Legitimate Interests as a Legal Basis for Processing

What it is

HubSpot uses a legal basis called 'legitimate interests' to process your personal data for purposes like sending you marketing content, conducting research, and improving its products, without requiring your separate consent for each use.

Why it matters (compliance & governance perspective)

Legitimate interests is a flexible legal basis that does not require your consent but is subject to a balancing test. Individuals in the EU and UK have the right to object to processing based on legitimate interests.

Consumer impact (what this means for users)

HubSpot may send you marketing communications or analyze your usage data based on legitimate interests rather than explicit consent, particularly if you are not an EU or UK user. EU and UK users can object to this processing by contacting HubSpot at privacy@hubspot.com.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages GDPR Article 6(1)(f) (legitimate interests as a legal basis) and the associated balancing test requirements, enforced by EU supervisory authorities. The provision also implicates GDPR Article 21 (right to object to processing based on legitimate interests). Legitimate interests processing for direct marketing purposes is subject to specific restrictions under GDPR Recital 47 and the ePrivacy Directive. The FTC may view reliance on legitimate interests for data uses that consumers would not reasonably expect as a potential unfair or deceptive practice under US law. GOVERNANCE EXPOSURE: Medium. Reliance on legitimate interests is common in the industry but requires a documented balancing test demonstrating that the processing purpose does not override data subjects' rights. If HubSpot has not completed and documented these assessments, this creates regulatory exposure with EU supervisory authorities. The use of legitimate interests for marketing-adjacent processing (such as product improvement and market research) may be particularly scrutinized. JURISDICTION FLAGS: EU/EEA and UK users have a statutory right to object to legitimate interests processing, and HubSpot must cease processing upon a valid objection unless it can demonstrate compelling legitimate grounds. This right must be communicated clearly. Outside the EU/UK, legitimate interests has no direct statutory equivalent, but analogous considerations apply under US state privacy laws' frameworks for required purposes. CONTRACT AND VENDOR IMPLICATIONS: Business customers should verify that HubSpot's legitimate interests processing does not extend to data uploaded by the customer (where HubSpot is a processor), as that would require the customer's instruction or separate legal basis. Data Processing Agreements should clearly delineate the scope of permitted processing purposes to avoid unauthorized use of customer data. COMPLIANCE CONSIDERATIONS: Compliance teams should request HubSpot's Legitimate Interests Assessment (LIA) documentation for processing activities relying on this basis, particularly for marketing and analytics uses. Privacy notices should clearly identify which processing activities rely on legitimate interests and provide opt-out or objection mechanisms. For business customers, DPA terms should confirm that HubSpot does not rely on legitimate interests to process customer-uploaded data for its own purposes.

Applicable agencies

Provision details

Other risks in this policy

• Dual Controller/Processor Framework high
• International Data Transfers via Standard Contractual Clauses medium
• Cookies and Advertising Tracking medium
• Data Subject Rights Request Process medium
• Data Sharing with Third-Party Service Providers and Partners medium
• CCPA California Resident Rights and Data Sale Opt-Out medium