Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that HubSpot has certified under the EU-U.S. Data Privacy Framework, UK Extension, and Swiss-U.S. DPF, and that in the event of conflict between the Privacy Policy and DPF Principles, the DPF Principles govern. The U.S. FTC is identified as the enforcement authority for DPF compliance.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes HubSpot's primary cross-border transfer mechanism for EEA, UK, and Swiss personal data, identifies the FTC as the enforcement authority for DPF compliance, and commits HubSpot to a 45-day complaint resolution timeline with escalation paths through EU data protection authorities, the UK ICO, and the Swiss Federal Data Protection and Information Commissioner, including binding arbitration as a last resort.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Under this clause, EU, UK, and Swiss residents whose personal data is transferred to HubSpot's U.S. operations have rights to access, correction, amendment, and deletion of their data, and can escalate unresolved complaints to their respective data protection authority or through binding arbitration. The policy states that complaints submitted to privacy@hubspot.com will be investigated and addressed within 45 days.
Cross-platform context
See how other platforms handle International Data Transfers and Data Privacy Framework and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"HubSpot complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF"), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework ("Swiss-U.S. DPF") as set forth by the U.S. Department of Commerce (collectively "the Data Privacy Framework"). HubSpot has certified to the U.S. Department of Commerce that it adheres to the EU-US DPF Principles with regard to the processing of Personal Data received from the European Union, and the United Kingdom (and Gibraltar) and to the Swiss-US DPF Principles with regard to the processing of Personal Data received from Switzerland. If there is any conflict between this Privacy Policy and the DPF Principles, the DPF Principles will govern.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision directly engages the EU-U.S. Data Privacy Framework (established under GDPR adequacy decision), UK GDPR international transfer requirements, Swiss Federal Act on Data Protection international transfer provisions, and FTC Act enforcement jurisdiction. The policy also references Standard Contractual Clauses and UK Addendum as supplementary transfer mechanisms for third-party transfers not covered by the DPF. 2. GOVERNANCE EXPOSURE: Medium. The DPF certification provides a recognized legal transfer mechanism, but the DPF's adequacy determination has faced and may continue to face legal challenges in EU courts. HubSpot's reliance on SCCs as a backup mechanism is standard practice. The 45-day complaint resolution commitment is operationally specific and creates a measurable compliance obligation. 3. JURISDICTION FLAGS: EEA, UK, Switzerland, and Canada are explicitly addressed. For Canada, HubSpot states it is subject to the regulatory enforcement powers of the Office of the Privacy Commissioner of Canada. The policy notes that HubSpot may be required to disclose personal data in response to lawful requests by public authorities including for national security purposes, which is a known limitation of DPF protections. 4. CONTRACT AND VENDOR IMPLICATIONS: B2B customers transferring personal data to HubSpot from the EEA, UK, or Switzerland should confirm that their data processing agreements reference the appropriate transfer mechanisms (DPF, SCCs, or UK Addendum) and that their own transfer impact assessments account for HubSpot's U.S. data processing operations. 5. COMPLIANCE CONSIDERATIONS: Compliance teams should monitor the status of the EU-U.S. DPF adequacy decision given ongoing legal proceedings, maintain SCCs as a fallback mechanism, and ensure that the 45-day complaint resolution process is operationally implemented. The national security disclosure carve-out should be disclosed to data subjects where required by applicable law.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes HubSpot's primary cross-border transfer mechanism for EEA, UK, and Swiss personal data, identifies the FTC as the enforcement authority for DPF compliance, and commits HubSpot to a 45-day complaint resolution timeline with escalation paths through EU data protection authorities, the UK ICO, and the Swiss Federal Data Protection and Information Commissioner, including binding arbitration as a last …
Under this clause, EU, UK, and Swiss residents whose personal data is transferred to HubSpot's U.S. operations have rights to access, correction, amendment, and deletion of their data, and can escalate unresolved complaints to their respective data protection authority or through binding arbitration. The policy states that complaints submitted to privacy@hubspot.com will be investigated and addressed within 45 days.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.