Privacy Notice For GSMA Connectivity For Good & Mobile For Development

Date last updated: 08 June 2026

1. Who we are and what is the purpose of this privacy notice?

We are GSM Association, (“GSMA”, “we”, “us” or “our”) with registered office at 1 Angel Lane, London, EC4R 3AB, England.

This privacy notice (“Privacy Notice”) explains how GSMA collects and processes personal data of individuals, who participate in our GSMA Connectivity for Good initiatives, including, External Affairs, Government Convening, Mobile for Development, Policy and Regulation, Spectrum, Mobile Economy.

GSM Association acts as the controller of your personal data under the EU General Data Protection Regulation (“GDPR”). For certain processing activities related to Mobile for Development (“M4D“) outlined in section 3 below, GSMA Mobile for Development Foundation Inc. acts as a joint controller with GSM Association.

2. What categories of personal data do we collect and process about you?

In this Privacy Notice, when we mention “personal data”, we mean any information that is about you.

We may process the following personal data about you:

Contact Data first name, last name, job title, company name, email, country / region.

M4D Innovation Fund Data designated contacts data (first name, last name, email title, LinkedIn profile, work phone, cell phone, preferred method of contact, alternative address) and data related to the organisation (primary person, organisation name, legal name, address, email, phone number, link to website, social media handles), data on how you heard about this opportunity, data on the purpose for registering.

M4D Research Data data collected for M4D research purposes that may include name, phone number, location, age, gender, political status, and other data. M4D Research Data may also include biometric data resulting from specific technical processing of your voiceprint or thumbprint which uniquely identify you.

Photograph your photograph.

Audiovisual Data video and audio recordings, including photographs.

Login Credentials username and password.

3. For what purposes do we process your personal data?

We may process your personal data for the purposes described below. We also set out the data categories that we process for each purpose and our lawful basis under the GDPR for undertaking the processing purpose we have described.

1. Events
   • Description: If you sign up for our event(s), we will process your personal data to organise the event and support your participation. You may find our events across the global events library or on pages related to our initiatives. We may use third-party providers (such as LinkedIn or Stream Yard) to organise events. Please refer to the privacy notices of the third-party providers for details on how they handle your personal data. Recordings from our events may be published on our websites or media channels.
   • Data categories: Contact Data, Audiovisual data, and other data that may be required for registration.
   • Lawful basis: (i) Our legitimate interest that includes organisation of the event and (ii) consent or, if applicable, our legitimate interests for the use of recordings from our events on our website or other media channels.
2. Newsletters
   • Description: If you subscribe to our newsletter(s) (such as, Policy Insights, External Affairs, M4D), we will process your personal data to send you emails with the latest insights and regulatory developments from GSMA Connectivity for Good initiatives, depending on the newsletter(s) you subscribed to.
   • Data categories: Contact Data, other data requested in the form.
   • Lawful Basis: Consent.
3. Government Convening
   • Description: If you are a representative of the government, intergovernmental organisation, or leader in the mobile industry and if you express your interest in joining one of our Ministerial Programme(s), MWC, or M360 events, we may send you a personalised invitation to our event(s). We may receive your contact details from your organisation. Recordings or photographs from our events may be published on our websites or media channels.
   • Data categories: Contact Data.
   • Lawful basis: (i) Our legitimate interest(s) in inviting you to our events, (ii) consent or, if applicable, (iii) our legitimate interests for the use of recordings from our events on our website or other media channels.
4. M4D Innovation Fund – Register Your Interest
   • Description: If you sign up to our newsletter regarding our M4D GSMA Innovation Fund program, we will process your personal data to send you updates on the selected GSMA Innovation Fund(s), when you can apply and eligibility criteria.
   • Data categories: Contact Data, data on your selected GSMA M4D newsletter(s) (optional).
   • Lawful basis: Consent.
5. M4D Innovation Fund – Participation
   • Description: If you submit an application or participate in one of our M4DInnovation Fund(s) as a grantee or a representative,we will process your personal data to register your account and grant you access to our Innovation Fund Applicant and Grantee portal, review your application, evaluate your project and manage your grant(s). We may also use your Photograph and name on our website, social media and in M4D Innovation Fund(s) marketing materials.
   • Data categories: M4D Innovation Fund Data, Photograph, Login Credentials.
   • Lawful basis: Performance of a contract and our legitimate interest that includes evaluation of your application, conducting due diligence on our part and managing your grant(s). Consent is obtained for the use of your Photograph and name on our website, social media and marketing materials and for the recording or taking photographs of you during our events.
6. M4D Research
   • Description: We may process your personal data for research projects, which may include activities such as interviews, surveys, or questionnaires. Participants will be asked by our third-party suppliers to provide consent for the processing of their personal data for research purposes. In cases where we conduct focus group research with participants who are unable to provide written consent, we may obtain consent through alternative means such as a thumbprint or voice recording. Some research materials, such as photographs or video/audio recordings, may be published on our website or social media channels.
   • Data categories: M4D Research Data, Photograph, Audiovisual data.
   • Lawful basis: Consent and explicit consent for biometric data.
7. Contact Us Forms
   • Description: If you fill out one of the contact forms on our website (such as contact forms for External Affairs, M4D or Spectrum), we will process your personal data to respond to your enquiry.
   • Data categories: Contact Data, your enquiry, other data requested in the contact form.
   • Lawful basis: Our legitimate interests that includes processing your personal data to respond to your enquiry.
8. Data Subjects’ Requests and Enquiries
   • Description: We may use your personal data to respond to your enquiry, complaint, or a data subject request (e.g. access to data, erasure, etc.).
   • Data categories: Contact Data, other data relevant to the data subject’s request.
   • Lawful basis: Compliance with legal obligations or legitimate interest that involves processing your request and/or responding to your enquiry.

GSMA Mobile for Development Foundation is a joint controller of your personal data for the M4D processing activities described in points 4 and 5 above.

Consent

Where we process your personal data based on consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted on other lawful processing grounds.

Legitimate Interest

If we collect and use your personal data based on our legitimate interests (or of a third party), you may object to such processing. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you may object to such processing at any time.

4. Marketing

If you provide us with your consent or we have another lawful basis for sending marketing communications, we may process your personal data for direct marketing purposes using different communication channels such as email.

We may also use automated tools within our marketing technology platforms, including AI and machine-learning algorithms, to analyse how you interact with our communications, events and online content. This helps us understand your interests and engagement patterns, segment our audiences, tailor the content and communications we send to you and improve the relevance of our marketing.  

This processing may involve the use of your contact details, profile information and usage data, such as email engagement, event attendance and website interactions. It may also generate scores or place you into audience segments based on predicted interests or likelihood of engagement. We use the outputs of this processing only to support our marketing activities and not to make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. You have the right to object to this processing at any time. 

You can update your marketing communication preferences anytime in the preference centre on our website. You can access the preference centre via unsubscribe link included in each email from us.

5. Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing. 

6. How do we collect your personal data?

Directly from you, for example when you subscribe for our newsletters or email communications, register for one of our events, or apply and participate in our M4D GSMA Innovation Fund(s), use our services or products, interact with our apps or websites, communicate with us via email or other means.

From third parties, for example from your employer or another person that shared your data with us as part of your company’s application for one of our M4D GSMA Innovation Fund(s).

7. Who has access to your personal data?

We may share your personal data with the following recipients:

• Our agents, vendors, or service providers who perform functions on our behalf or provide services to us: for example, IT service providers, accounting service providers or hosting service providers.
• Authorities where we are required to do so by law for example for security reasons or in connection with criminal or regulatory investigations.
• Outside advisors, including legal counsels for the purpose of defence of legal claims or regulatory proceedings.
• Our Affiliates for examplefor administrative purposes, group reporting, or provision of other services.
• Our external event partners, when you sign up for events co-organised with our partners, we may share your personal data to facilitate your participation at the event.

Please note that this list is non-exhaustive, and we may need to share your data with other parties to effectively deliver our services.

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your personal data internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

We retain your personal data only for as long as necessary to fulfil the purposes described in this Privacy Notice or to comply with legal requirements. Retention periods vary depending on the data type and processing purpose. Specific retention periods are set out below where applicable.

Your personal data will be deleted as follows:

• Data relating to the donor-funded activities of your project within M4D GSMA Innovation Fund(s) that includes M4D research materials received for the purposes of M4D programmes (interviews, surveys, questionnaires), data related to your user account on GSMA Innovation Fund Online Grants Portal, data related to donor-funded events is deleted after 7 (seven) years from the end of M4D donor grant agreement. Photographs and video recordings that are published on our website or social media are retained for as long as they remain publicly available.
• Data relating to our marketing communications will be retained for a period of two years after your last interaction or activity with GSMA.
• Data relating to your registration for our events (except for donor-funded events) completed on our website will be retained for 12 months after you registered for the event.

We may retain your other personal data for the duration of our legal relationship with you or to comply with applicable regulations such as tax or accounting. You may contact us anytime if you want to know more about how long we will keep your data.

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

Confirmation of processing – you can ask us to confirm if we are processing your personal data.

Access – you can ask us to provide a copy of the personal data that we hold about you.

Rectification – you can ask us to rectify the record of your personal data that we maintain.

Restrict – you can ask us to restrict the processing of your personal data in certain situations.

Object to processing – you can object to the processing of your personal data, where we process your data based on our legitimate interests or for direct marketing purposes;

Deletion – you can ask us to delete some or all of the personal data that we hold about you;

You have the right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data. Our lead data protection authority in the EU is the Agencia Española de Protección de Datos.

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly.

For additional questions or information concerning the processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal

GSM Association, 1 Angel Lane,

London, EC4R 3AB

United Kingdom