Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
This provision establishes a two-tier structure for feature-specific Sub-Processors: those that apply by default when certain features are used, and those that apply only when a customer actively opts in. For opt-in Sub-Processors, HubSpot states it will notify customers before activation. Customers may avoid a feature-specific Sub-Processor by choosing not to use the associated feature or integration.
This analysis describes what HubSpot's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes that certain Sub-Processors are activated automatically when default features are used, without a specific opt-in action at the time of Sub-Processor engagement. The document does not specify which listed feature-specific Sub-Processors are default versus opt-in, meaning customers must determine this through feature-level review rather than from this document alone.
Interpretive note: The document does not specify which of the listed feature-specific Sub-Processors are classified as default versus opt-in, requiring customers to obtain this information through feature-level review or direct inquiry with HubSpot.
Under this provision, some feature-specific Sub-Processors will process Customer Data by default when certain HubSpot features are active, while others require customer opt-in. Customers who wish to avoid a particular Sub-Processor may do so by not using the associated feature or integration, but must first identify which Sub-Processors are default versus opt-in.
Cross-platform context
See how other platforms handle Opt-In versus Default Feature-Specific Sub-Processors and similar clauses.
Compare across platforms →Monitoring
HubSpot has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Some of our features and integrations require the use of additional Sub-Processors. Some Sub-Processors will apply to you as a default, and some Sub-Processors will apply to you only if and when you opt-in. In either case, you may choose not to use the Applicable Service provided by these Sub-Processors. We will notify you before you turn on a feature or install an integration that requires support from an opt-in Sub-Processor.Excerpt from HubSpot's Sub-Processors
(1) REGULATORY LANDSCAPE: This provision engages GDPR principles of data minimization and purpose limitation, as default-active Sub-Processors may process Customer Data without a specific opt-in decision at the feature level. Where Sub-Processors process personal data of EU residents, GDPR Article 28 requires that appropriate contractual protections are in place regardless of whether the Sub-Processor is default or opt-in. The Irish Data Protection Commission has jurisdiction over HubSpot's EU processing. (2) GOVERNANCE EXPOSURE: Medium. The absence of explicit identification of which Sub-Processors are default versus opt-in in the Sub-Processors Page itself requires customers to conduct feature-level review to understand their Sub-Processor exposure. Compliance teams may find it difficult to maintain accurate data processing records without this information being clearly mapped in the document. (3) JURISDICTION FLAGS: EU and EEA customers face the highest exposure, as GDPR requires documented awareness of all sub-processors and applicable transfer mechanisms. Default-active Sub-Processors engaged without explicit customer action may complicate documentation of sub-processor authorization under GDPR Article 28. (4) CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request from HubSpot a clear mapping of which feature-specific Sub-Processors are default versus opt-in, and maintain this mapping in their vendor management records. Contract review should confirm that HubSpot's DPA obligations cover both default and opt-in Sub-Processor relationships with equivalent protections. (5) COMPLIANCE CONSIDERATIONS: Compliance teams should audit active HubSpot features and integrations to determine which feature-specific Sub-Processors are currently default-active and update records of processing activities accordingly. Teams should ensure that any features triggering opt-in Sub-Processor activation are reviewed before enablement.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision establishes that certain Sub-Processors are activated automatically when default features are used, without a specific opt-in action at the time of Sub-Processor engagement. The document does not specify which listed feature-specific Sub-Processors are default versus opt-in, meaning customers must determine this through feature-level review rather than from this document alone.
Under this provision, some feature-specific Sub-Processors will process Customer Data by default when certain HubSpot features are active, while others require customer opt-in. Customers who wish to avoid a particular Sub-Processor may do so by not using the associated feature or integration, but must first identify which Sub-Processors are default versus opt-in.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by HubSpot.