we”, “us” or “our”) with registered office at Suite 910, 3445 Peachtree Road, Atlanta, GA 30326 USA.

This privacy notice (“Privacy Notice”) explains how we collect and process personal data of individuals who participate in our regulatory training courses, created by professional education division GSMA Advance for mobile operators, other commercial organisations and ecosystem players.

GSMA Services LLC is the controller of your personal data under the EU General Data Protection Regulation (“GDPR“).

2. What categories of personal data do we collect and process about you?

In this Privacy Notice, when we mention “personal data”, we mean any information that is about you.

We may process the following personal data about you:

Contact Data your name, job title, company, business email, country/region, phone number.

Registration Data password, job title, gender (optional), type of company or organisation.

My Learning Profile your name, job title, organisation, type of company or organisation, type of work (optional), gender (optional), phone number (optional), city, country, profile picture (optional).

Learning History information on your completed and current training courses.

Billing Data your name, company or organisation name, country/region, street address, town/city, purchase order reference (optional), VAT number (optional), postcode/ ZIP.

Login Credentials email address and password for your My Learning Profile.

Usage Data device IDs, IP address, location data (country and city), information on your use of our website, or other usage data.

3. For what purposes do we process your personal data?

We may process your personal data for the purposes described below. We also set out the data categories that we process for each purpose and our lawful basis under the GDPR for undertaking the processing purpose we have described.

1. Registration and management of My Learning Profile 
   • Description: We will process your personal data to create and manage your My Learning Profile, keep your learnings track record and generate reports on your learning.
   • Data categories: Contact Data, My Learning Profile, Registration Data, Learning History, Login Credentials, Usage Data.
   • Lawful basis: Performance of a contract.
2. Participation in GSMA Advance training courses
   • Description: We will process your personal data to facilitate your participation in eLearning or in-person training courses, track your attendance and progress, issue course completion certificates, send you communications related to your courses, and share recommendations on training courses you may be interested in.
   • Data categories: Contact Data, My Learning Profile, Registration Data, Learning History.
   • Lawful basis: Performance of a contract and our legitimate interest, which includes managing your participation in our training course(s) and sending you recommendations.
3. Billing
   • Description: We will process your personal data for payment processing and billing purposes as well as for tax and accounting purposes.
   • Data categories: Contact Data and Billing Data.
   • Lawful basis: Performance of a contract and compliance with legal obligations.
4. GSMA Advance enquiry form
   • Description: If you want to partner with us or for other enquiries related to GSMA Advance you may fill out a contact form on our website. We will process your personal data to respond to your enquiry.
   • Data categories: Contact Data, other data related to your enquiry.
   • Lawful Basis: Our legitimate interest, which includes responding to your enquiry.
5. Help and Feedback related to My Learning Profile
   • Description: If you request assistance with your My Learning Profile or submit feedback on our training courses, we will process your personal data to address your requests and analyse the feedback for service improvement.
   • Data categories: Contact Data, your username, training course details, and other data included in your request or feedback.
   • Lawful basis: Our legitimate interest, which includes responding to your request and/or processing your feedback.
6. Direct Marketing
   • Description: We may send you marketing communications about our courses or services via email if you provide your consent or we have another lawful basis to do so. We may send you communications tailored to your interests.
   • Data categories: Contact Data and Learning History.
   • Lawful basis: Consent or legitimate interest, which includes processing your personal data for direct marketing purposes.
7. Analytics
   • Description: We may use your personal data to gain better understanding of the demographics, backgrounds, and interests of participants in GSMA Advance training courses. This information is analysed to produce aggregated and statistical data, which does not directly identify any individual. The insights gathered support the ongoing development and improvement of our GSMA Advance training courses and related initiatives.
   • Data categories: Contact Data, My Learning Profile, Learning History.
   • Lawful basis: Our legitimate interest, which involves processing your data for analytical purposes.
8. Technical support and security
   • Description: We may use your personal data to diagnose, troubleshoot, and fix issues with your My Learning Profile, training courses, and to keep our services secure.
   • Data categories: Contact Data, Usage Data, other data required for technical support & security.
   • Lawful basis: Legitimate interest that includes diagnosing and fixing technical issues with your My Learning Profile or our services, and keeping our services secure.
9. Data subjects’ requests and enquiries
   • Description: We may use your personal data to respond to your enquiry, complaint, or a data subject request such as access to data or data erasure.
   • Data categories: Contact Data, other data relevant to the data subject’s request.
   • Lawful basis: Compliance with legal obligations or legitimate interest, which includes processing your request and/or responding to your enquiry.

Consent

Where we process your personal data based on consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted on other lawful processing grounds.

Legitimate Interest

If we collect and use your personal data based on our legitimate interests (or of a third party), you may object to such processing. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you may object to such processing at any time.

4. Marketing

If you provide us with your consent or we have another lawful basis for sending marketing communications, we may process your personal data for direct marketing purposes using different communication channels such as email.

You can update your marketing communication preferences anytime in the preference centre on our website. You can access the preference centre via unsubscribe link included in each email from us.

5. Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing. 

6. How do we collect your personal data?

Directly from you, for example when you register your My Learning Profile, enrol to our GSMA Advance training course(s), subscribe to our newsletter, use our services or products, interact with our apps or websites, communicate with us via email or other means.

From third parties, for example from your employer or another person that enrolled you for our GSMA Advance training course(s).

7. Who has access to your personal data?

We may share your personal data with the following recipients:

• Our agents, vendors, or service providers who perform functions on our behalf or provide services to us; for example, IT service providers, accounting service providers or hosting service providers, other accreditation bodies with whom we partnered to provide certain training course(s).
• Authorities where we are required to do so by law for example for security reasons or in connection with criminal or regulatory investigations,
• Outside advisers, including legal counsels for the purpose of defence of legal claims, or regulatory proceedings,
• Our Affiliates for examplefor administrative purposes, group reporting, or provision of other services.

Please note that this list is non-exhaustive, and we may need to share your data with other parties in connection with the delivery of GSMA Advance training course(s).

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your personal data internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice or to comply with legal requirements. Retention periods vary depending on the data type and processing purpose. Specific retention periods are set out below where applicable.

Your personal data will be deleted as follows:

Data relating to your My Learning Profile and participation in our GSMA Advance training course(s) will be deleted two years after your last completed training or course.

• Data relating to our marketing communications will be deleted upon your withdrawal of consent (opt-out) or after a period of two (2) years from your last interaction with GSMA, whichever occurs earlier.

We may retain some of your personal data to comply with applicable regulations such as tax or accounting. You may contact us anytime if I you want to know more about how long we will keep your data.

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

Confirmation of processing – you can ask us to confirm if we are processing your personal data;

Access – you can ask us to provide a copy of the personal data that we hold about you;

Rectification – you can ask us to rectify the record of your personal data that we maintain;

Restrict – you can ask us to restrict the processing of your personal data in certain situations;

Object to processing – you can object to the processing of your personal data, where we process your data based on our legitimate interests;

Deletion – you can ask us to delete some or all of the personal data that we hold about you;

Portability – in certain circumstances, you can ask GSMA to provide you a copy of your personal data in a structured, electronic format, or to transmit it directly to another data controller, where technically feasible.

You have the right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data. Our lead data protection authority in the EU is the Agencia Española de Protección de Datos.

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly.

For additional questions or information concerning the processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal

GSMA Services LLC, 1 Angel Lane,

London, EC4R 3AB

United Kingdom