GDPR-compliant lead capture at events in the EU.
Last updated
5 min readThis guide is general information for people who run stands. It is not legal advice, and rules differ between countries and situations. Ask your data protection officer or a lawyer about your case.
In short
To capture leads at an event under the GDPR, tell people what you will do with their details when you collect them, rely on a lawful basis you can name, collect only what you need, record what they agreed to, keep it only as long as you need it, and be able to find and delete one person's data on request.
Who is responsible for what.
At your stand your organisation decides why and how the details are used, which makes it the controller. A tool such as 1Namecard that stores them on your behalf is a processor, and should be bound by a data processing agreement (Article 28). The show organiser may be a controller too, for the badge data it collects. That data is theirs, and what you may do with it depends on what the visitor agreed to when registering.
1Namecard's data processing addendum is part of the terms for every plan and lists the sub-processors.
Pick a lawful basis for each purpose.
You need a lawful basis (Article 6) for every purpose, and your notice should say which one you use. Two come up most often at events.
Consent. The person agrees clearly, by a positive action, to a stated purpose, and can withdraw as easily as they gave it. Use it for marketing e-mail or for sharing details with others.
Legitimate interests. You have a business reason, you need the data for it and the person's rights do not outweigh it. It can cover a reply to an enquiry the visitor made at your stand. Write down a short balancing test.
Marketing e-mail adds a second layer. The ePrivacy rules, applied differently in each Member State, often require consent before you send it, and some countries treat company addresses differently from personal ones. Check the rules of the countries you will write to. A separate, unticked box for marketing keeps the choice clear.
Tell people when you collect.
Article 13 requires you to give certain information at the moment you collect details: who you are, why you use the data and on what basis, who receives it, how long you keep it and what rights the person has. At a stand the practical answer is a short line on the form with a link to your full privacy notice.
- Included: Who is collecting: your organisation's name.
- Included: Why, in one line, for example 'so that we can reply to your enquiry'.
- Included: A separate checkbox, unticked, for marketing e-mail.
- Included: A link to your privacy notice.
Collect only what you need.
Data minimisation (Article 5) means asking for the smallest set of details that does the job. For most B2B follow-up that is a name, a work e-mail address and a company. Make a phone number optional, and do not ask for anything you will not use.
Keep a record of what each person agreed to.
If you rely on consent, you must be able to show it (Article 7). That means keeping the wording the person saw, when they agreed and where. A spreadsheet of names cannot show that, and neither can a pile of paper cards or photographs of them.
Decide how long you keep leads.
Keep personal data no longer than the purpose needs. There is no single period. Write down one you can justify, review leads that have gone nowhere and delete them. Someone who asks you to stop contacting them should stay on a short suppression list, so that you do not contact them again by mistake.
Be ready for requests.
People can ask to see their data, correct it, have it erased or object to direct marketing (Articles 15 to 21). You generally have one month to respond (Article 12), and the right to object to direct marketing is absolute. You need to find everything about one person quickly, across your CRM, your mailbox and your spreadsheets.
In 1Namecard an admin can delete all data for one e-mail address in a click, and a connected CRM such as HubSpot is asked once to delete the contact too. Backups taken before the deletion are not changed, and alerts, e-mails and webhooks already sent stay where they arrived, so delete those copies as well.
1 click
for an admin to delete all data for one e-mail address in 1Namecard
Check where the data goes.
Hosting in the EU keeps storage in the EU. Also check the processors you rely on, and where their sub-processors and staff are, because transfers outside the EEA need a legal mechanism (Chapter V). 1Namecard stores and processes customer and lead data in Frankfurt, Germany, and the data processing addendum and the privacy page list its sub-processors and the mechanism for each transfer. The security page summarises the rest.
Paper, photos and badge scans count too.
The same rules cover a notebook, a photographed business card and a badge scan. A paper list left on a train can be a personal data breach. Prefer capture methods where the details go straight into a system with access controls, and avoid keeping copies on personal phones.
A checklist for your next show.
- Step 1.
Name the purposes you collect for, and a lawful basis for each.
- Step 2.
Put a short notice and a link to your privacy notice on the form.
- Step 3.
Keep marketing consent separate, unticked and optional.
- Step 4.
Ask only for the fields you will use.
- Step 5.
Store the wording, version and time of each consent.
- Step 6.
Set a retention period and a date to review old leads.
- Step 7.
Know who can find and erase one person's data, and how fast.
- Step 8.
Sign a data processing agreement with every tool that holds the data.
- Step 9.
Ask the organiser what visitors agreed to before you use badge scan data.
The full text of the regulation is on EUR-Lex. For how lead capture works in practice, read how to capture and follow up trade show leads.
Quick answers.
Do I need consent to follow up a lead from a trade show?
Not always. Replying to an enquiry the person made at your stand can rest on legitimate interests, depending on your situation. Sending marketing e-mail often needs consent under national ePrivacy rules. Ask your data protection officer or a lawyer about your case.
Is it enough to host lead data in the EU?
No. EU hosting helps, but the GDPR also covers why you collect data, what you tell people, how long you keep it and how you handle requests. It applies to the processors you use as well.
Can I use the organiser's badge scan data for marketing?
Only as far as the organiser's terms and the visitor's registration allow. Ask the organiser what the visitor agreed to before you add scanned contacts to a marketing list.