HubSpot shares your personal data with vendors, advertising companies, and other partners who help operate its services, subject to contractual requirements that they protect the data.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Sharing personal data with advertising partners in particular expands the number of organizations that may have access to your information, which increases privacy risk and may involve cross-context behavioral advertising.
Removal of general third-party sharing provision may reduce transparency, though advertising sharing was separately added in more detailed form.
View full change record →This separated provision provides more detailed and structured disclosure of third-party sharing practices, including explicit requirement that third parties comply with legal obligations, which was previously embedded in a broader provision.
View full change record →Your personal data may be shared with a range of third-party vendors and advertising partners, meaning entities beyond HubSpot may store and use your information. HubSpot states it requires these parties to protect your data, but the practical enforcement of those contractual requirements is not independently verifiable by individual consumers.
How other platforms handle this
At Ledger, earning and maintaining our users' trust is a top priority. That's why we are deeply committed not only to protecting your privacy and securing your personal data, but also to being fully transparent about how we handle it.
If you are located in the European Economic Area, Switzerland, or the United Kingdom, you have the right to access, correct, or erase your personal data; the right to restrict or object to our processing of your personal data; the right to data portability; and, where our processing is based on your...
We use information to enhance the quality, reliability, and/or accuracy of our AI Features by creating, developing, training, testing, improving, and maintaining AI and ML models run by Strava or our service providers. We use aggregated, de-identified data for this purpose. We also use personal info...
Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"We may share your personal data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. We may also share your personal data with advertising partners to display relevant advertising to you. We require all third parties to respect the security of your personal data and to treat it in accordance with the law.— Excerpt from HubSpot's HubSpot Privacy Policy
REGULATORY LANDSCAPE: This provision engages GDPR Article 28 (processor contracts) and Article 6 (lawfulness of sharing), enforced by EU supervisory authorities. Under CCPA/CPRA, sharing personal data with advertising partners for cross-context behavioral advertising is a regulated activity subject to opt-out rights, enforced by the California Privacy Protection Agency. The FTC Act Section 5 applies to deceptive representations about third-party data sharing practices. GOVERNANCE EXPOSURE: Medium. The breadth of third-party sharing, particularly with advertising partners, is standard for SaaS marketing platforms but requires robust sub-processor management and disclosure. HubSpot's statement that it requires third parties to comply with the law is a standard contractual representation but does not independently verify the adequacy of third-party practices. JURISDICTION FLAGS: EU/EEA requires that all sub-processors be subject to data protection obligations equivalent to the main DPA, and sub-processor changes must be notified to business customers. California requires disclosure of categories of third parties with whom personal data is shared. Jurisdictions with comprehensive privacy laws increasingly require controller accountability for downstream processor practices. CONTRACT AND VENDOR IMPLICATIONS: Business customers should review HubSpot's sub-processor list and ensure they have approved or can object to sub-processor additions as required by their DPA. The policy's general statement about third-party contractual requirements should be verified against actual DPA terms, which may contain more specific obligations and audit rights. COMPLIANCE CONSIDERATIONS: Compliance teams should request HubSpot's current sub-processor list and establish a process for monitoring sub-processor changes. Privacy impact assessments may be warranted for high-risk sub-processors, particularly those involved in advertising technology. Business customers should confirm that their own privacy notices disclose HubSpot's sub-processors to the extent required by applicable law.
Full compliance analysis
Regulatory citations, enforcement risk, and due diligence action items.
Free: track 1 platform + weekly digest. Monitor: 25 platforms + same-day alerts. No credit card required.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
Sharing personal data with advertising partners in particular expands the number of organizations that may have access to your information, which increases privacy risk and may involve cross-context behavioral advertising.
Your personal data may be shared with a range of third-party vendors and advertising partners, meaning entities beyond HubSpot may store and use your information. HubSpot states it requires these parties to protect your data, but the practical enforcement of those contractual requirements is not independently verifiable by individual consumers.
ConductAtlas has identified this type of provision across 2 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.