When a business uses HubSpot's software, HubSpot stores and processes that business's customer list (including your email and contact details) on the business's behalf. The business — not HubSpot — is responsible for making sure it had your permission to put your data there.
Your email address, phone number, and interaction history may be stored in HubSpot's CRM by a business you've dealt with, without HubSpot being the entity responsible for obtaining your consent — making it harder to know who to contact if you want your data removed.
Cross-platform context
See how other platforms handle Dual Controller-Processor Model for Contact Data and similar clauses.
Compare across platforms →This means your personal data could be inside HubSpot's systems even if you've never directly signed up for HubSpot, and the business that uploaded it is the one legally responsible for having your consent.
(1) REGULATORY FRAMEWORK: This provision implicates GDPR Art. 4(8) (processor definition), Art. 28 (processor obligations and contractual requirements), Art. 29 (processing under controller authority), and Art. 82 (liability). Under CCPA §1798.140(ag), HubSpot functions as a 'service provider,' which limits its liability for onward use only if it contractually restricts its own use of the data. The primary enforcement authorities are EU/EEA national Data Protection Authorities, the UK ICO, and the California Privacy Protection Agency (CPPA). (2)
Compliance intelligence locked
Regulatory citations, enforcement risk, and due diligence action items.
Watcher: regulatory citations. Professional: full compliance memo.