Support and CRM
GDPR HubSpot
In an indie stack, HubSpot is used for CRM, forms, and sales tracking. Entity cited: HubSpot, Inc.. The sections repeat what the vendor publishes, without filling a gap. Last update of the facts: October 4, 2026. Verified on October 4, 2026.
Translation of the French sheet. The facts do not change. The date is the date the official pages were read.
DPA HubSpot
Yes. Public DPA.
Stated role
Processor of Customer Personal Data for the subscription services. Each party is controller of Controller Personal Data for the enrichment products and the HubSpot tracking code.
Personal data
Contact details and other personal data sent or received through the subscription service. As controller: first name, last name, business email, employer, position, title, IP address, and online identifiers.
Sub-processors of HubSpot
Public sub-processor page.
Transfers outside the EU
Hosting / location
Customer Personal Data may be transferred and processed by HubSpot, Inc. in the United States and in other countries where affiliates and sub-processors operate. The service is hosted by cloud infrastructure providers.
EU–United States Data Privacy Framework
HubSpot, Inc. is registered. EU-U.S. Data Privacy Framework status: Active. The certification covers HubSpot and the Clearbit brand.
Cookies
If the site is hosted by HubSpot or embeds the tracking code, HubSpot may set essential cookies (including __hs_opt_out, __hsmem, and Cloudflare cookies such as __cf_bm) and, depending on the banner, analytics cookies __hstc, hubspotutk, __hssc, and __hssrc, plus the chat cookie messagesUtk.
Typical use, written by StackLégal and not by the vendor: CRM, forms, and sales tracking.
History
Last update: October 4, 2026.
First publication. The facts come from the official pages cited in the sources. Anything not stated there remains "not disclosed".
Clause to paste
Place it in the sub-processor section of your privacy policy. Review it: a “not disclosed” field must be completed before publication.
Sub-processor clause
Sources
Verified on October 4, 2026.
Frequently asked questions
Is HubSpot a processor within the meaning of the GDPR?
Processor of Customer Personal Data for the subscription services. Each party is controller of Controller Personal Data for the enrichment products and the HubSpot tracking code.
What DPA does HubSpot publish?
Yes. Public DPA. https://legal.hubspot.com/dpa
Which further sub-processors does HubSpot publish?
Public sub-processor page. https://legal.hubspot.com/sub-processors-page
Where does HubSpot state that it processes data, including outside the EU?
Customer Personal Data may be transferred and processed by HubSpot, Inc. in the United States and in other countries where affiliates and sub-processors operate. The service is hosted by cloud infrastructure providers.
Is HubSpot registered under the EU–United States Data Privacy Framework?
HubSpot, Inc. is registered. EU-U.S. Data Privacy Framework status: Active. The certification covers HubSpot and the Clearbit brand. https://www.dataprivacyframework.gov/participant/5812
Which personal data does HubSpot mention?
Contact details and other personal data sent or received through the subscription service. As controller: first name, last name, business email, employer, position, title, IP address, and online identifiers.
Often in the same stack
These sheets come up in searches for a Next.js SaaS. Next.js itself is not a processor: GDPR Next.js.
Related tools
Full pack, from 39 € incl. VAT
The clause above covers only one tool. StackLégal generates the legal notices, terms of use, terms of sale, privacy policy, Article 28 DPA, and the public list, naming only the boxes that are checked. One-time payment via Gumroad. This is not legal advice.