HubSpot and Data Protection – What Belongs in the Privacy Policy
Compact guide to HubSpot: processed data, purposes, legal bases (GDPR), DPA and what website operators must include in their privacy policy.
HubSpot and Data Protection – What Website Operators Need to Know
If a website operator uses HubSpot, it processes visitor, contact and interaction data for the purposes of customer relationship management (CRM), marketing automation and website analytics on the basis of consent (for tracking), legitimate interests (for forms) or contract performance (for customer relationships) under the GDPR. This information is based on provider information and publicly available sources.
A. Purpose and Function of HubSpot
HubSpot is a comprehensive CRM and marketing automation platform from US-based HubSpot Inc. with EU branch HubSpot Ireland Ltd. It enables website operators to:
- Website tracking: A tracking pixel (HubSpot Analytics Code) collects visitor data (page view, clicks, dwell time)
- Form management: HubSpot forms on the website collect contact data (name, email, phone, etc.)
- Chat and live support: A chat widget enables real-time communication with visitors
- Email marketing: Automated email campaigns to contacts
- CRM database: Central system for managing customer data, deals and interaction history
- Personalization: Content and offers are adapted based on visitor profile
Technical integration: The website operator embeds the HubSpot tracking code (an asynchronous JavaScript snippet) in the <head> or <body> area of its website. In addition, HubSpot forms and chat widgets can be inserted. The tracking code sets a cookie on the visitor's device on loading and sends data to HubSpot's servers.
B. Mandatory Disclosures in the Privacy Policy regarding HubSpot
The GDPR requires website operators to transparently explain the following points:
- Processing purposes (Art. 13(1)(c)): Why is data processed?
- Legal bases (Art. 13(1)(c)): On which legal basis does the processing take place?
- Legitimate interests (Art. 13(1)(d)): If legitimized via legitimate interests
- Recipients or categories of recipients (Art. 13(1)(e)): To whom is data shared?
- Third-country transfers (Art. 13(1)(f)): Is data transferred to countries outside the EU/EEA?
- Retention period (Art. 13(2)(a)): How long is data stored?
- Data subject rights (Art. 13(2)(b) and (c)): Rights of access, erasure and objection
Common error: Many website operators use HubSpot's standard data protection text directly in their statement. This contradicts Art. 12(1) GDPR (clarity and intelligibility). A topic-oriented approach is better: structure by processing purposes (e.g. "Website analytics", "CRM and marketing"), not by individual tools.
Privacy policy in minutes — easy to maintain, no subscription.
Instead of an unreadable text block per tool: a topic-oriented, hybrid approach with a clear list of recipients — maintainable, transparent, GDPR-compliant.
- No subscription, no hidden costs
- Easy to maintain thanks to a topic-based structure instead of tool-by-tool blocks
- Curated by Dr. Thomas Helbing, certified specialist for IT law
The generator is offered by matterius GmbH. matterius is not a law firm and does not provide legal advice.
C. Provider of HubSpot: HubSpot Inc. / HubSpot Ireland Ltd.
| Aspect | Information |
|---|---|
| Legal name | HubSpot Inc. (USA) and HubSpot Ireland Limited (EU) |
| Address (USA) | 25 First Street, 2nd Floor, Cambridge, MA 02141, USA |
| Address (EU) | HubSpot Ireland Limited, 2nd Floor, 30 North Wall Quay, Dublin 1, Ireland |
| Country of registered office | USA (headquarters); Ireland (EU branch) |
| Registration number (Ireland) | Irish Company Registration Office CHN 706302 |
| DPF status | Certified under the EU-U.S., UK Extension, and Swiss-U.S. Data Privacy Framework |
| Privacy Policy | https://legal.hubspot.com/privacy-policy |
| Data Processing Agreement (DPA) | https://legal.hubspot.com/dpa |
| EU data protection info | https://legal.hubspot.com/dp-eu-data-transfers |
| Role | Processor under Art. 28 GDPR (for website integration) |
Note: HubSpot has an EU branch in Ireland and is DPF-certified, which ensures the legal compliance of data transfers to the USA.
D. Data Processing by HubSpot – Process
Collection
The HubSpot tracking code is executed when the website loads. It collects visitor data (page view, referrer, browser, device, timestamp). In addition, data is collected through forms (name, email, etc.), chat widgets (messages, IP) and external data sources (CRM, email lists).
Storage
Data is stored in HubSpot's databases. HubSpot has EU data centers but also US servers. The retention period depends on the customer contract; data is typically stored for as long as the HubSpot account is active.
Use
HubSpot uses the data for:
- Contact management and CRM functionality
- Website analytics and visitor tracking
- Marketing automation and email campaigns
- Personalization of website content
- Chat and support functions
Sharing
HubSpot shares data with integrated partner tools (e.g. Slack, Salesforce, Google Analytics), with service providers (hosting, analytics) and possibly with other HubSpot users (depending on account structure). For EU users, SCCs are used.
Erasure
Users can erase contacts in HubSpot. When the account is erased, data is erased after a grace period. Data subjects can submit erasure requests, which HubSpot must process.
E. Data Collected when Using HubSpot
HubSpot collects a broad spectrum of data:
Tracking data (via Analytics Code):
- IP address
- Cookie ID (HubSpot cookie:
hubspotutk) - Visited URLs and referrer
- Page view time and dwell time
- Clicks and clicked links/buttons
- Scroll depth and engagement metadata
- Browser, operating system, device type
- Time zone and coarse location data
- Session information
Form data:
- Name, email address, phone number
- Company name
- Job title
- Custom form fields (depending on configuration)
Chat data:
- Chat messages and timestamps
- IP address and browser info
- Visitor identification
CRM data (added externally):
- Customer data from external systems
- Purchase history
- Customer interaction history
- Contract information
This data can be classified into the following standardized data type categories:
- Web server log data: IP address, date/time/time zone, URL, referrer, browser/OS/device, technical metadata
- Click paths: Visited pages incl. referrer, clicked links/buttons with date/time
- End-device data: Device type, operating system, screen resolution/size, orientation
- Browser information: Browser name, browser version, installed extensions
- Coarse location data: IP-based coarse location at city/municipality level
- User account data: Username/identifier, email address, name, phone
- Interaction data: Chat messages, form entries, engagements (email opens, link clicks)
- Conversion events: Form submissions, chat initiation, download, offer request
- Technical telemetry data: Error rates, loading times, session information
F. Purposes of Use when Using HubSpot
HubSpot processes data for the following purposes:
- Functional provision: Website analytics, contact management, chat support, email marketing
- CRM and customer relationship management: Central place to manage all customer interactions
- Marketing automation: Automated email campaigns, lead scoring, personalization
- General marketing: Targeting of email campaigns, success measurement, A/B testing
- User profile creation: Creation of contact profiles, segmentation, personalization
- User-individual marketing: Personalized website content, dynamic landing pages
- Communication: Support via chat, email campaigns, lead nurturing
- General product improvement: Optimization of the HubSpot platform based on usage data
G. Legal Bases for HubSpot
HubSpot is a large tool with multiple functions and therefore multiple potential legal bases:
1. Website tracking (Analytics Code):
- Legal basis: Consent under Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG
- Consent required: Yes, before the tracking code is loaded
- Cookie banner needed: Yes, with explicit opt-in option for HubSpot
2. Forms (name, email address):
- Legal basis: Art. 6(1)(b) GDPR (contract performance / contract initiation) or Art. 6(1)(a) GDPR (consent)
- Consent required: Generally not – the user implicitly consents by submitting the form
- Cookie banner: Not required for storage in the CRM
3. Chat widget:
- Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interests, if it only serves functionality)
- Consent required: Depending on configuration – if data is also used for marketing purposes: yes
4. Email marketing:
- Legal basis: Art. 6(1)(a) GDPR (consent) + § 7(2) No. 1 UWG (opt-in for email advertising)
- Consent required: Yes, specific consent to receive marketing emails
- Double opt-in recommended: Standard for email marketing
Blanket statement: In individual cases, the legal basis should be examined with a lawyer, as it depends on the exact configuration.
H. Special Features and Notes regarding HubSpot
- DPF certification: HubSpot is DPF-certified, which ensures the legal compliance of data transfers to the USA. The certification should be reviewed regularly.
- EU data centers: HubSpot has EU data centers but also US servers. The operator can configure EU data storage in the HubSpot settings.
- Processor: HubSpot acts as a processor (Art. 28 GDPR) for website integration. A DPA (Data Processing Agreement) is available at https://legal.hubspot.com/dpa and should be signed.
- Standard Contractual Clauses (SCCs): HubSpot uses SCCs for data transfers to the USA (in addition to DPF certification).
- Sub-processors: HubSpot uses sub-processors (e.g. AWS for hosting, Slack for integrations). A current list is available on the HubSpot website.
- Privacy notices: HubSpot provides privacy notices that can be integrated into the website. These should be reviewed.
- Data subject rights: Users have rights of access, rectification, erasure and objection. HubSpot has tools for processing these requests.
- Marketing compliance: For email marketing, laws such as UWG § 7 must be observed (double opt-in, unsubscribe possible).
- Data protection contact: HubSpot's data protection officer can be reached via https://legal.hubspot.com/.
I. FAQ regarding HubSpot
J. Conclusion and Recommendation regarding HubSpot
Summary: HubSpot is an extensive CRM and marketing tool with multiple data protection requirements depending on the functions used. With correct configuration and documentation, HubSpot is GDPR-compliant.
Why text blocks are problematic: The privacy policy should not simply copy HubSpot's standard text. This contradicts Art. 12(1) GDPR. Users should understand which data is processed for which purposes – not be confused by technical documentation.
Recommended approach: A topic-oriented privacy policy with a clear structure is better:
- Website analytics: Explain that HubSpot collects visitor data
- CRM and marketing: Explain that contact data is stored and marketing is automated
- Email marketing: Specific information about email campaigns and opt-out
- Recipient annex: Name HubSpot and other recipients
Recommendations for operators:
- Sign DPA at https://legal.hubspot.com/dpa
- Implement cookie banner with specific opt-in for HubSpot
- Configure EU data centers in HubSpot (if possible)
- Regularly review DPF certification status
- Document data subject rights requests
This article is intended for general information about HubSpot and does not replace legal advice in individual cases. As of: 2026-04-22.
Privacy policy in minutes — easy to maintain, no subscription.
Instead of an unreadable text block per tool: a topic-oriented, hybrid approach with a clear list of recipients — maintainable, transparent, GDPR-compliant.
- No subscription, no hidden costs
- Easy to maintain thanks to a topic-based structure instead of tool-by-tool blocks
- Curated by Dr. Thomas Helbing, certified specialist for IT law
The generator is offered by matterius GmbH. matterius is not a law firm and does not provide legal advice.
Authorship
This knowledge article is provided by matterius GmbH. matterius is not a law firm and does not provide legal advice.
matterius is editorially accompanied by Dr. Thomas Helbing, a German-based lawyer specialised as Fachanwalt für IT-Recht (certified specialist for IT law) in Munich.
Dr. Helbing has been continuously recognised by Handelsblatt since 2020 through to today (2026) as one of "Germany's best lawyers" in the fields of IT law and data protection law.
According to Kanzleimonitor.de (editions 2024–2026), he ranks among the leading lawyers for data protection and IT law and is listed in the Top 100 lawyers in Germany. Kanzleimonitor is regarded as a particularly meaningful market study, as it is based exclusively on personal recommendations from in-house counsel.
Dr. Helbing has many years of advisory experience in data protection and IT law and advises clients of all sizes — from startups to high-growth SaaS companies and unicorns through to international corporations.
His professional background covers the full spectrum of practice in IT and technology law. He began his career at an international major law firm, subsequently gained in-house experience at a DAX corporation, and is himself an entrepreneur and founder of several digital projects. He also has hands-on programming experience, allowing him to understand technical systems, software architectures, and digital business models not only from a legal but also from a technical perspective.
For many years his clients have included technology companies and SaaS providers, leading German research institutions, and a systemically important German major bank. His advisory focus lies in particular in the areas of GDPR compliance, the data economy, SaaS, AI regulation, and IT contract law.
More about Dr. Helbing: www.thomashelbing.com
Hotjar and Data Protection – What Belongs in the Privacy Policy
Compact guide to Hotjar: processed data, purposes, legal bases (GDPR) and what website operators must include in their privacy policy.
Inspectlet and Data Protection – What Belongs in the Privacy Policy
Compact guide to Inspectlet: processed data, purposes, legal bases (GDPR) and what website operators must include in their privacy policy.