Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The policy states that where applicable law does not require consent, HubSpot conducts marketing and advertising activities on the basis of legitimate business interests, and may combine data from third-party providers with other collected information for personalized communications and event promotion.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes legitimate interests as the default legal basis for marketing activities targeting individuals who have not provided explicit consent, and authorizes combination of third-party sourced data with HubSpot-collected data for personalized outreach. The provision is conditioned on legal requirements in applicable jurisdictions, acknowledging that consent will be obtained where law requires it.
Interpretive note: The policy does not describe the documented balancing test supporting legitimate interests for marketing, and the scope of 'where required by law' consent conditions varies by jurisdiction.
The updated policy now explicitly discloses that HubSpot collects Email Engagement Data (such as open, delivery, bounce, and click statuses) from emails sent through its Subscription Services using embedded tracking technologies. This represents formalization of a data collection practice into explicit policy language. However, the policy simultaneously removed a previously stated sentence directing users to a form for removing their personal data from HubSpot's commercial dataset. The updated terms do not indicate an alternative removal mechanism.
View change record →Under this clause, individuals who have not opted out of marketing may receive personalized communications based on combined data from HubSpot and third-party sources, unless they are in a jurisdiction where opt-in consent is required. Marketing opt-out is available by following the unsubscribe instructions in each HubSpot communication.
Cross-platform context
See how other platforms handle Legitimate Interests Basis for Marketing and Professional Data Processing and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Otherwise, we will market and advertise our products and services on the basis of our legitimate business interests. We may use information collected from third party service providers and other sources in combination with other information we collect through other means described in this Privacy Policy for the purposes of providing you with updates and improved services, personalized communications, event promotion, and to otherwise improve the user experience.Excerpt from HubSpot's Privacy Policy
1. REGULATORY LANDSCAPE: This provision engages GDPR Article 6(1)(f) legitimate interests requirements, including the requirement for a documented balancing test. Under GDPR, individuals have an absolute right to object to processing on legitimate interests grounds under Article 21, and HubSpot must cease processing upon receipt of such an objection unless compelling legitimate grounds can be demonstrated. Canada's PIPEDA and CASL impose opt-in consent requirements for commercial electronic messages. The FTC Act applies to deceptive marketing practices. 2. GOVERNANCE EXPOSURE: Medium. The blanket assertion of legitimate interests for marketing activities is permissible under GDPR where a documented balancing test supports it, but the policy does not describe the balancing test or its outcomes. For EEA and UK users, the right to object to legitimate interests processing is unconditional in certain contexts and must be operationally honored. 3. JURISDICTION FLAGS: EEA and UK users have GDPR Article 21 objection rights. Canada imposes opt-in consent for commercial electronic messages under CASL, which may conflict with a legitimate interests default. Australian users are subject to the Spam Act 2003 consent requirements. 4. CONTRACT AND VENDOR IMPLICATIONS: Third-party data sources used to enrich marketing profiles should be assessed for compliance with applicable privacy law in the jurisdictions where the data subjects are located, including whether those sources lawfully collected and transferred the data for marketing combination purposes. 5. COMPLIANCE CONSIDERATIONS: Legal teams should verify that a documented legitimate interests assessment exists for each marketing use case, that the opt-out mechanism is operationally implemented and honored in a timely manner, and that CASL-compliant consent mechanisms are in place for Canadian recipients. Objection requests under GDPR Article 21 should be tracked and honored within required timeframes.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes legitimate interests as the default legal basis for marketing activities targeting individuals who have not provided explicit consent, and authorizes combination of third-party sourced data with HubSpot-collected data for personalized outreach. The provision is conditioned on legal requirements in applicable jurisdictions, acknowledging that consent will be obtained where law requires it.
Under this clause, individuals who have not opted out of marketing may receive personalized communications based on combined data from HubSpot and third-party sources, unless they are in a jurisdiction where opt-in consent is required. Marketing opt-out is available by following the unsubscribe instructions in each HubSpot communication.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.