Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that in the event of a merger, acquisition, or bankruptcy, all personal data collected by HubSpot would transfer to the acquiring entity, with notification provided to users via email or website notice.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes the transfer of all collected personal data to a successor entity in a corporate transaction, and commits to notifying users of any resulting changes in data ownership and use. The provision does not specify a timeline for notification or describe what choices would be available to users following a transfer.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Under this clause, all personal data collected by HubSpot including account information, usage data, and Customer Data held as a processor would transfer to an acquiring company in a corporate transaction. The policy states that users will be notified and informed of their choices, but does not specify the notification timeline or what those choices would include.
Cross-platform context
See how other platforms handle Corporate Acquisition Data Transfer and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"If we (or our assets) are acquired by another company, whether by merger, acquisition, bankruptcy or otherwise, that company would receive all information gathered by HubSpot on the websites and the Subscription Service. In this event, you will be notified via email and/or a prominent notice on our website, of any change in ownership, uses of your Personal Data, and choices you may have regarding your Personal Data.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR requirements for lawful basis of processing following a transfer of data controller responsibilities, CCPA provisions regarding changes in data use following a business transaction, and FTC guidance on honoring privacy promises in corporate transactions. The FTC has brought enforcement actions against companies that materially changed data use practices following an acquisition without adequate user notice or consent. 2. GOVERNANCE EXPOSURE: Low. The provision includes a notification commitment, which is consistent with FTC guidance and GDPR requirements for informing data subjects of changes in controller identity. The provision does not specify whether users will have an opportunity to delete their data or withdraw consent prior to the transfer. 3. JURISDICTION FLAGS: EEA and UK users may have GDPR rights to object to or request deletion of their data before or after a transfer of controller responsibilities. California residents have CCPA rights to know about changes in data use following a business transaction. 4. CONTRACT AND VENDOR IMPLICATIONS: B2B customers who have entered into data processing agreements with HubSpot should assess whether those agreements address assignment of DPA obligations in the event of a corporate transaction and whether successor entity obligations are contractually specified. 5. COMPLIANCE CONSIDERATIONS: Legal teams should assess whether the notification commitment described is operationally feasible (email notification to all users) and whether data deletion or opt-out rights would be offered to users following a transfer. In GDPR contexts, a new processing notice and potentially a new legal basis assessment may be required if the successor entity's data use materially differs from HubSpot's current practices.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision authorizes the transfer of all collected personal data to a successor entity in a corporate transaction, and commits to notifying users of any resulting changes in data ownership and use. The provision does not specify a timeline for notification or describe what choices would be available to users following a transfer.
Under this clause, all personal data collected by HubSpot including account information, usage data, and Customer Data held as a processor would transfer to an acquiring company in a corporate transaction. The policy states that users will be notified and informed of their choices, but does not specify the notification timeline or what those choices would include.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.