(Last Updated 11 November 2026)

1. Who we are and what is the purpose of this privacy notice?

We are: (i) GSMA Ltd LLC, (“GSMA”, “we”, “us” or “our”), the organiser of MWC Barcelona (“MWC Barcelona”), with registered offices at 3445 Peachtree Road, Suite 910, Atlanta Georgia 30326 United States of America; and (ii) GSMA 4YFN Event Management S.L., (“GSMA 4YFN”), the organiser of the 4YFN event (“4YFN“) co-located at the MWC Barcelona, with registered offices at Avinguda de la Reina Maria Cristina s/n, Hall 1, Side Entrance, Fira Barcelona Montjuïc, 08004 Barcelona, Spain.

MWC Barcelona and 4YFN are individually referred to as the “Event” and collectively referred to as the “Events”.

This privacy notice (“Privacy Notice”) explains how GSMA and GSMA 4YFN collect and process your personal data in connection with your participation as an exhibitor (including as a sponsor, whether or not you have a stand at the Events) or contractor (or as a member of their personnel) at MWC Barcelona and/or 4YFN (“you”, “your” or “yours”).

If you are an attendee, this Privacy Notice does not apply to you. Please refer instead to the Privacy Notice for MWC Barcelona and 4YFN attendees.

GSMA Ltd LLC is the controller of your personal data under the EU General Data Protection Regulation (“GDPR”). For certain processing activities outlined in section 3 below, GSMA 4YFN: (i) also acts as an independent controller; or (ii) acts as a joint controller with GSMA Ltd LLC.

2. What categories of personal data do we collect and process about you?

In this Privacy Notice, when we mention “personal data”, we mean any information that is about you.

We may process the following personal data about you:

  1. Contact Data: full name, email address and mobile phone number.
  2. ID Data: information from your passport or EU National ID card (“ID document“): full name, date of birth, nationality, type of ID document, ID document number, country issuing the ID document, expiry date of the ID document and ID portrait photo.
  3. Photograph: photo of your face (i.e. the live selfie or photo image file you provide at the time of registration).
  4. Biometric Data: personal data resulting from specific technical processing of your Photograph and ID portrait photo, which uniquely identify you.
  5. Login Credentials: username, email address and password for the Online Event Manual and, where applicable, the Global Events Account.
  6. Billing Data: company name, full name, billing address, country / region, VAT number or tax ID and PO number / reference.
  7. Company Data: your company name, job title and industry.

3. For what purposes do we process your personal data?

We may process your personal data for the purposes described below. We also set out the categories of personal data that we process for each purpose and our lawful basis under the GDPR for undertaking the processing purpose we have described. 

A) For Exhibitors and their personnel

1. Contact form for sponsors or exhibitors

  • Description: We may process your personal data to respond to your interest in becoming an exhibitor or a sponsor at the Event(s). We may have received your enquiry via email, phone, the contact form for exhibitors and sponsors on our website, or other channels.
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Legitimate interest in responding to your enquiry and developing a potential business relationship with you or your company.

2. Contract performance

  • Description: We will process your personal data to perform a contract between GSMA or GSMA 4YFN and the exhibitor. This includes, among others, your participation at the Events, logistics and, where applicable, building and dismantling a stand and stand plan submission.
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Performance of a contract, where you are the exhibitor contracting with us; and legitimate interest in performing the contract with the exhibitor you represent, where you are a member of its personnel.

3. Webinars and onsite meetings and conferences

  • Description: We may invite you to webinars, online trainings and/or onsite meetings and conferences related to organisation, logistics, promotion and running of the Events. If you register for an onsite meeting or conference held at a third-party venue, we will share your personal data with such third-party for security and access control. Your personal data will be processed in accordance with third-party privacy notice.
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Legitimate interest in organising webinars, trainings,onsite meetings and conferences to coordinate the logistics and running of the Events.

4. LinkedIn group

  • Description: We may invite you to join our LinkedIn group, created to share information on the organisation, logistics and running of the Events. Your further use of the LinkedIn group will be governed by the LinkedIn privacy notice.
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Legitimate interest in sharing important organisational information with you through a LinkedIn group to ensure the proper organisation and running of the Events.

5. Newsletters

  • Description: We may send you newsletters, guidelines and other information to bring you the latest news and announcements about the Events and their organisation.
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Legitimate interest in keeping you informed about the organisation and running of the Events.

6. Surveys

  • Description: We may send you feedback surveys to learn more about your experience and to improve our services and the organisation of the Events.
  • Data categories: Contact Data, Company Data and your survey responses.
  • Lawful basis: Legitimate interest in obtaining your feedback to improve the organisation and running of the Events.

7. Analytics

  • Description: We may use your personal data to help us better understand the profile of the companies and personnel participating in our Events (e.g. by industry, job title or country). We will use this information to create aggregated and statistical information (which does not identify you) to support us with reporting on the outcomes of the Events and to improve future events. 
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Legitimate interest in understanding the profile of participants in our Events to report on their outcomes and improve future events.

8. Donation Room

  • Description: If you choose to participate in the “Donation Room” initiative (read here for more information), we will process your personal data to manage your participation.
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Legitimate interest in organising and coordinating the Donation Room initiative and your participation in it.

B) For contractors engaged by MWC Barcelona and 4YFN exhibitors and their personnel

1. Registration and coordination of contractor activities

  • Description: We will process your personal data to send you a registration link, manage your registration and registration-related communications, record your association with the relevant contractor company and exhibitor, and provide practical information and instructions to coordinate your work at the Events, including during the build-up and dismantling periods.
  • Data categories: Contact Data, ID Data and Company Data.
  • Lawful basis: Our legitimate interest in administering contractor registration and coordinating the activities of contractors to ensure the efficient organisation and running of the Events.

2. ID Document Validation and Identity Verification (“Validate & Verify”)

  • Description: Further to the “validate and verify” registration and entry process requirements mandated by the MWC Barcelona Security Plan and delivered by the Catalan Police (Cos de Mossos d’Esquadra), GSMA is instructed to:
  • Validate the authenticity of your ID document and verify your identity (“ID Validation”) to prevent fraudulent activities such as false representation or identity theft; and
  • Re-verify your identity each time you access the venue to ensure that only authorised contractors with a previously validated ID document are granted access to the Events.
  • You may complete your ID Validation through one of the following options:
  • Option 1: Biometric: The Biometric option enables instant ID Validation. Our online registration system will collect the required information from your ID document and undertake image analysis to compare your ID portrait photo with the Photograph (i.e. live selfie). Your biometric information will be deleted immediately after the process is complete (i.e. within milliseconds).
  • Option 2: Non-Biometric: The Non-Biometric option does not offer instant ID Validation. Our registration system will collect the required information from your ID document and a GSMA representative will then visually compare your ID portrait photo with the Photograph (i.e. live selfie or photo image file) to verify your identity. There is no Biometric Data involved in this option.
  • Option 3: Live Video: The Live Video option enables ID Validation through a video call with a GSMA representative. You will have to: (i) present your ID document to the GSMA representative; (ii) manually input the required information from your ID document so that it can be entered into our registration system; and (iii) provide a Photograph (i.e. live selfie or photo image file). There is no Biometric Data involved in this option.
  • Please read our FAQs for more information about our Validate & Verify process. We will also provide you with guidance on each step of the registration process.
  • Data categories: ID Data, Photograph and, for Option 1 only, Biometric Data.
  • Lawful basis: (i) For all options: legitimate interest in undertaking the ID document and identity verification to ensure the safety and security of the Events; and (ii) For Biometric only: your explicit consent to the processing of your Biometric Data. If you do not wish to give your explicit consent, you may choose the Non-Biometric or Live Video option instead.

3. Digital Contractor Pass

  • Description: Once you have completed your registration, we will use your personal data to issue you a Digital Contractor Pass (QR code) that will allow you to enter the Events area. If you will also be working during the Event days, you will register through the MWC Series App using your GSMA Global Events Account, and your Digital Contractor Pass will be displayed in the MWC Series App. If you will only be working during the build-up and/or dismantling periods, your Digital Contractor Pass will be displayed on our web service.
  • Data categories: Contact Data and Photograph, and, if you use the MWC Series App, Login Credentials.
  • Lawful basis: Legitimate interest in managing access to the Events area so that only registered contractors can enter the venue.

4. VIP Car stickers

  • Description: If you are a VIP car driver or a member of the personnel of a VIP car service provider, we will process your personal data to provide you with a VIP Car sticker and grant you access to the “VIP Pick-Up & Drop-Off” area.
  • Data categories: Contact Data and Company Data.
  • Lawful basis: Legitimate interest in managing access to the “VIP Pick-Up & Drop-Off” area so that only authorised vehicles and drivers can use it.

C) For MWC Barcelona and 4YN exhibitors, contractors, and their personnel

1. Direct Marketing

  • Description: We may send you marketing communications about the Events, services or products (e.g. via email, phone and, where applicable, SMS and/or WhatsApp). We will only send you electronic marketing communications if you have given us your consent or, where you are a contact of an existing exhibitor, about events, services or products similar to those your company has contracted with us. You can opt out at any time using the unsubscribe link included in each communication.
  • Data categories: Contact Data, Company Data and information about how you interact with our communications (see Section 4).
  • Lawful basis: Your consent; or, where you are a contact of an existing exhibitor, our legitimate interest in promoting our events, services or products similar to those your company has contracted with us.

2. Online Event Manual

  • Description: If you are an exhibitor or contractor, you may be granted access to the Online Event Manual where we make available our Events rules and regulations, instructions, forms, manuals and other useful information regarding the organisation of the Events.
  • Data categories: Contact Data and Login Credentials.
  • Lawful basis: Legitimate interest in providing you with the rules, instructions and information you need to participate in the Events.

3. Data subjects’ requests and enquiries

  • Description: If you exercise your data protection rights (e.g. access, erasure, etc.) or submit an enquiry or complaint, we will process your personal data to handle and respond to your request.
  • Data categories: Contact Data and other data relevant to your request.
  • Lawful basis: Compliance with our legal obligations under the GDPR to respond to data subject requests; and legitimate interest in responding to your enquiries or complaints and in establishing, exercising or defending legal claims.

4. For technical support and security

  • Description: We may use your personal data to diagnose, troubleshoot and fix issues with our website, the Online Event Manual, the registration platform, the MWC Series App or our other services, and to ensure the security of all our services.
  • Data categories: Contact Data, Login Credentials and technical data relating to your use of our services (e.g. IP address, device and browser information, and log data).
  • Lawful basis: Legitimate interest in diagnosing and fixing technical issues with our services, ensuring their security and detecting malicious activities.

5. Incident/Accident reporting & security

  • Description: Fira de Barcelona, as owner of the venue, is primarily responsible for responding to incidents and accidents that happen at the venue and for ensuring security at the Events. However, if you are involved in or witness an incident or accident, we may also take part in responding to it and process your personal data for our own internal investigations and, where required, to report it to the competent authorities or our insurers.
  • Data categories: Contact Data, ID Data and data relating to the incident or accident (which may include health data where you have been injured).
  • Lawful basis: Compliance with our legal obligations; and legitimate interest in managing incidents and accidents and ensuring security at the Events. Where we process health data, we do so to protect your vital interests or for the establishment, exercise or defence of legal claims.

6. Billing

  • Description: If you or the company you represent purchases services from us, we will process your personal data for payment processing and billing purposes, as well as for tax and accounting purposes.
  • Data categories: Contact Data and Billing Data.
  • Lawful basis: Performance of a contract, where you are the party contracting with us, or legitimate interest in managing payments and invoicing with the company you represent; and compliance with our tax and accounting obligations.

If you participate in 4YFN, GSMA 4YFN is also an independent controller of your personal data for the processing activities described in points A. 1 – 3, 5, 7, and C. 1, 3 and 5 above.

GSMA and GSMA 4YFN are joint controllers of your personal data for the processing activities described in points B. 1 and B. 3, and C. 6 above. However, GSMA 4YFN acts as a joint controller only in relation to the personal data processed for the specific purposes associated with 4YFN. If you do not participate in 4YFN, your personal data will not be processed by GSMA 4YFN.

Consent 

Where we process your personal data based on consent, you can withdraw your consent at any time by contacting us (see Section 12) or, for marketing communications, by using the unsubscribe link included in each email. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal. 

Legitimate Interest

If we collect and use your personal data based on our legitimate interests (or those of a third party), you may object to such processing on grounds relating to your particular situation. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defence of legal claims. Please note that, where the processing is necessary for security and access control purposes (such as ID Validation), we may not be able to grant you access to the Events if you object.

Where we process your personal data for direct marketing purposes, you may object to such processing at any time, and we will stop processing your personal data for those purposes.

4. Marketing

If you provide us with your consent or we have another lawful basis for sending marketing communications, we may process your personal data for direct marketing purposes using different channels of communication (e.g. via email, phone and, where applicable, SMS and/or WhatsApp). 

We may also use automated tools within our marketing technology platforms, including AI and machine-learning algorithms, to analyse how you interact with our communications, events and online content. This helps us understand your interests and engagement patterns, segment our audiences, tailor the content and communications we send to you and improve the relevance of our marketing.  

This processing may involve the use of your contact details, profile information and usage data, such as email engagement, event attendance and website interactions. It may also generate scores or place you into audience segments based on predicted interests or likelihood of engagement. We use the outputs of this processing only to support our marketing activities and not to make decisions based solely on automated processing which produce legal effects concerning you or similarly significantly affect you. You have the right to object to this processing at any time. 

You can update your marketing communication preferences anytime in the preference centre on our website. You can access the preference centre via unsubscribe link included in each email from us. 

5. Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing.

6. How do we collect your personal data?

We receive your personal data from an exhibitor, or a contractor engaged by the Event exhibitors.

If you are an exhibitor, contractor or a member of their personnel, we may receive your data via our Online Event Manual.

If you are a contractor or a member of their personnel, we may also collect your data via our Contractor Accreditation System which is used by MWC Barcelona exhibitors to register their contractors and allow contractors to provide their personnel’s personal data to GSMA.

We may also receive personal data directly from you, when you contact us or use one of our services.

7. Who has access to your personal data?

We may share your personal data with the following recipients:

  • Our agents, vendors, or service providers who perform functions on our behalf or provide services to us: for example, providers of registration, access control, security and venue services, IT service providers, accounting service providers or hosting service providers.
  • Our exhibitors and/or contractors for the performance of the services.
  • Authorities where we are required to do so by law, or have other lawful basis to do so, for example for security reasons, identity verification or in connection with criminal or regulatory investigations. In particular, ID Data is shared with the Catalan Police (Cos de Mossos d’Esquadra) for the purpose of ensuring the security of the Events.
  • Outside advisers, including legal counsels for the purpose of defence of legal claims, or regulatory proceedings.
  • Our Affiliates for examplefor administrative purposes, group reporting, or provision of other services.
  • Payment processor, who handles payments for our services.

Please note that this list is non-exhaustive, and we may need to share your personal data with other parties in connection with the Events or to effectively deliver our services.n-exhaustive, and we may need to share your personal data with other parties in connection with the Events or to effectively deliver our services.

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your personal data internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

We will delete your ID Data and Photograph 24 hours after the end of the dismantling period of the Events. Biometric Data is deleted immediately after the comparison is completed (see section B.2).

We will keep your other personal data (such as Contact Data and Company Data) for as long as necessary for the purposes described in Section 3, including to maintain our business relationship with the exhibitor or contractor you represent for future editions of the Events, and to comply with our legal obligations (e.g. Billing Data for the period required by tax and accounting laws). We may also retain personal data for longer where necessary for the establishment, exercise or defence of legal claims, or where you have consented to receive marketing communications, until you withdraw your consent.

You may contact us anytime if you want to know more about how long we will keep your data.

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

  • Confirmation of processing – you can ask us to confirm if we are processing your personal data;
  • Access – you can ask us to provide a copy of the personal data that we hold about you;
  • Rectification – you can ask us to rectify the record of your personal data that we maintain;
  • Restrict – you can ask us to restrict the processing of your personal data in certain situations;
  • Object to processing – you can object to the processing of your personal data, where we process your data based on our legitimate interests or for direct marketing purposes;
  • Deletion – you can ask us to delete some or all the personal data that we hold about you.

You have a right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data. Our lead data protection authority in the EU is the Agencia Española de Protección de Datos. 

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly.

For additional questions or information concerning processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. CCTV Recordings

The Event premises are monitored by the venue owner, Fira de Barcelona (“Fira”) for security reasons. Fira may be asked by authorities to provide CCTV recordings for specific time periods as part of investigations regarding visitors, contractors or other personnel. We do not manage or keep these recordings. For further information, please refer to the data processing notices available on Fira’s CCTV informational signage located throughout the venue.

12. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal

GSMA Ltd LLC

1 Angel Lane,

London EC4R 3AB

United Kingdom