Back to overview
August 31 2018Legal matters

Don´t fear business cards

Generating leads at trade fairs and GDPR

With no other marketing instrument is it as easy to establish personal contacts with customers, cooperation partners and the media as it is at trade fairs. The acquisition of new customers for exhibitors is one of the most important goals of their trade fair participation. Accordingly, exhibitors at trade fairs collect a lot of personal data, so that the question regularly arises as to how the new contacts can be used in compliance with data protection regulations.

How are contacts established at trade fairs?

As a rule, contact with the new customer begins with a personal meeting with the stand personnel. In the further course of the event, the visitor may give the exhibiting company his contact details. This can be done by handing over a business card, by including the contact data in a lead sheet of the exhibitor or by electronic data entry by the exhibitor, e.g. by business card scan, direct entry into the company CRM or scanning a visitor bath. The mere transfer of a business card or the handwritten recording of contact data does not constitute processing of personal data within the meaning of the GDPR, so that the data protection law does not apply here. Ultimately, however, the data is regularly recorded in the exhibitor's electronic CRM system, so that the contact data is also recorded electronically here. If individual business cards, e.g. because the contact is not interesting for the company or the contact already exists, are disposed of after the trade fair, the company will not be subject to any data protection obligations.

When is the collection of visitor data legal?

If visitor data is recorded electronically and thus processed automatically, the scope of the General Data Protection Rule (GDPR) is opened up. It stipulates that processing is generally prohibited unless it is expressly permitted by law. Even if this sounds threatening at first, the legislator has created far-reaching grounds for permission in Art. 6 (1) GDPR. In connection with trade fairs, the following grounds for authorisation are particularly important:
The data subject has given his or her consent.
Processing is necessary for the fulfilment of a contract to which the data subject is a party or for the implementation of pre-contractual measures which are taken at the request of the data subject.

A balance between exhibitor and visitor interests shows that the exhibitor's interests prevail.
As visitors regularly pass on their own data to the exhibitor at the trade fair stand, it can be assumed that the exhibitor has given his consent to the electronic recording of such data (also possible orally or by implied action). However, it is difficult to prove that consent has not been given in writing. As a rule, however, the exhibitor can also invoke the weighing of interests as the norm for permission. A legitimate interest of the exhibitor may also be, for example, the use of contact data for advertising purposes.

The duty to provide information

New since the GDPR came into force are the extensive information obligations imposed on companies. In order to comply with this obligation, companies should send a confirmation e-mail to the visitor immediately after electronic contact has been established in which the visitor is informed about the storage of his personal data, referred to the company's data protection declaration via a link and informed of the right of objection.

Is advertising permitted?

Even if the contact data may be used for advertising purposes from a data protection point of view, the exhibitor must also note that according to §7 UWG an advertising address by e-mail or telephone is only possible with the prior express consent of the person concerned. If the exhibitor wishes to send the visitor advertising such as the company newsletter by e-mail after the trade fair, he should obtain a declaration of consent beforehand. Here, a simple click on a consent button within the mail, which is necessary anyway due to the information obligations, can be sufficient to legally secure the future sending of advertising e-mails.


When collecting visitor data, companies should ensure that a well-prepared email is subsequently sent to the visitor in order to comply with the data protection information obligations and obtain express advertising consent. This follow-up e-mail can then also be used immediately to ensure follow-up after the trade fair appearance and to maintain the newly established contacts.

We have placed cookies on your device to give you the best experience and to improve our website.
If you continue to browse on this site, we’ll assume you’re OK to proceed. More information