UAE PDPL and exhibition lead capture: the consent checklist most stands skip
A usable consent record holds three facts for every lead: the wording the visitor saw, a timestamp and the device they used. A business-card fishbowl and a clipboard hold none of them, and the checklist below compares both with a badge scanner and a game across 7 requirements.
This post is practical guidance, not legal advice. The consent features described here are in line with UAE PDPL and GDPR-style practice, and the post covers what a stand can record and decide before the show. Ask your own adviser to read your privacy notice and your follow-up plan before you rely on either.
What a usable consent record contains
When a visitor asks "How did you get my email?", you want an answer you can show, not one you have to remember. A usable consent record gives it in three parts.
The first is the text version shown: the exact wording the visitor saw when they ticked the box, because wording changes between shows. The second is a timestamp, which also tells you when that person stood at your stand. The third is the device, which ties the tick to a real phone instead of a row typed in later.
Every lead in the export from BoothBuzz carries these three facts. The visitor scans the QR, enters name, email, mobile, company and your custom questions, ticks consent and plays for 60 seconds. The whole flow is described in how BoothBuzz works.
Why a fishbowl and a clipboard have no record
A fishbowl collects business cards. A card says nothing about what the visitor agreed to, when they dropped it in, or whether they wanted marketing. Someone types the cards into a sheet days later, and the sheet shows an email address with no history behind it.
A clipboard is better because visitors write their own details, but it has gaps of its own. Spellings go wrong, handwriting is illegible, and the next visitor can read the lines above theirs. The sheet also carries no per-person timestamp, and a tick column records a tick without the wording that was shown.
A badge scanner is different again. Nothing is asked of the visitor, so many walk past, and the scan gives you badge data only, in limited fields, under a licence per show. For what a scan covers, check your exhibitor manual. The longer comparison is in badge scanner vs a lead capture app.
The marketing opt-in: separate and never pre-ticked
Playing a game for a prize and agreeing to marketing are two different decisions. Keep the marketing opt-in as its own tick that the visitor makes themselves, never pre-ticked.
In BoothBuzz the consent tick sits in the sign-up form and the marketing opt-in is its own tick, never pre-ticked. Each lead carries both records, so you can filter your Excel file to the people who said yes to marketing.
For visitors who did not tick it, plan a narrower first message, such as their prize result or the answer to the question they asked at the stand, and ask your adviser what that message may cover. The first week after the show is covered in the lead follow-up playbook.
The checklist: fishbowl, clipboard, badge scanner and game
Use this table when you plan your stand. A cell that says "your rule" means the tool gives you nothing, so your own process has to carry the requirement.
| Requirement | Fishbowl | Clipboard | Badge scanner | Game |
|---|---|---|---|---|
| Consent record: text version shown, timestamp, device | None | None, unless staff note them for every person | Check your exhibitor manual | Recorded for every lead |
| Separate marketing opt-in, never pre-ticked | None | Only if you add a tick column | Nothing asked of the visitor | Its own tick, never pre-ticked |
| Visitor types their own details | No, cards are retyped later | Yes, but with misspelt emails and illegible writing | No, badge data in limited fields | Yes, on their own phone |
| Other visitors cannot read earlier entries | Cards sit in an open bowl | No, earlier lines are visible | Check your exhibitor manual | Yes, and the leaderboard never shows emails or phone numbers |
| Consent record travels with the lead in the export | No export | No, someone types the sheet up | Check your exhibitor manual | Yes, in the lead export |
| Hosting location stated in your privacy notice | Your rule: state where you type the cards up | Your rule: state where you type the sheet up | Check your exhibitor manual | Ask where the data is hosted, then name it |
| Retention rule | Your rule | Your rule | Check your exhibitor manual | 90 days after the event, 365 days after download |
The hosting row is deliberate. Your privacy notice should say where lead data is hosted. Confirm the hosting country of every tool you use, and write it into the notice before the show.
Retention and deletion: set the rule before you download
The BoothBuzz retention windows are 90 days after the event and 365 days after download. The data belongs to you, which also means that a downloaded Excel, CSV or PDF file is your copy under your rule from the moment you save it.
Write your own retention period into your privacy notice and put the deletion day in a calendar. When that day comes, delete from laptops, shared drives and CRM imports, not only the dashboard. Keep a short do-not-contact list of the emails that asked to stop, so a deleted person is not added again after the next show. If a visitor asks you to delete their details, act on it in your own files, and ask any provider how it handles the same request.
Consent is what makes the next conversation easy
A consented contact is one you can get in touch with next week without an awkward opening. Call only where the visitor gave a mobile for calls, and stay within what the consent wording said. That is the networking side of this checklist, and it follows from how a game changes the order of a stand conversation.
Normally a staff member intercepts a stranger and the conversation starts cold. With Gem Rush or Flip Match, the two games BoothBuzz offers, the visitor opts in first and gives a real name and email as the price of playing. Your staff member then opens with the visitor's own score instead of a pitch. Here is a template, not a quote from a real call: "Hello [name], you were [rank] on our board on [day] at [time], and you ticked the box to hear from us. You asked about [topic]. Is now a good moment?"
The leaderboard does three jobs a form cannot. It gives a visitor a reason to return and defend their rank, a reason to fetch a colleague and beat them, and a prize draw held in public, where you are the host and not the seller. Each lead then reaches your spreadsheet with the talking already begun, the time of the visit attached, and a record that they agreed to hear from you.
A consent check to run before the show
Until the start date, anyone opening the public link sees a Coming soon page, while your staff can enter a password and play the real game. That lets your team read every screen a visitor will meet. Use the window for six checks:
- Read the consent wording as a visitor would, in each language your visitors will use: the player screens come in English, Arabic (right to left), Spanish and Mandarin Chinese.
- Confirm the marketing tick starts empty.
- Decide who may contact whom, and about what, for visitors who did not opt in to marketing.
- Ask where the data is hosted and write that location into your privacy notice.
- Set your retention period and put the deletion day in a calendar.
- Brief staff to open follow-up with the visitor's score and visit, not with "we found your email".
Where this checklist stops
The table helps you collect and record. It does not replace advice on what your privacy notice should say or how long you should keep data. Those are questions for your own adviser, and this post is practical guidance, not legal advice.
FAQ
Who owns the data collected by an exhibition lead capture game?
With BoothBuzz the data belongs to the exhibitor. You download every lead as Excel, CSV or PDF from your dashboard, and you stay responsible for how you use it under your own privacy notice.
How long is exhibition lead data kept?
BoothBuzz retention is 90 days after the event and 365 days after download. Set your own retention period for the files you download and write it into your privacy notice.
Where is my exhibition lead data hosted?
Your privacy notice should say where lead data is hosted. Confirm the hosting country of every tool you use, get it in writing rather than relying on a brochure, and write it into the notice before the show.
Can I email everyone who played my exhibition game?
Send marketing only to the visitors who ticked the separate marketing opt-in. For the rest, keep the first message to what they expected at the stand, such as their prize result, and ask your adviser what that may cover.
Choose Gem Rush or Flip Match for your next stand, and read the pricing before you decide.