Using trade event and business databases responsibly

Fibvo editorial · 8 January 2026 · 5 min read

An email arrives offering the complete visitor list from a large logistics exhibition. Or a sales team downloads a business directory and loads every entry into the CRM. Both feel like efficient prospecting. But what you may do with a list depends on where it came from, what the people on it were told and how long you keep it. Settle those questions before you import anything.

Know what kind of data you are holding

Sort what you hold into three groups.

• Company information, such as a firm's name, address and sector from an exhibitor directory. This is generally lower risk, but in a proprietorship the business details are also one person's details.
• Personal data about people at work, such as a named manager's email address, mobile number and job title. India's DPDP Act and the EU and UK GDPR treat this as personal data, even when it is used for business.
• Data someone else collected, such as a bought or scraped list. You inherit every problem with how it was gathered, usually without knowing what those problems are.

Many organisers warn exhibitors that offers to sell attendee lists are not authorised, and some are scams. Even a genuine list carries no evidence that the people on it agreed to hear from you.

Write down where each list came from

Give every list a short source record before it goes into your CRM or email platform.

• The source: the event, directory, website or seller, with a link or a note of where to find it.
• The date you obtained it and the person who brought it in.
• How it was collected: copied from a public exhibitor directory, scanned at your own stand, shared by the organiser or bought.
• What the source said about use, such as the directory's terms or the notice visitors saw when they registered.
• The purpose you are keeping it for, such as follow-up after a named show.

If you are offered a bought list, ask the seller where the details came from and what the people on it were told. A seller who cannot answer is handing you the problem along with the file. Set aside any list whose source you cannot explain.

Where a list came from decides what you are allowed to do with it.

Check the organiser's terms and visitor notice before importing

Organisers publish exhibitor directories so that companies can find each other. The terms of use often allow looking up firms but restrict copying, bulk downloads or reuse for mass mailings. Read them before anyone exports or retypes the entries. Within those terms, a directory is a sound way to find firms in your market.

Badge scans and lead-retrieval apps work differently. The notice visitors see at registration usually explains that a scan shares their details with that exhibitor, and it may say what exhibitors can use them for. A scan lets you follow up on the conversation at your stand. It does not make the person a newsletter subscriber, and it does not let you pass their details to anyone else.

To reach visitors you did not meet, ask the organiser what they offer. Many run pre-show mailings or app notifications to registered visitors who agreed to hear from exhibitors.

For contacts in India, the DPDP Act's notice and consent duties are being phased in under the DPDP Rules 2025. The Act has no general legitimate-interest ground for marketing, so where the notice people saw did not cover messages from you, consent is the safe basis to plan for. For contacts in the EU or UK, if you did not collect the data from the person, you must tell them where it came from, at the latest in your first message. This is general guidance, not legal advice.

Give every imported list a deletion date

Data kept in case it is useful one day is the data most likely to be leaked, misused or mailed by mistake. As its duties are phased in under the DPDP Rules 2025, the DPDP Act will expect personal data to be erased once its purpose is served or consent is withdrawn, and GDPR already limits how long you may keep data.

• Set a review date when the list is imported, tied to its purpose. Follow-up from a show is a matter of weeks or months, not years.
• On that date, keep the contacts who replied, became customers or joined your list themselves. Delete the rest.
• Delete from every copy: the CRM, the email platform, shared drives, exported spreadsheets and salespeople's phones.
• Limit who can export contacts.

Honour removal requests wherever the data sits

Sooner or later someone will ask you to stop contacting them, delete their details or explain where you found them. Have the process ready before the first request.

• Say in your first message how you found the person and how they can stop hearing from you.
• When someone asks where you got their details, answer from your source record, including the seller's name if you bought the list.
• Log each request with its date and channel, act on it within a short internal deadline, and tell the person when it is done.
• Remove the person from every system and every channel. Someone who unsubscribes from email should not start receiving calls or WhatsApp messages.
• Keep only their email address or phone number on a suppression list, so they are not added back from the next list, and check every new import against it.
• WhatsApp's business messaging policy requires people to opt in before you message them, so a directory number is not permission.

---

Written by Fibvo — Bengaluru and Erode, India — working with clients in other time zones. Questions, or think we have it wrong? Tell us.