Privacy Notice For GSMA Foundry

Date last updated: 08 June 2026

1. Who we are and what is the purpose of this privacy notice?

We are GSM Association (“GSMA”, “we”, “us” or “our”) with registered office at 1 Angel Lane, London EC4R 3AB, England.

This privacy notice (“Privacy Notice”) explains how we collect and process personal data of individuals including our members and industry players who collaborate within our GSMA Foundry hub.

GSM Association is the controller of your personal data under the EU General Data Protection Regulation (“GDPR”).

2. What categories of personal data do we collect and process about you?

In this Privacy Notice, when we mention “personal data”, we mean any information that is about you.

We may process the following personal data about you

Contact Data your first name, last name, email address, company name, job title, country / region, industry description (if required), phone number (if required).

Member Data information on GSMA membership.

Application Data information you submit in your application for GSMA Foundry Innovation Challenges, or as required during evaluation stage. This may include details about your organisation, project or idea, expected outcome of your project, duration, and other relevant information specific to each challenge.

Photographyour photograph.

3. For what purposes do we process your personal data?

We may process your personal data for the purposes described below. We also set out the data categories that we process for each purpose and our lawful basis under the GDPR for undertaking the processing purpose we have described.

1. GSMA Foundry Innovation Challenges
   • Description: If you express your interest in one of our GSMA Foundry Innovation Funding and Challenges by completing a form on our website or via other means (such as email), we will process your personal data to review your application and select the most promising projects. If your project has been selected, your application will be evaluated by the relevant committee consisting of GSMA representatives and GSMA Members. The terms of the challenge, project evaluation process, benefits and prizes differ in each case and are described on our website or in the terms of reference. We may run challenges in partnership with external partners who may access your personal data in order to evaluate your application and provide funding for your project.
   • Data categories: Contact Data, Application Data.
   • Lawful basis: Performance of a contract and our legitimate interest that includes reviewing your application and facilitating your participation in one of the challenges.
2. GSMA Foundry Excellence Awards
   • Description: If you apply for the GSMA Foundry Excellence Awards, we will use your personal data to process your application, communicate with you and, if applicable, award prizes. Where required by law, your application and related individuals may be verified against sanction lists. We may publish your name, company and photograph on our website and media channels.
   • Data categories: Contact Data, Photograph, other data included in your application.
   • Lawful basis: Performance of a contract, legitimate interest that includes reviewing your application and enabling your participation in GSMA Foundry Excellence Awards and compliance with legal obligations with respect to sanction lists screening.
3. Become a Partner – Expression of Interest
   • Description: If you express your interest to become our Partner by completing Become a Partner – Submission of Interest form on our website or via other means (such as email), we will process your personal data for communication, and, if applicable, to evaluate your application.
   • Data categories: Contact Data, Member Data, other data included in your application.
   • Lawful basis: Our legitimate interest that includes responding to your application.
4. GSMA Foundry – Partnerships
   • Description: If you are a representative of a GSMA Foundry Partner we will process your personal data for purposes related to our collaboration with the partner, including partner onboarding, providing partnership resources and contributions, as well as for communication. We may share your personal data with other GSMA Foundry Partners for collaboration and communication purposes.  
   • Data Categories: Contact Data.
   • Lawful basis: Our legitimate interests that includes processing your personal data for activities related to GSMA Foundry Partnership.
5. GSMA Foundry Mailing List
   • Description: If you sign up to our GSMA Foundry Mailing List, we will process your personal data to send you updates on networking events, exhibitions, speaking opportunities, workshops and insightful content.
   • Data categories: Contact Data, Member Data.
   • Lawful basis: Consent.
6. Submit Your Projects Form
   • Description: If you submit your project for review through our Submit Your Projects form on our website or via other means (such as email), we will process your personal data to evaluate your application and get in touch with you to discuss how we can accelerate your project within GSMA Foundry.
   • Data categories: Contact Data, data related to your project submission.
   • Lawful basis: Our legitimate interest that includes using your personal data to evaluate your project submission.
7. GSMA Foundry – Project Implementation
   • Description: If you project is positively assessed, we will process your personal data for purposes related to accelerating and growing your project with GSMA Foundry, and for communication purposes.
   • Data categories: Contact Data, other data as may be required during the project implementation.
   • Lawful basis: (i) our legitimate interests that includes processing personal data for activities related to project implementation.
8. GSMA Foundry Events
   • Description: If you sign up for our events such as GSMA Foundry events or GSMA Foundry Innovation Spotlight Interview Series, we will process your personal data to organise the event and support your participation. We may also use third-party providers, including LinkedIn, as a platform for our webinars or organise events together with our partners, such as TechTuesdaysUK. Please refer to the privacy notices of our partners and third-party providers for details on how they handle your personal data.
   • Data categories: Data required in the registration form, which may vary depending on the specific event.
   • Lawful basis: Our legitimate interest in processing your personal data for the organisation of and management of the event.
9. Share Your AI Use Cases
   • Description: If you contribute and share your AI use case via our Share your AI Use case contact form, we will process your personal data to contact you, evaluate your case study, and feature it in our AI Use Case Library.
   • Data categories: Contact Data, data included in your AI use case study submission.
   • Lawful basis: Consent.
10. GSMA Pavilion at MWC Barcelona
    • Description: If you apply via our website to showcase your innovation and exhibit on the GSMA Pavilion during MWC Barcelona event, we will process your personal data for contact and selection purposes related to your application. If you application is assessed positively, we will process your data for implementation and management of the showcase activities.
    • Data categories: Contact Data, other data required in the the application form.
    • Lawful basis: Our legitimate interest in evaluating your application and management of your showcase activities.
11. Direct Marketing
    • Description: We may send you marketing communications about our events, services or products (e.g. via email) if you provide your consent or we have another lawful basis to do so.
    • Data categories: Contact Data.
    • Lawful basis: (i) consent; and (ii) legitimate interests for direct marketing purposes.
12. Data subjects’ requests and enquiries
    • Description: We may use your personal data to respond to your enquiry, complaint, or a data subject request (e.g. access to data, erasure, etc.).
    • Data categories: Contact Data, other data relevant to the data subject’s request.
    • Lawful basis: Compliance with legal obligations or legitimate interest that involves processing your request and/or responding to your enquiry.

Consent

Where we process your personal data based on consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted on other lawful processing grounds.

Legitimate Interest

If we collect and use your personal data based on our legitimate interests (or of a third party), you may object to such processing. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you may object to such processing at any time.

4. Marketing

If you provide us with your consent or we have another lawful basis for sending marketing communications, we may process your personal data for direct marketing purposes using different communication channels such as email.

We may also use automated tools within our marketing technology platforms, including AI and machine-learning algorithms, to analyse how you interact with our communications, events and online content. This helps us understand your interests and engagement patterns, segment our audiences, tailor the content and communications we send to you and improve the relevance of our marketing.  

This processing may involve the use of your contact details, profile information and usage data, such as email engagement, event attendance and website interactions. It may also generate scores or place you into audience segments based on predicted interests or likelihood of engagement. We use the outputs of this processing only to support our marketing activities and not to make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. You have the right to object to this processing at any time. 

You can update your marketing communication preferences anytime in the preference centre on our website. You can access the preference centre via unsubscribe link included in each email from us.

5. Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing.

6. How do we collect your personal data?

Directly from you, for example when you subscribe for our mailing list, submit your project for our GSMA Foundry Innovation Challenges, use our services or products, communicate with us via email or other means.

From third parties, for example from your employer or another person that shared your data with us, as part of your company’s application for GSMA Innovation Challenges or other initiatives.

7. Who has access to your personal data?

We may share your personal data with the following recipients:

• Our agents, vendors, or service providers who perform functions on our behalf or provide services to us; for example, IT service providers, accounting service providers or hosting service providers;
• Authorities where we are required to do so by law for example for security reasons or in connection with criminal or regulatory investigations;
• Outside advisors, including legal counsels for the purpose of defence of legal claims, or regulatory proceedings;
• Our Affiliates for examplefor administrative purposes, group reporting, or provision of other services;
• Our partners who are involved in organising GSMA Foundry InnovationChallenges, GSMA Foundry events or other initiatives.

Please note that this list is non-exhaustive, and we may need to share your data with other parties to effectively deliver our services.

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your personal data internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

We retain your personal data only for as long as necessary to fulfil the purposes described in this privacy notice or to comply with legal requirements. Retention periods vary depending on the data type and processing purpose. Specific retention periods are set out below where applicable.

Your personal data will be deleted as follows:

• Data relating to your subscription to GSMA Foundry mailing list such as your contact data and information on the member you represent will be deleted if you do not interact with us for 9 months.
• Data relating to your application(s) for GSMA Foundry Innovation Challenges or GSMA Foundry Excellence Awards will be deleted 9 months after the end of a challenge or an award. Data relating to the publication on our website or social media of a successfully selected or awarded project will be retained at our discretion, or until you request its deletion.

We may retain your other personal data for the duration of our legal relationship with you or to comply with applicable regulations such as tax or accounting. You may contact us anytime if you want to know more about how long we will keep your data.

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

Confirmation of processing – you can ask us to confirm if we are processing your personal data.

Access – you can ask us to provide a copy of the personal data that we hold about you.

Rectification – you can ask us to rectify the record of your personal data that we maintain.

Restrict – you can ask us to restrict the processing of your personal data in certain situations.

Object to processing – you can object to the processing of your personal data, where we process your data based on our legitimate interests or for direct marketing purposes;

Deletion – you can ask us to delete some or all of the personal data that we hold about you;

Portability – in certain circumstances, you can ask GSMA to provide you a copy of your personal data in a structured, electronic format, or to transmit it directly to another data controller, where technically feasible.

You have the right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data. Our lead data protection authority in the EU is the Agencia Española de Protección de Datos.

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly.

For additional questions or information concerning the processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal

GSM Association, 1 Angel Lane,

London, EC4R 3AB

United Kingdom