Date last updated: 08 June 2026

1. Who we are and what is the purpose of this privacy notice?

We are GSMA Services LLC with registered office at Suite 910, 3445 Peachtree Road, Atlanta, GA 30326, USA and GSMA Advisory Services Ltd with registered office at 1 Angel Lane, London EC4R 3AB (collectively “GSMA”, “we”, “us” or “our”).

This privacy notice (“Privacy Notice”) explains how we collect and process personal data of representatives and other personnel of GSMA Industry Services customers, including prospective customers.

GSMA Services LLC is the controller of your personal data. However, for certain processing activities outlined in section 3 below, GSMA Advisory Services Ltd also acts as your data controller.

2. What categories of personal data do we collect and process about you?

In this Privacy Notice, when we mention “personal data”, we mean any information that is about you.

We may process the following personal data about you:

Contact Data your first name, last name, company name, job title (optional), industry description, country/region, notes, phone number (if required), email address (if required).

Registration Data your first name, last name, company address, job title, phone number, email address. Scope of data required for registration may vary depending on the services you are using.

Login Credentials email address or username and password. Login credentials may vary depending on the platform/service you log in to.

Billing Data company name, company registration number, full name, billing address, country / region, VAT number or tax ID, and PO number / reference.

Usage Data your username, location (country and city), IP address, information on your use of our website or data platforms, or other usage data.

3. For what purposes do we process your personal data?

We may process your personal data for the purposes described below. We also set out the data categories that we process for each purpose and our lawful basis for undertaking the processing purpose we have described.

1. GSMA Industry Service – Platforms
   • Description: We will process your personal data in connection with your use of the relevant GSMA Industry Service platforms. This includes grating you access and managing your account(s), resolving any issues with your access to the services, and communicating with you. The list of our GSMA Industry Services is available here. Please note that registration rules, login procedures and terms of use may vary depending on the service you are using.
   • Data categories: Contact Data, Registration Data, Login Credentials, Usage Data. Usage Data are collected only for some of our Service Platforms.
   • Lawful basis: Performance of a contract and/or our legitimate interest involving resolving issues with our services and communication with you.
2. Contact persons and contract performance
   • Description: We will process your personal data in connection with the negotiation, conclusion and performance of a contract between your organisation and us. This includes verifying your authority to enter into the agreement, managing the contractual relationship, coordinating the performance of services under the agreement, and communicating with you in your capacity as a contact person and representative on behalf of your organisation.
   • Data categories: Contact Data.
   • Lawful basis: Our legitimate interests in managing our contractual relationships, ensuring the proper performance of services, and maintaining effective communication with designated representatives and contact persons.
3. Industry Services – ‘Contact us’ form
   • Description: We process your personal data to respond to your enquiry, provide customer support and respond to requests submitted via our website.
   • Data categories: Contact Data, area of interest, other data related to your enquiry.
   • Lawful basis: Our legitimate interest in responding to your enquiry.
4. GSMA Services Partnership Program – enquiry form
   • Description: If you want to partner with us or for other enquiries related to GSMA Services Partnership Program, you may fill out a contact form on our website. We will process your personal data to respond to your enquiry.
   • Data categories: Contact Data, other data related to your enquiry.
   • Lawful basis: Our legitimate interest in responding to your enquiry.
5. GSMA Services Partnership Program
   • Description: We will process your personal data in connection with your partnership with GSMA Industry Services, including partner evaluation and onboarding, participation in meetings and events, submission of contributions, and communication.
   • Data categories: Contact Data.
   • Lawful basis: Ourlegitimate interest that includes processing your personal data for activities related to your partnership with GSMA Industry Services.
6. Billing
   • Description: We will process your personal data for payment processing, billing, tax and accounting purposes.
   • Data categories: Contact Data and Billing Data.
   • Lawful basis: Performance of a contract and compliance with legal obligations.
7. GSMA Industry Services Newsletter
   • Description: If you subscribe to our newsletter, we will process your personal data to send you updates related to GSMA Industry Services, latest initiatives, industry news, insights and reports curated by our team.
   • Data categories: Contact Data.
   • Lawful basis: Consent.
8. Webinars and online events
   • Description: If you sign up for our webinars or online events, we will process your personal data in connection with your participation. We may share your data with our external partners to facilitate the organisation of the event and related communication. Recordings from our webinars may be published on our websites and social media.
   • Data categories: Contact data, other data required in the registration form which may differ depending on the event
   • Lawful basis: Consent or our legitimate interest that includes sharing your data with the event partners.
9. Direct Marketing
   • Description: We may send you marketing communications about GSMA Industry Services or our other services and/or products via email if you provide your consent or we have another lawful basis to do so.
   • Data categories: Contact Data.
   • Lawful basis: Consent or our legitimate interests that involve processing your data for marketing purposes.
10. Analytics
    • Description: We may use your personal data to help us better understand the demographics, backgrounds and interests of our customers or their representatives. We will use this information to create aggregated and statistical information (which does not directly identify you) to support us with further developments of our GSMA Industry Services and related initiatives.
    • Data categories: Contact Data, Usage Data.
    • Lawful basis: Legitimate interest that includes processing your personal data for analytical purposes.
11. Technical support and security
    • Description: We may use your personal data to diagnose, troubleshoot, and resolve technical issues with our Industry Services platforms, your access to our services, and to maintain the security of our services.
    • Data categories: Contact Data,Usage Data,otherdata required for technical support & security.
    • Lawful basis: Our legitimate interest that includes diagnosing and fixing technical issues with our services and ensuring the security of our services.
12. Data subjects’ requests and enquiries
    • Description: We may use your personal data to respond to your enquiry, complaint, or a data subject request (e.g. access to data, erasure, etc.).
    • Data categories: Contact Data, other data relevant to your request.
    • Lawful basis: Compliance with legal obligations and our legitimate interest that includes processing your personal data to respond to your request or enquiry.
13. Network Services
    • Description: For certain network services we provide, we process personal data that enable the correct routing of messages and calls, and to prevent exploitation of international telephone numbers. Personal data processed as part of these services may include telephone numbers which may be sourced from various sources. We have engaged a data processor, responsible for the technical operation of the service, including the hosting, querying, maintenance, and security of the data processed in connection with the service.
    • Data categories: Telephone numbers and other data necessary for the provision of our services.
    • Lawful basis: Our legitimate interest in operating and delivering the relevant network services.

For the purposes of provision of certain GSMA assurance services, GSMA Advisory Services Ltd acts as an independent data controller for the processing activities described in points 3.2 – 3.10 and 3.12 above.

Consent

Where we process your personal data based on consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted on other lawful processing grounds.

Legitimate Interest

If we collect and use your personal data based on our legitimate interests (or of a third party), you may object to such processing. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you may object to such processing at any time.

4. Marketing

If you provide us with your consent or we have another lawful basis for sending marketing communications, we may process your personal data for direct marketing purposes using different communication channels such as email.

We may also use automated tools within our marketing technology platforms, including AI and machine-learning algorithms, to analyse how you interact with our communications, events and online content. This helps us understand your interests and engagement patterns, segment our audiences, tailor the content and communications we send to you and improve the relevance of our marketing.  

This processing may involve the use of your contact details, profile information and usage data, such as email engagement, event attendance and website interactions. It may also generate scores or place you into audience segments based on predicted interests or likelihood of engagement. We use the outputs of this processing only to support our marketing activities and not to make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. You have the right to object to this processing at any time. 

You can update your marketing communication preferences anytime in the preference centre on our website. You can access the preference centre via unsubscribe link included in each email from us.

5. Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing.

6. How do we collect your data?

Directly from you, for example when you represent GSMA customer (or prospective customer), create your account at one of our Industry Services platforms, subscribe for our newsletter, use our services or products, interact with our apps or websites, communicate with us via email or other means.

From third parties, for example from our customer (or prospective customer) or a person who provided us with your contact details.

7. Who has access to your data?

We may share your personal data with the following recipients:

• Our agents, vendors, or service providers who perform functions on our behalf or provide services to us; for example, IT service providers, accounting service providers or archiving service providers,
• Authorities where we are required to do so by law for example for security reasons or in connection with criminal or regulatory investigations,
• Outside advisers, including legal counsels for the purpose of defence of legal claims, or regulatory proceedings,
• Our Affiliates for examplefor administrative purposes, group reporting, or provision of other services.

Please note that this list is non-exhaustive and we may need to share your data with other parties in connection with delivery of GSMA Industry Services.

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your personal data internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

We retain your personal data only as long as necessary to fulfil the purpose(s) for which it was collected, to provide you our services, or as otherwise necessary to fulfil the purposes described in this privacy notice.

Your data processed for marketing communications purposes will be retained until you withdraw your consent.

We may retain some of your personal data to comply with applicable regulations such as tax or accounting. You may contact us anytime if you want to know more about how long we will keep your data.

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

Confirmation of processing – you can ask us to confirm if we are processing your personal data;

Access – you can ask us to provide a copy of the personal data that we hold about you;

Rectification – you can ask us to rectify the record of your personal data that we maintain;

Restrict – you can ask us to restrict the processing of your personal data in certain situations;

Object to processing – you can object to the processing of your personal data, where we process your data based on our legitimate interests;

Deletion – you can ask us to delete some or all of the personal data that we hold about you;

Portability – in certain circumstances, you can ask GSMA to provide you a copy of your personal data in a structured, electronic format, or to transmit it directly to another data controller, where technically feasible.

You have the right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data. Our lead data protection authority in the EU is the Agencia Española de Protección de Datos.

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly.

For additional questions or information concerning the processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal

GSMA Services LLC

1 Angel Lane

London, EC4R 3AB

United Kingdom