Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that HubSpot collects professional personal data including business contact information from public sources, third-party providers, and its own customers, and distributes this data to other HubSpot customers for sales and marketing use through enrichment product features.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes HubSpot's role as a controller of a commercial dataset of professional personal data that is collected from individuals who are not direct HubSpot users and made available to paying customers. The policy relies on legitimate interests as the legal basis for this processing, asserting that people would expect their work-related data to be shared in this way.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Under this clause, personal data including email addresses, phone numbers, job titles, and physical addresses sourced from public records, third parties, and HubSpot customers may be included in a commercial dataset and distributed to HubSpot customers for sales and marketing outreach without direct notice to the individual. Individuals can request removal from the commercial dataset by submitting the opt-out form linked in the policy.
Cross-platform context
See how other platforms handle Enrichment Product Commercial Dataset and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"HubSpot collects business contact and similar professional data from various sources, including publicly available sources, third party providers, and customers who use our enrichment products. This information powers our commercial dataset. We provide information from our commercial dataset to customers who choose to use enrichment products within the Subscription Services as part of their sales, marketing, and other business activities. If you'd like to remove your Personal Data from our commercial dataset, complete and submit this form.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Articles 6(1)(f) and 14 (information obligations for data not collected directly from the data subject), CCPA provisions regarding sale or sharing of personal information, and the UK GDPR equivalent provisions. The legitimate interests basis for collecting and distributing professional personal data to third-party customers requires a documented balancing test under GDPR. GDPR Article 14 requires that individuals whose data is collected from third parties be informed of the processing within one month unless an exemption applies. The FTC Act Section 5 governs unfair or deceptive data broker practices. 2. GOVERNANCE EXPOSURE: High. The enrichment dataset operation involves collection of personal data from individuals with no direct relationship with HubSpot and commercial distribution of that data to customers. The policy's assertion that legitimate interests apply because people would expect work-related data to be shared is a substantive legal claim that may face challenge in GDPR enforcement contexts, particularly for data categories beyond standard business contact information. 3. JURISDICTION FLAGS: EEA and UK individuals whose professional data is included in the dataset have Article 14 rights to be informed and Article 21 rights to object to processing on legitimate interests grounds. California residents have CCPA rights regarding sale or sharing of their personal information. Illinois, New York, and other state-level privacy frameworks may impose additional notice or opt-out obligations. 4. CONTRACT AND VENDOR IMPLICATIONS: HubSpot customers using enrichment products should assess whether their use of purchased professional contact data complies with applicable privacy law in their target jurisdictions, and whether their data processing agreements with HubSpot adequately address their controller obligations for data sourced from HubSpot's commercial dataset. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should evaluate whether HubSpot's Article 14 notice obligations are met for EEA and UK residents in the commercial dataset, whether the legitimate interests balancing test is documented and defensible, and whether the opt-out mechanism is operationally effective and timely. Data broker registration requirements in states such as California, Vermont, and Texas may apply to this operation.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes HubSpot's role as a controller of a commercial dataset of professional personal data that is collected from individuals who are not direct HubSpot users and made available to paying customers. The policy relies on legitimate interests as the legal basis for this processing, asserting that people would expect their work-related data to be shared in this way.
Under this clause, personal data including email addresses, phone numbers, job titles, and physical addresses sourced from public records, third parties, and HubSpot customers may be included in a commercial dataset and distributed to HubSpot customers for sales and marketing outreach without direct notice to the individual. Individuals can request removal from the commercial dataset by submitting the opt-out form …
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.