This provision establishes that fifteen named HubSpot affiliate entities across the US, Ireland, Germany, Australia, Singapore, Japan, Colombia, Sweden, France, the UK, Belgium, Canada, Spain, the Netherlands, and India are authorized as Sub-Processors with access to Customer Data by virtue of the customer's agreement to the DPA.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision authorizes Customer Data access by HubSpot affiliate entities in jurisdictions that include countries without EU adequacy decisions, specifically Singapore (HubSpot Asia Pte. Ltd.), India (HubSpot India Private Limited), Japan (HubSpot Japan KK), and Colombia (HubSpot Latin America S.A.S.). Customers must ensure that appropriate cross-border transfer mechanisms are in place for data flowing to these entities.
Interpretive note: The specific cross-border transfer mechanisms applicable to affiliate Sub-Processors in Singapore, India, Japan, and Colombia are not disclosed in this document and depend on the content of HubSpot's DPA and associated standard contractual clauses.
Under this provision, Customer Data may be accessed by fifteen HubSpot affiliate entities in fifteen countries, including Singapore, India, Japan, and Colombia, as authorized by the customer's agreement to the DPA. Customers with data residency or transfer restrictions should evaluate the transfer mechanisms applicable to each affiliate location.
Cross-platform context
See how other platforms handle HubSpot Affiliate Sub-Processors with Global Scope and similar clauses.
Compare across platforms →"To help HubSpot deliver the Subscription Service, we engage HubSpot Affiliates as Sub-Processors to assist with our data processing activities. By agreeing to the DPA, you agree all of these Sub-Processors may have access to Customer Data.Excerpt from HubSpot's Sub-Processors
(1) REGULATORY LANDSCAPE: This provision engages GDPR Chapter V (international data transfers) for transfers to affiliate entities in Singapore, India, Japan, and Colombia, none of which currently hold a full EU adequacy decision.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision authorizes Customer Data access by HubSpot affiliate entities in jurisdictions that include countries without EU adequacy decisions, specifically Singapore (HubSpot Asia Pte. Ltd.), India (HubSpot India Private Limited), Japan (HubSpot Japan KK), and Colombia (HubSpot Latin America S.A.S.). Customers must ensure that appropriate cross-border transfer mechanisms are in place for data flowing to these entities.
Under this provision, Customer Data may be accessed by fifteen HubSpot affiliate entities in fifteen countries, including Singapore, India, Japan, and Colombia, as authorized by the customer's agreement to the DPA. Customers with data residency or transfer restrictions should evaluate the transfer mechanisms applicable to each affiliate location.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.