Last Updated 24 September 2026

1. Who we are and what is the purpose of this privacy notice?

We are GSMA Ltd LLC, (“GSMA”, “we”, “us” or “our”), the organiser of NOVA Future Summit event (“Event”), with registered offices at 3445 Peachtree Road, Atlanta, Georgia 30326, United States of America.

This privacy notice (“Privacy Notice”) describes how we collect, use, and share personal data of individuals who attend or participate in the Event (“you”, “your” or “yours”).

GSMA Ltd LLC is the controller of your personal data under the EU General Data Protection Regulation (“GDPR”).

This Privacy Notice constitutes our notice at collection and our privacy policy pursuant to the California Consumer Privacy Act (“CCPA”).

2. What categories of personal data do we collect about you?

In this Privacy Notice, when we mention “personal data”, we mean your personal data including “personal information” within the meaning of the CCPA, which refers to any information or data that is about you.

We may process the following personal data about you:

Contact Data: your name, email address, gender (optionally), country/region, address, city, state/province, postcode/zip code, country code, mobile phone number. CCPA equivalent: identifiers, characteristics of protected classifications under California or federal law.
Profile Data: company name, job title, job level, area of responsibility, company industry type, areas of interest, networking preferences (including, website URL, Twitter/X/LinkedIn profile URL if provided).
Photograph: photo of your face or other image of yourself you may upload to the MyNova portal and MWC Series App: CCPA equivalent; audio, electronic, visual, thermal, olfactory, or similar information.
Billing Data: company name, full name, billing address, country / region, VAT number or tax ID, and PO number / reference. CCPA equivalent: personal information including financial information.
Audiovisual Data: video and audio recordings, including photographs. CCPA equivalent: audio, electronic, visual, thermal, olfactory, or similar information.
Usage Data: device IDs, cookies, IP address, information on your use of our website or mobile apps, or other usage data. CCPA equivalent: identifiers, internet or other electronic network activity information.
Login Credentials: username, email address and password for your GSMA Global Events Account. CCPA equivalent: identifiers, sensitive personal information.
Networking Data: information on your contacts, followers, messages, meetings, and attended events.
Inferences (CCPA): inferences drawn from Contact Data, Profile Data and Usage Data to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

3. What do we use your personal data for?

We may process your personal data for the purposes described below. We also set out the categories of personal data that we process for each purpose and our lawful basis under GDPR for undertaking the processing purpose we have described.

1) Registration and GSMA Global Events Account creation

Description: We will use your personal data to register you for the Event and create your GSMA Global Events Account. With your GSMA Global Events Account you may also register for other GSMA events.
Data categories: Contact data, Profile Data, Billing Data and Login Credentials.
Lawful basis: Performance of a contract.

2) Attendance at the Event

Description: We will process your personal data for the purpose of your attendance at the Event, including granting you access to the Event area, facilitating your participation in meetings, sessions and other activities at the Event and to communicate with you about the organisation, logistics and running of the Event. We may communicate with you through email, telephone, WhatsApp or other available channels.
Data categories: Contact Data.
Lawful basis: Performance of a contract.

3) Billing

Description: We will process your personal data for the purposes of payment processing and billing, as well as for tax and accounting purposes.

Data categories: Contact Data and Billing Data.

Lawful basis: Performance of a contract and compliance with legal obligations.

4) Enhanced Networking

Description: To maximise your experience at GSMA events, we offer personalised networking service that facilitates introductions between attendees, exhibitors and our sponsors. We will share your personal data with exhibitors and sponsors if you have signed up to Enhanced Networking for networking purposes. You can easily opt out of Enhanced Networking by changing your preferences in your networking profile.
Data categories: Contact Data and Profile Data.
Lawful basis: Consent.

5) MyNova Portal

Description: To maximise your experience at the Nova Future Summit event, we offer a personalised networking service that facilitates connections and engagement between attendees via a web-based portal, MyNova. If you opt in to the MyNova networking portal, this allows you to connect and engage with attendees from Nova Future Summit and the wider MyMWC community. Data relating to your MyNova user account will expire within nine (9) months if You do not have at least one complete registration in the 12 months prior to the launch of the registration system for the next edition of MWC Barcelona happening November each year. You can easily opt out of networking at any time by changing your preferences in the MyNova web portal or MWC Series App.
Data categories: Profile Data, Photograph and Networking Data.
Lawful basis: Consent.

6) Broadcasting

Description: During the Event we make video and audio recordings of the venue, sessions, meetings and attendees, or take your photographs. These recordings may be broadcast/ published/ streamed (live or later) on public television networks, TVs at the Event and on other media such as social media, radio or the internet. We use these recordings to promote the Event. Your image and voice may be recorded in the background of such recordings or as a direct contributor to such recordings, for example, where you are interviewed.
Data categories: Contact Data and Audiovisual Data.
Lawful basis: Performance of a contract or legitimate interests for promotion, marketing and raising awareness about the Event.

7) Speakers

Description: If you are a speaker at the Event, we may process information from your professional profile, images or video of you, recordings of your voice and other information about you that is included in the materials presented by you during the Event.

We will use this information to promote the session and/or a meeting you are speaking at. We may also record the session and broadcast/publish/stream it (live or later) on various media, including public television networks, TVs at the Event and on other media such as social media, radio or the internet.

Your professional profile and image may be used by our AI chatbot service installed on our websites. The purpose of the chatbot is to inform attendees and website users about sessions, meetings and speakers at the Event.
Data categories: Contact Data, Profile Data, Photograph, Audiovisual Data and other data relating to the session you are taking part in.
Lawful basis: Performance of a contract or legitimate interests for enabling the proper organisation and management of the session or meeting, promotion and marketing and raising awareness about the Event.

8) LinkedIn

Description: You may link your GSMA Global Events Account with your LinkedIn account or choose to use your LinkedIn account to log into your GSMA Global Events Account. This will allow you to share content related to the Event on your LinkedIn profile. We will not share any content through your LinkedIn account without your consent. For more information on how LinkedIn may use your personal data see LinkedIn privacy notice.
Data categories: Email address, LinkedIn ID and LinkedIn Token.
Lawful basis: Consent.

9) Partner Programmes & Summit Sponsors Lead Generation

Description: Our partners may host a summit or a conference at the Event. You may also be able to participate in a partner summit/conference online. If you sign up to a summit or conference (whether held on-site at the Event or online) we will share your personal data with our partners to facilitate the organisation of sessions that you attend, for communications related to that event as well as invitations to stay in touch with the partner who organised the summit or conference.
Data categories: Contact Data and Profile Data.
Lawful basis: Performance of a contract (with respect to the attendance in the partner event) or legitimate interest (for data sharing with our partners to facilitate the organisation of sessions you attend and to allow our partners to contact you about the event).

10) Direct Marketing

Description: We may contact you to inform you about our events, products and services through a variety of channels, including by email, telephone, social media platforms, and other online channels such as targeted advertising and sponsored content displayed on third-party websites and platforms. We may also conduct online marketing activities using cookies, pixel tags, web beacons, or other similar tracking technologies, which may include building profiles based on your browsing behaviour, interests, and interactions with our content. Any such communications and marketing activities will only be carried out where you have provided your consent or where we otherwise have a lawful basis to do so. All communications and contacts made with you, through whatever channel, may be personalised and tailored to your interests and profile.
Data categories: Contact Data, Profile Data, Usage Data and Inferences.
Lawful basis: Consent or our legitimate interests involving processing your personal data for direct marketing purposes.

11) Profiling

Description: We may analyse your personal data for profiling purposes, to improve our marketing activities and create more relevant news and communications for our customers.
Data categories: Contact Data, Profile Data, Usage Data and Inferences.
Lawful basis: Legitimate interest involving processing your personal data for marketing, including profiling purposes.

12) Surveys

Description: We may send you feedback surveys to learn more about your experience and to improve our services and organisation of the Event.
Data categories: Contact data and Profile Data.
Lawful basis: Legitimate interest in improving the organisation and functioning of the Event.

13) Analytics

Description: We may use your personal data to help us better understand the demographics, backgrounds and interests of attendees at our events. We will use this information to create aggregated and statistical information (which does not directly identify you) to support us with reporting on the outcomes of the Event and to improve future events.
Data categories: Contact Data, Profile Data, Billing Data, Usage Data and Inferences.
Lawful basis: Legitimate interest involving processing your personal data for analytical purposes.

14) Incident/Accident Reporting & Security

Description: The owner of the venue (The Meritage Resort and Spa) is primarily responsible for responding to incidents and accidents that happen during the Event and ensuring security at the Event. However, in some cases we may also be involved in responding to incidents and/or accidents at the Event and use your personal data for our own internal investigations.
Data categories: Contact Data, Audiovisual Data and data relating to the incident/accident.
Lawful basis: Compliance with legal obligations and legitimate interest involving managing incidents and accidents and ensuring security at the Event.

15) Data subjects' requests and enquiries

Description: We may process your personal data if you make a data subject request (e.g. access to data, erasure, etc.) or submit an enquiry/complaint.
Data categories: Contact Data and other data relevant to the data subject's request.
Lawful basis: Compliance with legal obligations, defence of legal claims or for legitimate interests involving processing your request and/or responding to your enquiry.

Consent

Where we process your personal data based on consent, you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal data conducted on other lawful processing grounds.

Legitimate Interest

If we collect and use your personal data based on our legitimate interest (or of a third party), you may object to such processing. In that case we will no longer process your personal data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where we process your personal data for direct marketing purposes, you may object to such processing at any time.

4. Marketing

Where you have provided your consent, or where we otherwise have a lawful basis to do so, we may contact you for direct marketing purposes through a variety of channels, including the MWC Series App, email and telephone. We may also conduct online marketing activities on social media platforms and third-party websites using cookies, pixel tags, web beacons, or other similar tracking technologies.

You may update your marketing communication preferences at any time by visiting the preference centre on our website, which is also accessible via the unsubscribe link included in each of our emails. To manage your cookie and online marketing preferences, you may update your settings at any time through the cookie banner available on our websites.

5. Automated processing

We will not use your personal data to make a decision about you based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless it is necessary for a contract between us and you, is permitted by law or you have provided us with your consent for such processing.

6. How do we collect your personal data?

Directly from you, for example when you register for the Event, create your GSMA Global Events Account, subscribe for our marketing communications, use our services or products, interact with our apps or websites, communicate with us via email or other means.
From third parties, for example from your employer or entity engaged with you on a professional basis, social media (e.g. LinkedIn), a person who bought a Pass for you and signed you up for the Event, or from other attendees.

7. Who has access to your personal data?

We may share your personal data with the following recipients:

Our agents, vendors, or service providers who perform functions on our behalf or provide services to us: for example, providers of registration, access control, security and venue services, telesales, marketing, IT, accounting or hosting service providers.
Authorities where we are required to do so by law, or have other lawful basis to do so, for example for security reasons, identity verification or in connection with criminal or regulatory investigations.
Outside advisors, including legal counsels for the purpose of defence of legal claims, or regulatory proceedings.
Our Affiliates for example for administrative purposes, group reporting, or provision of other services.
Social media, if you decide to pair your LinkedIn account with your GSMA Global Events Account or when you publish our content on your social media profiles or if we decide to conduct tailored marketing activities through social media.
Our partners and exhibitors when you, for example sign up for our Enhanced Networking service or summits/conferences organised by our Event partners and sponsors, you provide your consent, or we otherwise have a lawful basis for sharing your personal data with them.
Payment processors who handle payments for our services; they may act on our behalf or be independent controllers of your personal data.
Other third parties as may be disclosed to you at the time of registration or detailed in the terms and conditions of the Event or MWC Series App.

Please note that this list is non-exhaustive, and we may need to share your personal data with other parties in connection with the Event or to effectively deliver our services.

8. International data transfers

As we operate via a global network of corporate offices, booking and service centres, and data centres, it may be necessary to transfer your personal data internationally, i.e. outside of the country where it was originally collected or outside of your country of residence.

Where we transfer personal data that originates in the European Union (“EU”), the United Kingdom (“UK”) or Switzerland to a country outside the EU, the UK or Switzerland, we will ensure such transfer is made in accordance with applicable laws. We use a variety of legal mechanisms, including Standard Contractual Clauses adopted by the European Commission, to ensure your rights and protections travel with your data.

9. How long do we keep your personal data?

Information relating to your GSMA Global Events Account (i.e. Contact Data, Profile Data, Usage Data and Login Credentials) will be deleted if You (the GSMA Global Events Account holder) do not have at least one complete registration in the 12 months prior to the launch of the MWC Barcelona registration system happening November each year.

We may retain your other personal data for the duration of our legal relationship with you or to comply with applicable regulations (e.g. tax or accounting). You may contact us anytime if you want to know more about how long we will keep your personal data.

10. Your rights as a data subject

Below you will find descriptions of rights that you may be able to exercise in relation to the personal data we process about you.

Confirmation of processing – you can ask us to confirm if we are processing your personal data.
Access – you can ask us to provide a copy of the personal data that we hold about you.
Rectification – you can ask us to rectify the record of your personal data that we maintain.
Restrict – you can ask us to restrict the processing of your personal data in certain situations.
Object to processing – you can object to the processing of your personal data where we process your data based on our legitimate interests or for direct marketing purposes.
Deletion – you can ask us to delete some or all of the personal data that we hold about you.
Portability – in certain circumstances, you can ask GSMA to provide you a copy of your personal data in a structured, electronic format, or to transmit it directly to another data controller, where technically feasible.

You have the right to contact the relevant data protection authority if you have concerns about how GSMA processes personal data.

However, we encourage you to contact us directly in the first instance so that we can attempt to address your concerns directly. For additional questions or information concerning the processing of your personal data or if you would like to exercise one of your rights, you can email us at dataprivacy@gsma.com.

11. Minors

The Event is intended exclusively for adults who have reached the age of eighteen (18) years by the start date of the Event. We do not knowingly collect or process personal data of individuals under the age of 18. For more details, please read GSMA’s Attendee Terms and Conditions for Events and our FAQs.

12. CCTV Recordings

The Event premises are monitored by the venue owner, The Meritage Resort and Spa, for security reasons. The venue owner may be asked by authorities to provide CCTV recordings for specific time periods as part of investigations regarding attendees, contractors or other personnel. We do not manage or keep these recordings. For more information, you can consult the details of this data processing on the venue owner's informative CCTV signs placed at the venue.

13. California Consumer Privacy Act (“CCPA”)

This section applies to California residents only and supplements the rest of this Privacy Notice. It describes the rights that the CCPA, as amended by the California Privacy Rights Act, confers on California residents and explains how you can exercise those rights.

a. Personal information we collect and disclose for a business purpose

In the past 12 months, we may have collected and disclosed for our business and commercial purposes each of the categories of personal information listed in Section 2 of this Privacy Notice relating to California residents.

We collect personal information when you interact with us and use our services, for example when you sign up to our events, use our websites or enter our social media profiles. Some of the information we collect is considered sensitive personal information under CCPA such as account log-in information and password.

We do not use or disclose sensitive personal information such as your GSMA Global Events Account login and password beyond what is needed to provide the products and services you request, with your consent, or for other purposes specified in the law such as detecting security incidents; resisting malicious, deceptive, fraudulent or illegal actions; ensuring the physical safety of a person; short-term, transient uses; performing services such as maintaining or servicing accounts, providing customer service; verifying your information; and verifying, maintaining or enhancing a service on a device that is owned, manufactured or controlled by us or on your device. We may also disclose sensitive personal information to service providers providing storage or similar services on our behalf.

b. How long we retain your personal information

We retain personal information for as long as they are needed for our business and commercial purposes indicated in Section 3 of this Privacy Notice. We may retain your personal information also for legal, tax, audit, investigative, and security purposes and then securely delete or destroy them. For more details on how long we retain your personal information please see Section 9 of this Privacy Notice.

c. Your rights

Subject to certain exceptions, and to the extent applicable to how GSMA processes your personal information, you have the following rights under the CCPA:

Right to Know: You have the right to know what personal information GSMA has collected about you, including the specific pieces of personal information GSMA holds about you.

Right to Delete: You have the right to request that GSMA delete personal information it has collected from you, subject to certain exceptions.

Right to Correct: You have the right to request that GSMA correct inaccurate personal information it maintains about you.

Right to Opt-Out of Sale or Sharing: If GSMA sells or shares your personal information, you have the right to direct GSMA to stop selling or sharing your personal information.

Right Not to be Retaliated Against: You have the right not to be discriminated against or retaliated against for exercising any of your rights under the CCPA.

How you may exercise your rights

You or your authorised agent may submit a request to know, delete, or correct your personal information by contacting us at dataprivacy@gsma.com.

Verification of identity

To protect your personal information, we are required to verify your identity before processing a request to know, delete, or correct. We will seek to verify your identity by matching the information you provide with information we already maintain about you. We may verify your identity using your email address, name, or phone number.

Authorised agents

You may designate an authorised agent (an individual or a business) to submit a request on your behalf. To authorise an agent, please contact us at dataprivacy@gsma.com with your name, email address and mailing address, along with the name, address and email address of your authorised agent, together with signed written permission authorising the agent to submit the request.

We may require your authorised agent to provide proof that you gave them signed permission to submit the request. We may also ask you to verify your identity directly with us, or to confirm directly with us that you have authorised the agent to act on your behalf.

d. Notice of Right to Opt-Out from Sale/Sharing

You have the right to instruct us not to sell or share your personal information. Under California law, "sale or sharing" encompasses the exchange of personal information for monetary or other valuable consideration, as well as the disclosure of information we hold about you for the purposes of cross-contextual advertising. This definition does not extend to all disclosures of personal information. We do not knowingly sell or share the personal information of children under the age of 16.

GSMA does not sell your personal information for monetary consideration. However, we may share personal information collected during the Event or through your interactions with our websites with non-affiliated third-party websites, social media networks and advertising technology companies for the purposes of cross-contextual behavioural advertising — that is, to deliver personalised marketing to you based on your activity across different websites, platforms and services.

We disclose personal information to social media networks and advertising technology companies — including those operating on our websites — who combine that information with data they have collected about your visits to other websites, or that they otherwise hold about you, in order to deliver more tailored advertising to you. This takes place through the use of cookies, pixels, tags, application programming interfaces (APIs), scripts and similar technologies.

Categories of personal information we may share for cross-context behavioral advertising:

Device identifiers;
Internet Protocol (IP) addresses;
Geolocation data, such as device location and IP location;
Internet browsing and search history, or interaction with a website application or advertisement.

If you wish to opt out of the sharing of your personal data for cross-context behavioral advertising, please indicate such preference by selecting appropriate settings in the cookie banner visible on the website.

As described in Section 3(8), we may share your personal information with our partners for organisational and commercial purposes in connection with summits and conferences held at the Event. This includes sharing information to facilitate your attendance at sessions, to send you communications related to a summit or conference, and to enable partners who organised a summit or conference to invite you to stay in touch with them following the Event.

Categories of personal information we may share with summit partners:

Identifiers such as name, email address, phone number, country/region, address, and professional or employment-related information such as company name, job title, job level, area of responsibility, company industry type, areas of interest.

If you wish to opt out of the sharing of your personal data with our partners, please contact us at dataprivacy@gsma.com.

14. Contact us

You can contact us with any enquiry relating to your personal data by filling out this form, sending an email to dataprivacy@gsma.com or writing to:

Data Privacy – Legal
GSMA Ltd LLC, 1 Angel Lane,
London, EC4R 3AB
United Kingdom