This new provision explicitly discloses HubSpot's reliance on legitimate interests as a legal basis under GDPR, providing transparency about processing activities that may not require explicit consent.

This separated provision provides more detailed and structured disclosure of third-party sharing practices, including explicit requirement that third parties comply with legal obligations, which was previously embedded in a broader provision.

This standalone high-severity provision was replaced by separate, more granular provisions on data sharing and advertising tracking; the removal of the explicit high-severity classification may indicate reduced emphasis on third-party sharing risks.

This provision addressing product improvement, analytics, and personalization is no longer explicitly stated, though similar practices may now be covered under the new 'Legitimate Interests' provision or implied in other sections.

Simplified and clarified the controller-processor relationship, removing references to 'Customer Data' and 'Contacts' terminology in favor of more standardized 'personal data' language, and emphasized regulatory compliance responsibility.

Removed reference to Privacy Shield framework and simplified to focus on SCCs and equivalent mechanisms; added Switzerland explicitly; removed the 'at least one of' multiple safeguards language in favor of a more singular approach.

Removed detailed technical cookie definition, completed the truncated text about browser instructions, added explicit warning about service limitations if cookies are refused, and integrated third-party advertising partner disclosure into this provision.

Broadened from GDPR-specific (EEA/UK only) to location-agnostic language ('depending on your location and subject to applicable law'), completed the truncated list with explicit rights including objection, restriction, portability, and consent withdrawal, and provided a specific contact email address.

Added explicit reference to CCPA as 'amended by' CPRA, simplified 'use, disclose, and sell' to just 'collect', added new right to correct inaccurate personal information (CPRA-specific), and reworded non-discrimination right from 'for exercising' to 'against for exercising'.

Removed the parenthetical example explaining legal obligations retention and changed terminology from 'personal information' to 'personal data'; severity downgraded from medium to low.