GSMA Careers Privacy Notice

Date last updated: 20 May 2026

1. What is the purpose of this privacy notice?

This privacy notice (“Privacy Notice”) explains how GSMA group companies collect and process personal data of individuals who are applying for employment or other type of engagement with GSMA.

This Privacy Notice does not apply to GSMA employees. If you are currently employed by GSMA, please refer to the Data Privacy Guidance on Employee Personal Data.

2. Who is the controller of your personal data?

We are GSM Association with registered office at 1 Angel Lane, London, EC4R3AB, England, and our affiliates: GSMA Ltd LLC, Georgia, USA; GSMA S.R.L., Argentina; GSMA Services India Private Limited, India; GSMC Event Project Management, S.L., Barcelona, Spain; GSMA (Shanghai) Co., Ltd., Shanghai, China; GSMA 4YFN Event Management S.L., Barcelona, Spain; GSM Conference Services Limited, London, England; GSM Conference Services Limited, Wan Chai, Hong Kong; GSM Association, Nairobi, Kenya; GSM Association, Brussels, Belgium; GSMA Ventures LLC, Delaware, USA; GSMA Advisory Services LTD, London, United Kingdom (jointly “GSMA”, “we”, “us” or “our”).

During our recruitment processes, your personal data will be processed by one or more GSMA companies, depending on the position you are applying for. GSM Association acts as a data controller for all recruitment processes across GSMA group. This means that GSM Association is responsible for managing the recruitment process, collecting your CV and application documents, initial candidate selection, and storing your information throughout the recruitment process.

In addition to GSM Association, the specific GSMA company where the position is located will act as a joint data controller together with GSM Association. This joint controller arrangement ensures that the company where you may potentially be employed is directly involved in processing your application, whilst GSM Association provides centralised recruitment support across our group.

3. What categories of personal data do we collect and process about you?

In this Privacy Notice, when we mention “personal data”, we mean any information that is about you.

We may process the following personal data about you:

My Workday Account Data    given name, family name, a preferred name, address, phone number.

Application Data                          information on how candidate heard about us, previous employment at GSMA, country, prefix, given name, family name, address, phone number, previous experience (CV and other application documents), salary expectations, eligibility to work in a given location, notice period.

DEI Data                                            diversity, equity and inclusion data such as race/ethnicity, religion, sexual orientation, gender identity, disability, passport gender.

Login Credentials                        your email address and password for GSMA Workday Account.

4. For what purposes do we process your personal data?

We may process your personal data for the purposes described below. We also set out the data categories that we process for each purpose and our lawful basis under the European Union’s General Data Protection Regulation for undertaking the processing purpose we have described. 

1. Registration and Management of your GSMA Workday Account 
   • Description: We will process your personal data to create your GSMA Workday Account and grant you access to our recruitment platform on Workday where you can manage your job application(s).
   • Data categories: My Workday Account Data, Login Credentials.
   • Lawful basis: Our legitimate interest that involves processing your personal data within your GSMA Workday Account.
2. GSMA Recruitment Process
   • Description: We will process your personal data for recruitment and selection purposes, including to evaluate your application(s), assess your suitability for the position you apply for, conduct online or onsite interviews, arrange your travel bookings, and reimburse expenses related to your travel to interviews. Depending on the position you are applying for and the country in which you will reside, we may process your personal data for other purposes to ensure compliance with applicable laws.
   • Data categories: Application Data and other data included in your application.
   • Lawful basis: Performance of a contract, legitimate interest that involves processing your data for recruitment and compliance with our legal obligations.
3. Diversity and inclusion statistics
   • Description: We may process your personal data to create reports and monitor equality of opportunity for candidates, ensure diversity across the GSMA group, and maintain GSMA as a fair and attractive workplace for employees with different backgrounds and from different cultures. To achieve these goals, we may ask you to provide your DEI Data on a voluntary basis. We will collect DEI Data only if you consent to us processing such data. Any DEI Data you provide will have no impact on the recruitment process in which you participate or on our hiring decisions.
   • Data categories: Application Data, DEI Data.
   • Lawful basis: Explicit consent.
4. Vetting and background checks
   • Description: If you apply for certain positions at GSMA, we may process your personal data to conduct pre-employment vetting and background screening. This may include: (i) reference checks with previous employers or other referees you have provided, (ii) criminal record checks, (iii) verification of professional qualifications, memberships and registrations, (iv) verification of educational qualifications and credentials, (v) credit and financial history checks, (vi) checks with relevant regulatory bodies and professional organisations. For this purpose, we may share your personal data with our third-party background screening provider(s) (for example, PeopleCheck). We will only conduct these checks where they are relevant to the position for which you have applied and in accordance with applicable laws. In some cases, we may be legally required to conduct certain checks before we can offer you employment.
   • Data categories: Application Data, and other data required for the vetting and background checks.
   • Lawful basis: Depending on the recruitment process and applicable laws, the lawful basis for processing your data may vary and may include, among others: (i) our legitimate interest that involves ensuring that we recruit suitable employees for our positions; (ii) compliance with legal obligations, or (iii) pursuing substantial public interest.
5. Job offer
   • Description: If you are selected during the recruitment process, we will process your personal data to offer you a job, negotiate conditions of your employment and collect evidence of your academic or professional qualifications.
   • Data categories: Application Data and supporting evidence.
   • Lawful basis: (i)Performance of a contract and/or (i) our legitimate interest that involves ensuring that we recruit suitable employees for our positions.
6. GSMA Talent Pool
   • Description: If we decide to retain your CV and application in our talent pool and have your consent, we will process your personal data for the purpose of contacting you about future job opportunities that align with your experience and qualifications.
   • Data categories: Application Data.
   • Lawful basis: Consent.
7. GSMA Job Alerts
   • Description: When you create a job alert in your GSMA Workday Account, we will process your personal data to send you emails about new jobs that match your preferences and profile.
   • Data categories: My Workday Account Data.
   • Lawful basis: Consent.
8. Technical Support and Security
   • Description: We may use your personal data to diagnose, troubleshoot, and fix issues with your GSMA Workday Account, applications, and keep our services secure.  
   • Data categories: Data required for technical support & security.
   • Lawful basis: Legitimate interest that includes diagnosing and fixing technical issues with your GSMA Workday Account or our services, ensuring the security our services and detecting malicious activities. 
9. Data Subjects’ Requests and Enquiries:
   • Description: We may process your personal data to respond to your enquiry, complaint, or a data subject request (e.g. access to data, erasure, etc.).
   • Data categories: Data relevant to the data subject’s request.
   • Lawful basis: Compliance with legal obligations or legitimate interest in processing your request and/or responding to your enquiry.

Consent

Where we process your personal data based on consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted on other lawful processing grounds.

Legitimate Interest

If we collect and use your personal data based on our legitimate interests (or of a third party), you may object to such processing. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

5. Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing. 

6. How do we collect your personal data?

Directly from you, for example when you apply for a job via our GSMA Careers website, email, or submit your application through other channels.

From third parties, for example when we receive your application from recruitment agencies, through external referrals, or via LinkedIn. We may also receive your personal data from our background screening providers or referrals that you provide during your recruitment process.

7. Who has access to your personal data?

We may share your personal data with the following recipients:

• Our agents, vendors, or service providers who perform functions on our behalf or provide services to us; for example, IT service providers, accounting service providers or hosting service providers.
• Authorities where we are required to do so by law for example for security reasons or in connection with criminal or regulatory investigations.
• Outside advisors, including legal counsels for the purpose of defence of legal claims, or regulatory proceedings.
• Our Affiliates for examplefor administrative purposes, group reporting, or provision of other services.
• External recruitment agencies, referrals, talents pools forrecruitment and talent sourcing purposes.
• Background screening providers, for the vetting procedures background checks.

Please note that this list is non-exhaustive and we may need to share your data with other parties in connection with your recruitment process or to effectively deliver our services.

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your personal data internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

We retain your personal data only for as long as necessary to fulfil the purposes described in this privacy notice or to comply with legal requirements. Retention periods vary depending on the data type and processing purpose. Specific retention periods are set out below where applicable. 

Your personal data will be deleted as follows:

• For successful applicants employed by GSMA, relevant information from your application and your GSMA Workday Account will be added to your personnel file on our Workday HR system and retained during your employment. Following termination of employment, your data (including any DEI Data provided in your application) will be retained for six years.
• For unsuccessful applicants, all data from your application and your GSMA Workday Account will be retained for two years following the conclusion of the recruitment process.
• Data relating to vetting enquiries and background checks will be retained as follows: (i) Where no warnings or issues are identified: two years; (ii) Where warnings or issues are identified: two years following termination of employment; (iii) Where employment is terminated as a result of the vetting process: up to seven years.

We may retain your personal data to comply with applicable regulations (e.g. tax or accounting) or to defend against legal claims. You may contact us anytime if you want to know more about how long we will keep your data.

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

Confirmation of processing – you can ask us to confirm if we are processing your personal data;

Access – you can ask us to provide a copy of the personal data that we hold about you;

Rectification – you can ask us to rectify the record of your personal data that we maintain;

Restrict – you can ask us to restrict the processing of your personal data in certain situations;

Object to processing – you can object to the processing of your personal data, where we process your data based on our legitimate interests;

Deletion – you can ask us to delete some or all of the personal data that we hold about you;

Portability – in certain circumstances, you can ask GSMA to provide you a copy of your personal data in a structured, electronic format, or to transmit it directly to another data controller, where technically feasible.

You have the right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data. You can contact the relevant data protection authority located in the European Union’s relevant Member State where your habitual residence, place of work you applied for, or place of alleged infringement is. The contact details of supervisory authorities within the EU can be found on the website of the European Data Protection Board here.

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly.

For additional questions or information concerning the processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal

GSM Association, 1 Angel Lane,

London, EC4R 3AB

United Kingdom