GSMA Capacity Building Privacy Notice

Date last updated: 08 June 2026

1. Who we are and what is the purpose of this privacy notice?

We are GSM Association (“GSMA”, “we”, “us” or “our”) with registered office at 1 Angel Lane, London EC4R 3AB, England. 

This privacy notice (“Privacy Notice”) explains how we collect and process personal data of individuals who participate in our regulatory training courses, created by professional education division GSMA Capacity Building for regulators, policymakers and non-profit organisations.

GSM Association is the controller of your personal data under the EU General Data Protection Regulation (“GDPR”).

2. What categories of personal data do we collect and process about you?

In this Privacy Notice, when we mention “personal data”, we mean any information that is about you.

We may process the following personal data about you

Contact Data your name, organisation, email, country.

Registration Data password, your name, professional email address, job title, organisation, type of organisation, gender (optional), city, country.

My Learning Profile your name, job title, organisation, type of company or organisation, type of work (optional), gender (optional), phone number (optional), city, country, your profile picture (optional).

Learning History information on your completed and current training courses.

Login Credentials email address and password for your My Learning Profile.

Usage Data device IDs, IP address, location data, information on your use of our website or other usage data.

3. For what purposes do we process your personal data?

We may process your personal data for the purposes described below. We also set out the data categories that we process for each purpose and our lawful basis under GDPR for undertaking the processing purpose we have described.

1. Registration and management of My Learning Profile
   • Description: We will process your personal data to create and manage your My Learning Profile, keep your learnings track record and generate reports on your learning.
   • Data categories: Contact Data, My Learning Profile, Registration Data, Learning History, Login Credentials, Usage Data.
   • Lawful basis: Performance of a contract.
2. Participation in GSMA Capacity Building training courses
   • Description: We will process your personal data to facilitate your participation in eLearning or in-person training courses, track your attendance and progress, issue course completion certificates, send you communications related to your courses, and share recommendations on training courses you may be interested in.
   • Data categories: Contact Data, My Learning Profile, Registration Data, Learning History.
   • Lawful basis: Performance of a contract and our legitimate interest, which includes managing your participation in our training course(s) and sending you recommendations.
3. GSMA Capacity Building enquiry form
   • Description: If you have any enquiries related to GSMA Capacity Building you may fill out a contact form on our website. We will process your personal data to respond to your enquiry.
   • Data categories: Contact Data, other data related to your enquiry.
   • Lawful Basis: Our legitimate interest, which includes responding to your enquiry.
4. GSMA Newsletter
   • Description: If you subscribe to our newsletter, we will process your personal data to send you updates related to GSMA Capacity Building training course(s), latest initiatives, industry news, insights and reports curated by our team across the mobile ecosystem.
   • Data categories: Contact Data.
   • Lawful basis: Consent.
5. Help and Feedback related to My Learning Profile
   • Description: If you request assistance with your My Learning Profile or submit feedback on our training courses, we will process your personal data to address your requests and analyse the feedback for service improvement.
   • Data categories: Contact Data, username, training course details, and other data included in your request or feedback.
   • Lawful basis: Our legitimate interest, which includes responding to your request and/or processing your feedback.
6. Statistics and analytics
   • Description: We may use your personal data to gain better understanding of the demographics, backgrounds, and interests of participants in GSMA Capacity Building training courses. This information is analysed to produce aggregated and statistical data, which does not directly identify any individual. The insights gathered support the ongoing development and improvement of our GSMA Capacity Building training courses and related initiatives.
   • Data categories: Contact Data, My Learning Profile, Learning History.
   • Lawful basis: Our legitimate interest, which involves processing your data for analytical purposes.
7. Technical support and security
   • Description: We may use your personal data to diagnose, troubleshoot, and fix issues with My Learning platform, training course(s) and keep our services secure.
   • Data categories: Contact Data, Usage Data, other data required for technical support & security.
   • Lawful basis: Legitimate interest that includes diagnosing and fixing technical issues with your My Learning profile or our services and keeping our services secure. 
8. Data subjects’ requests and enquiries
   • Description: We may use your personal data to respond to your enquiry, complaint, or a data subject request (e.g. access to data, erasure, etc.).
   • Data categories: Contact Data, other data relevant to the Data Subject’s request.
   • Lawful basis: Compliance with legal obligations or legitimate interest, which includes processing your request and/or responding to your enquiry.

Consent

Where we process your personal data based on consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted on other lawful processing grounds.

Legitimate Interest

If we collect and use your personal data based on our legitimate interests (or of a third party), you may object to such processing. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you may object to such processing at any time.

4. Marketing

If you provide us with your consent or we have another lawful basis for sending marketing communications, we may process your personal data for direct marketing purposes using different communication channels such as email.

We may also use automated tools within our marketing technology platforms, including AI and machine-learning algorithms, to analyse how you interact with our communications, events and online content. This helps us understand your interests and engagement patterns, segment our audiences, tailor the content and communications we send to you and improve the relevance of our marketing.  

This processing may involve the use of your contact details, profile information and usage data, such as email engagement, event attendance and website interactions. It may also generate scores or place you into audience segments based on predicted interests or likelihood of engagement. We use the outputs of this processing only to support our marketing activities and not to make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. You have the right to object to this processing at any time. 

You can update your marketing communication preferences anytime in the preference centre on our website. You can access the preference centre via unsubscribe link included in each email from us.

5.  Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing. 

6. How do we collect your personal data?

Directly from you, for example when you register your My Learning Profile, enrol to our GSMA Capacity Building training course(s), subscribe for our newsletter, use our services or products, interact with our apps or websites, communicate with us via email or other means.

From third parties, for example from your employer or another person that enrolled you for our GSMA Capacity Building training course(s).

7. Who has access to your personal data?

We may share your personal data with the following recipients:

• Our agents, vendors, or service providers who perform functions on our behalf or provide services to us; for example, IT service providers, accounting service providers or hosting service providers, other accreditation bodies with whom we partnered to provide certain training course(s).
• Authorities where we are required to do so by law for example for security reasons, identity verification or in connection with criminal or regulatory investigations,
• Outside advisers, including legal counsels for the purpose of defence of legal claims, or regulatory proceedings,
• Our Affiliates for examplefor administrative purposes, group reporting, or provision of other services.

Please note that this list is non-exhaustive and we may need to share your data with other parties in connection with the delivery of GSMA Capacity Building training courses.

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your Personal Information internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice or to comply with legal requirements. Retention periods vary depending on the data type and processing purpose. Specific retention periods are set out below where applicable.

Your personal data will be deleted as follows:

• Data relating to your My Learning Profile and participation in our GSMA Capacity Building training course(s) will be retained for a period of thirty (30) days following the termination of the relevant training course contract, after which it will be permanently deleted.
• Data relating to our marketing communications will be deleted upon your withdrawal of consent (opt-out) or after a period of two (2) years from your last interaction with GSMA, whichever occurs earlier.

We may retain your other personal data for the duration of our legal relationship with you or to comply with applicable regulations such as tax or accounting. You may contact us anytime if you want to know more about how long we will keep your data. 

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

Confirmation of processing – you can ask us to confirm if we are processing your personal data;

Access – you can ask us to provide a copy of the personal data that we hold about you;

Rectification – you can ask us to rectify the record of your personal data that we maintain;

Restrict – you can ask us to restrict the processing of your personal data in certain situations;

Object to processing – you can object to the processing of your personal data, where we process your data based on our legitimate interests;

Deletion – you can ask us to delete some or all of the personal data that we hold about you;

Portability – in certain circumstances, you can ask GSMA to provide you a copy of your personal data in a structured, electronic format, or to transmit it directly to another data controller, where technically feasible.

You have the right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data. Our lead data protection authority in the EU is the Agencia Española de Protección de Datos.

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly.

For additional questions or information concerning the processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal

GSM Association, 1 Angel Lane,

London, EC4R 3AB

United Kingdom