·Legal Center

·HUBSPOT PRIVACY POLICY

·Last Modified: September 16, 2026

·HubSpot Privacy Policy

·HubSpot is committed to protecting your privacy. This Privacy Policy applies to the personal data we collect and process in the course of our business. HubSpot acts in different ways when processing data:

·(i) HubSpot acts as a controller of your personal data when you sign up for our products and services, visit our websites or interact with us through other channels (for example in person events). We use this data for a variety of purposes, including to provide our products and services to you, contact you about relevant content, and improve and promote our products and services.

·(ii) HubSpot acts as a processor when our customers use our products and services to collect and process personal data in connection with their sales, marketing, and other business activities. In this case, we act as a processor (or service provider) on behalf of our customers (who are controllers of personal data) under the HubSpot Data Processing Agreement included in the Customer Terms of Service.

·(iii) HubSpot also acts as a controller when we collect and process personal data about individuals in their professional capacity, and make that information available to customers for their own sales, marketing, and other business activities. This includes personal data we may collect indirectly about you, such as from publicly available sources, our customers, or other third parties. For more information see the "What Information We Collect and Process" section.

·For the purposes of this Privacy Policy "Personal Data" means any information relating to an identified or identifiable individual. This Privacy Policy describes your choices and rights with respect to your Personal Data, including your rights of access and correction.

·(i) For information about how to exercise your privacy rights when HubSpot acts as a controller of personal data, please see the "Your Privacy Rights and Choices" section.

·(ii) To opt out and delete your personal data from our commercial dataset of professionals, please fill out this form.

·(iii) If you wish to exercise your privacy rights regarding Personal Data we process on behalf of a customer, please refer to the customer policies and contact the customer directly.

·We update this Privacy Policy from time to time and encourage you to review this Privacy Policy periodically. We will post any Privacy Policy changes on this page and, if the changes are material, notify you directly (for example, by sending you an email notification). Terms not otherwise defined in this Privacy Policy have the meaning given to them in the HubSpot Customer Terms of Service.

11. What Information We Collect and Process 2. How We Use Personal Data 3. How We Share Personal Data

44. How We Transfer Personal Data Internationally

55. How We Store and Secure Personal Data 6. Cookies and Similar Technologies 7. Your Privacy Rights and Choices 8. California Privacy Rights 9. Other Important Privacy Information 10. Google Integrations 11. Contact Us

11. WHAT INFORMATION WE COLLECT AND PROCESS

1.11.1 Information You Provide to HubSpot. When you interact with us, including via our websites or any sites or services that link to this Privacy Policy (such as HubSpot.com, the Hustle.co, etc.), with our representatives, at events, or when you use the Subscription Service, we may collect Personal Data and other information from you, as further described below.

1.1.11.1.1 When You Visit Our Websites. We collect Personal Data from you when you submit web forms or interact with our websites, for example by subscribing to a HubSpot blog, engaging with our chatbots, signing up for a webinar, subscribing to one of our services or requesting customer support. We may ask for your email address, first and last name, job title, and other similar business information. You are free to explore some of our websites without providing any Personal Data about yourself.

1.1.21.1.2 HubSpot Events. When you register for any HubSpot event, we collect information such as name, address, phone number, and email address. We use this information to communicate with you and in some cases facilitate your registration. Additionally, we may share your registration data with event service providers in order to provide event information and improve your experience at the event or future HubSpot events. Please see the event's registration terms and conditions for additional information.

1.1.31.1.3 Account and User Information. We collect Personal Data when you sign-up for a HubSpot account, create or modify user information, set preferences, or provide any other related information to access or utilize our Subscription Service.

1.1.41.1.4 Payment Information. We collect payment and billing information when you register for or purchase paid products or services. For example, we may ask you to provide a billing address, or a billing contact for your HubSpot account. If you give us payment information, we use it solely as authorized by you in accordance with this Privacy Policy. We use secure third-party payment service providers to process personal and financial data.

1.1.51.1.5 Testimonials. We may post testimonials and comments on our websites, which may contain Personal Data. 1.2 Information We Process on Behalf of Customers When They Use the Subscription Service.Our product, or the Subscription Service, allows our customers to create and share marketing, sales and customer service content. When customers use our product, they may process Personal Data such as first and last name, email address, physical address, phone number, or other information about you. We call the information that our customers submit or collect via the product 'Customer Data' under our Customer Terms of Service.We generally store and process information about and on behalf of our customers on our servers as a processor (or service provider) based on a customer's instructions and in accordance with our Customer Terms of Service. Each customer controls and is responsible for the information they process using the Subscription Service and for complying with any regulations or laws that require providing notice, disclosure, and/or obtaining consent prior to transferring the Personal Data to HubSpot for processing purposes.If you have questions about the Personal Data we process on behalf of a customer, please contact the customer directly and refer to their policies.

1.31.3 Information We Collect and Process When You Use the Subscription Service.

1.3.11.3.1 Usage Data. We collect usage data when you or your users in your HubSpot account interact with the Subscription Service. Usage data includes metrics and information regarding your use and interaction with the Subscription Service such as what product features you use the most, when an object (like a ticket) is opened and closed, and how often certain features (like workflows) are triggered in your account.

·We engage third party providers to collect usage data. For more information about how we protect your information with these service providers, please see the "How We Share Personal Data" section.

1.3.21.3.2 Mobile. When you access or use the Subscription Service via our mobile applications, we automatically collect information such as your device model and version, operating system, or device identifiers.

1.3.31.3.3 Log Files. Like most websites and technology services delivered over the Internet, we automatically collect and store information about your computer hardware and software when you visit our websites, use our product and services, or visit other sites or services that link to this Privacy Policy. This information can include your IP address, browser type, domain names, internet service provider (ISP), and the files viewed on our websites (e.g., HTML pages, graphics, etc.), the files viewed on our, or our customer's websites (if those websites are hosted on HubSpot e.g. HTML pages or, graphics etc.), your operating system, access times and referring website addresses.

·When you use the Subscription Service, we collect and store the categories of information listed above in logs in the following instances, subject to the customer's implementation settings:

·(i) when a HubSpot User logs into their account and accesses tools in the HubSpot Platform;

·(ii) when an individual visits a customer's website, if the website is hosted by our product and services; or

·(iii) when an individual visits a customer's website, if the customer's website is self-hosted, if the customer uses our plug-ins, and the customer uses HubSpot scripts and content (such as embedded forms).; or

·(iv) third-party features and content from other companies.

·Our websites may include features and widgets (such as the share and/or "like" button or interactive mini-programs) that run on our websites. These features may collect your IP address, which page you are visiting on our sites, and may set a cookie to enable the feature to function properly. These features and widgets are either hosted by a third party or hosted directly on our websites.

1.3.41.3.4 Third Party Integrations. You may connect third party integrations to your HubSpot account, which may ask for certain permissions to access data or send information to your HubSpot account. It is your responsibility to review any third party integrations you authorize. We may collect information about what types of integrations you use in your HubSpot account.

·Any permission(s) granted by you, grants these third parties access to your data, which may include (but is not limited to) granting third party applications access to view, store, and modify your HubSpot account data. We are not responsible for the practices of third party integrations, so please carefully review the permissions you grant to third party applications.

·HubSpot Terms Tip: For more information on integrations with third party providers, please see the "Connect apps to HubSpot" knowledge base article.

1.41.4 Information We Collect From Other Sources.

1.4.11.4.1 HubSpot Partners. We may receive information about you, or Users of your HubSpot Account (if applicable), from our global network of partners. We may receive this data through a number of ways, including through our deal and lead registration processes.

·We may also collect information about you through our partner co-marketing partnerships. For example, you may sign up to a webinar or download a white paper published by HubSpot and a HubSpot co-marketing partner. You can read more information about our co-marketing program at https://www.hubspot.com/co-marketing-request-form. For more information about how we share data with our partners, review the "Partners" subsection of the "How We Share Personal Data" provision of this privacy policy.

1.4.21.4.2 Third Parties. We may receive information from third party service providers, from related companies, and from our business and solution partners.

1.4.31.4.3 Personal Data from Different Sources. We may collect Personal Data about you from other sources, such as third party providers and publicly available sources (like social media platforms). This may include physical mail addresses, job titles, email addresses, phone numbers, IP addresses, and social media profiles. This helps us to update and improve our products, services, and records, identify new customers, create more personalized advertising, suggest products and services that may interest you, deliver personalized communications, and promote events.

1.4.41.4.4 Other HubSpot Companies and Affiliates. We may receive information about you from other companies that are owned or operated by HubSpot.

1.51.5 Information We Collect and Process in Connection with Our Enrichment Products. HubSpot collects business contact and similar professional data from various sources, including publicly available sources, third party providers, and customers who use our enrichment products. This information powers our commercial dataset. We provide information from our commercial dataset to customers who choose to use enrichment products within the Subscription Services as part of their sales, marketing, and other business activities.

·If you'd like to remove your Personal Data from our commercial dataset, complete and submit this form. For more information about how to exercise your privacy rights and choices, please see the "Your Privacy Rights and Choices" section for more information.

1.61.6 Information We Collect and Process via the HubSpot Tracking Code. Our Customers may install the HubSpot Tracking Code on their website to collect information about website visitors. HubSpot uses information collected by the tracking code, such as IP addresses and online identifiers, to improve our products and services, including our commercial dataset. We store information about website visitors on our servers and process this data for our own purposes as a controller. 2. HOW WE USE PERSONAL DATA

2.12.1 To Communicate with You About the Product and Services. We use the account information you provide to HubSpot when signing up for our products and services, to send you transactional emails or in-app notification about billing, account management, and other administrative matters.

·We also use your information to recommend new products and services and to provide customer support, such as resolving technical issues you encounter and analyzing product outages or bugs.

·If you use the HubSpot mobile applications, we may send you push notifications from time to time in order to update you about events and promotions. If you no longer wish to receive such communications, you may turn them off at the device level.

2.22.2 To Provide the Subscription Service. We use your account information and Customer Data to provide the product and services to you. For example, we use the email address you provide when signing up for the product to create your user account, and we use your payment information to process payments for paid use of the Subscription Service. We also use this information to authenticate you when you log in and to provide customer support.

2.32.3 To Improve and Develop Our Communication, Product and Services. We use the information you provide us, professional data, log files, and usage data about how you or your users interact with our product and services to develop and improve our products, services, and communications. For example, we use usage data to assess trends and usage across the product to help us determine what new features or integrations our users may be interested in.

·When you use our products and services we may process personal data to develop, support, and improve HubSpot AI features and to train our AI models and similar products and services that rely on machine learning.

·We may publish data about how our product and services are being used across our customer base. When we share statistical information externally in this way, the data will be aggregated and we will not identify individual users or customers. For example, we may publish blog posts on trends or insights into how users are interacting with our product.

2.42.4 To Secure and Protect our Product and HubSpot Users. We use your account information to investigate and help prevent security incidents. We may also use this information to meet legal requirements. We use your information to verify user accounts, new product sign-ups, and to detect and prevent product abuse. This includes enforcing our Acceptable Use Policy.

·We use log files to provide general statistics regarding use of the websites by you, including how you use our websites, what country you are logging in from (for analytics, export control and regulatory purposes) and to help improve the navigation experience. Your IP addresses are also collected and logged for security and debugging purposes, for example to track access patterns, investigate security events and incidents. For these purposes we associate automatically-collected data to other personal data provided by you such as name, email address, address, and phone number.

2.52.5 To Market and Promote the Subscription Service. We use Personal Data to advertise, market, and promote our products, services, and other offerings. For example, we use information like your email or physical address to send information or HubSpot content to you we think may be of interest to you, including by post, email, or other means. We may also send you marketing communications relating to our business.

·You may opt out of receiving this promotional content by following the instructions contained in each communication that we send to you. If you unsubscribe from our marketing lists, we will continue to contact you regarding administrative matters, and to respond to your requests.

·We may reach out to you via telephone to ask about other HubSpot products or services you may be interested in. If you have a call scheduled with a HubSpot representative, we may record and transcribe the call. You will be notified prior to the call that the call is being recorded, and you will be offered an opportunity to opt-out of having the call recorded. We may also reach out to you via SMS, and you will be offered an opportunity to opt out of those communications.

·Where required by law, we will only send marketing communications with your consent. Otherwise, we will market and advertise our products and services on the basis of our legitimate business interests.

·We may use information collected from third party service providers and other sources in combination with other information we collect through other means described in this Privacy Policy for the purposes of providing you with updates and improved services, personalized communications, event promotion, and to otherwise improve the user experience.

2.62.6 Other Purposes if We Obtain Your Consent. We may use your data for other purposes when you give us consent to do so.

2.72.7 Legal Basis for Processing Personal Data (EEA and UK visitors only). If you are a website visitor located in the European Economic Area ("EEA") or United Kingdom ("UK"), HubSpot Ireland Limited is the data controller of your Personal Data. HubSpot's Data Protection Officer can be contacted here.

·Our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which we collect it. However, we will normally collect Personal Data from you only where we have your consent to do so, where we need the Personal Data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Data from you.

·If we ask you to provide Personal Data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Data is mandatory or not (as well as of the possible consequences if you do not provide your Personal Data). Similarly, if we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are. 3. HOW WE SHARE PERSONAL DATA

3.13.1 Service Providers. We may share Personal Data with our third party service providers to support our websites, products, and services. For example, we use service providers for data hosting, application development, marketing, sales support and customer support. We may need to share your information with service providers to provide information about products or services to you. Examples may include removing repetitive information from prospect lists, analyzing data or performing statistical analysis on your use of the Subscription Service or interactions on our websites, providing marketing assistance, processing credit card payments, supplementing the information you provide us in order to provide you with better service, developing and improving the product and services, and providing customer service or support. These service providers are prohibited from using your Personal Data except for these purposes, and they are required to maintain the confidentiality of your information. In all cases where we share your information in this way, we explicitly require the third party service providers to acknowledge and adhere to our privacy and data protection policies and standards.

3.23.2 Plaid Payment Services. We use Plaid to securely connect to financial institutions across the U.S. To the extent you are based in the U.S., by entering online banking credentials for payment and completing checkout, your banking credentials are sent to Plaid for validation. Your personal and financial data is processed by Plaid in accordance with the Plaid Privacy Policy available at https://plaid.com/legal/#consumers.

3.33.3 Partners. We may share your personal data with HubSpot partners to: (i) contact you based on your communication preferences; (ii) help us perform statistical analysis; (iii) provide sales support; (iv) provide customer support; and (v) to improve our partner programs and Subscriptions Services. Partners are prohibited from using your Personal Data except for the purposes stated herein, and they are required to maintain the confidentiality of your data.

·We also partner with trusted third parties to provide you with co-marketing content that we think may be relevant to you. When you engage with these co-marketing partners, we will tell you who we are sharing data with, and provide a link to the co-marketing partner's privacy policy so you can learn more about their privacy practices and how to opt-out of the partner's communications. You will always have a choice as to whether to disclose your Personal Information to our co-marketing partners. These co-marketing partners are required to adhere to our privacy and data protection policies. For more information on our co-marketing program, see this page.

3.43.4 HubSpot Marketplace. When you use a HubSpot Marketplace (such as the HubSpot App Marketplace, HubSpot Template Marketplace, HubSpot Solutions Directory) we may share your Personal Data with our Marketplace Partners who may contact you to provide promotional materials on their offerings. We will only share your Personal Data with our Marketplace Partners when you visit and interact with their listing page. For more information on how our Marketplace Partners process your Personal Data, including how to opt out of these communications, please see their Privacy Policy located on their Marketplace listing page.

3.53.5 Advertising Partners. We allow advertising networks to collect information about your interactions with our websites in order to deliver HubSpot's personalized ads. We may also share Personal Data, such as your email address, with our advertising partners to deliver HubSpot's personalized ads on other companies' sites or mobile apps. You can opt out of having your data disclosed to our advertising partners through this form.

3.63.6 Corporate Events. If we (or our assets) are acquired by another company, whether by merger, acquisition, bankruptcy or otherwise, that company would receive all information gathered by HubSpot on the websites and the Subscription Service. In this event, you will be notified via email and/or a prominent notice on our website, of any change in ownership, uses of your Personal Data, and choices you may have regarding your Personal Data.

3.73.7 Public Forums. Our websites may offer publicly accessible message boards, blogs, and community forums (e.g., HubSpot Community, Connect.com, etc.). Please keep in mind that if you directly disclose any information through our public message boards, blogs, or forums (including profile information associated with the account you use to post the information) it may be read, collected and used by any member of the public who accesses these websites. Your posts and certain profile information may remain even after you terminate your account. We urge you to consider the sensitivity of any information you may disclose in this way. We will correct or delete any information you have posted on the websites if you so request, as described in the"Your Privacy Rights and Choices" section of this Privacy Notice. In some cases, we may not be able to remove your information; we will let you know if we are unable to and why, if permitted.

3.83.8 Compelled Disclosure. We reserve the right to use or disclose your Personal Data if required by law or if we reasonably believe that use or disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a law, court order, or legal process. If you use the Subscription Service, Customer Data is considered Confidential Information and you should review the Confidentiality terms in the Customer Terms of Service for more information. HubSpot shares data about requests for customer information, to learn more see our Data Disclosure and Transparency Report.

3.93.9 HubSpot, Other Companies, and Affiliates. We may share your Personal Data with our current and future parents, Affiliates, subsidiaries, and other entities under common control and ownership to the extent necessary to fulfill your request or for other purposes permitted under this Privacy Policy.

3.103.10 HubSpot Customers in Connection with Our Enrichment Products. We may share Personal Data about individuals in our commercial dataset with our customers that use our enrichment products. Customers may use this information for their sales and marketing activities. We rely on our legitimate interests, as well as those of our customers, to collect and share data for the purposes listed. HubSpot's and our customers' legitimate interests are not more important than your privacy rights, and we process your data on the basis that people would expect their work-related data to be shared in this way. See the "Information We Collect and Process In Connection With Our Enrichment Products" section for more information.

44. HOW WE TRANSFER PERSONAL DATA INTERNATIONALLY

4.14.1 International Transfers within the HubSpot Group. To facilitate our global operations, we may transfer information that may include Personal Data to other HubSpot Affiliates who act as subprocessors, where we have operations for the purposes described in this policy. Please see Annex 3 of our Customer Data Processing Agreement for a list of impacted HubSpot Affiliates and their locations.

·This Privacy Policy will apply even if we transfer Personal Data to other countries. We have taken appropriate safeguards to require that your Personal Data will remain protected wherever it is transferred. When we share Personal Data of individuals in the European Economic Area ("EEA"), Switzerland or the United Kingdom ("UK") within and among HubSpot's Affiliates, we rely upon the the Standard Contractual Clauses (approved by the European Commission and Swiss authorities) and UK Addendum to the Standard Contractual Clauses (approved by the UK authorities) where required. We also have additional safeguards where appropriate (such as commercial industry standard secure encryption methods to protect customer data at rest and in transit, TLS for HubSpot hosted sites, web application firewall protection, and other appropriate contractual and organizational measures), as described more in detail in the HubSpot Trust Center.

4.24.2 International Transfers to Third Parties. Some of the third parties described in this Privacy Policy, which provide services to us under contract, are based in other countries that may not have equivalent privacy and data protection laws to the country in which you reside. When we share Personal Data of individuals in the EEA, Switzerland or UK with third parties, we use a variety of legal mechanisms to safeguard the transfer including the European Commission-approved Data Privacy Framework Standard Contractual Clauses, as well as additional safeguards where appropriate. For transfers to or from the United Kingdom, we make use of the UK Addendum. For transfers to or from Canada, we make use of the standard contractual clauses. With respect to personal data received from or transferred to Canada, HubSpot is subject to the regulatory enforcement powers of the Office of the Privacy Commissioner of Canada. Please contact us if you need more information about the legal mechanisms we rely on to transfer personal data outside the EEA, Switzerland, Canada, and UK.

4.34.3 Data Privacy Framework Notice. HubSpot complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF"), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework ("Swiss-U.S. DPF") as set forth by the U.S. Department of Commerce (collectively "the Data Privacy Framework").

·HubSpot has certified to the U.S. Department of Commerce that it adheres to the EU-US DPF Principles with regard to the processing of Personal Data received from the European Union, and the United Kingdom (and Gibraltar) and to the Swiss-US DPF Principles with regard to the processing of Personal Data received from Switzerland. If there is any conflict between this Privacy Policy and the DPF Principles, the DPF Principles will govern. To learn more about the Data Privacy Framework, and to view our certification, please visit https://www.dataprivacyframework.gov/.

·If you are located in the EU, UK or Switzerland, you have the right to request access to the Personal Data that we hold about you and request that we correct, amend or delete your Personal Data if it is inaccurate or processed in violation of the DPF Principles. We will give you an opportunity to opt out where Personal Data we control about you is to be disclosed to an independent third party or used for a purpose that is materially different from those set out in this Privacy Policy. If you would like to exercise any of your rights, please contact us via the details provided below.

·In compliance with the DPF Principles, HubSpot commits to resolve DPF Principles-related complaints about our collection and use of your Personal Data. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the DPF Principles should first contact HubSpot at privacy@hubspot.com. We will investigate and attempt to resolve any DPF Principles-related complaints within 45 days.

·In compliance with the Data Privacy Framework, HubSpot commits to cooperating and complying respectively with the advice of the panel established by the EU data protection authorities, the UK Information Commissioner's Office, and the Swiss Federal Data Protection and Information Commissioner with regard to unresolved complaints concerning our handling of personal data received in reliance on the Data Privacy Framework.

·Under certain conditions, more fully described on the DPF website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted. The U.S. Federal Trade Commission (FTC) has jurisdiction over HubSpot's compliance with the DPF Principles. HubSpot is subject to the investigatory and enforcement powers of the FTC.

·In the context of an onward transfer, HubSpot is responsible for the processing of Personal Data it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on our behalf. HubSpot will remain liable under the DPF Principles if our agent processes your Personal Data in a manner inconsistent with the DPF Principles, unless HubSpot is not responsible for the event giving rise to the damage.

·Please note that under certain circumstances, we may be required to disclose your Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

55. HOW WE STORE AND SECURE PERSONAL DATA

5.15.1 Data Storage and Security. We use a variety of security technologies and procedures to help protect your Personal Data from unauthorized access, use or disclosure. We secure the Personal Data you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. All Personal Data is protected using appropriate physical, technical and organizational measures. For more on Security at HubSpot, please see https://trust.hubspot.com/.

5.25.2 Retention of Personal Data. How long we keep information we collect about you depends on the type of information and how we collect and store it. After a reasonable period of time, we will either delete or anonymize your information or, if this is not possible, then we will securely store your information and isolate it from any further use until deletion is possible.

·We retain Personal Data that you provide to us where we have an ongoing legitimate business need to do so (for example, as needed to comply with our legal obligations, resolve disputes and enforce our agreements).

·When we have no ongoing legitimate business need to process your Personal Data, we securely delete the information or anonymize it or, if this is not possible, securely store your Personal Data and isolate it from any further processing until deletion is possible. We will delete this information at an earlier date if you so request, as described in the "Privacy Rights and Choices" section.

·If you have elected to receive marketing communications from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our content, products, or services, such as when you last opened an email from us or ceased using your HubSpot account. We retain information derived from cookies and other tracking technologies for a reasonable period of time from the date such information was created.

·The data we process on behalf of customers connection with the Subscription Service is stored and secured according to the HubSpot Customer Terms of Service and Customer Data Processing Agreement. 6. COOKIES AND SIMILAR TECHNOLOGIES

6.16.1 Cookies. When you visit our websites, sign up for a HubSpot account, attend a HubSpot virtual event, or request more information about HubSpot, we collect information automatically using tracking technologies, like cookies and tracking pixels. For more information, and to learn how to opt out, please refer to our Cookie Policy.

·HubSpot may use cookies or similar technologies (such as web beacons and JavaScript) to analyze trends, administer the website, monitor how visitors navigate around the websites, and to gather demographic information about our user base as a whole. To find out more about how we use cookies on our websites and how to manage your cookie preferences please see the HubSpot Cookie Policy as updated by us from time-to-time, without additional notice.

6.26.2 Advertising. We partner with third party ad networks to display advertising on our website or to manage our advertising on other sites. Our ad network partner uses cookies and web beacons to collect information about your activities on this and other websites to provide you targeted advertising based upon your interests. If you wish to not have this information used for the purpose of serving you targeted ads, you may opt-out by using these services: https://optout.networkadvertising.org/ or https://optout.aboutads.info/ (or if located in the European Union, by clicking here: http://www.youronlinechoices.eu/). Please note this does not opt you out of being served advertising you will continue to receive generic ads. 7. YOUR PRIVACY RIGHTS AND CHOICES

7.17.1 Personal Data Requests. Depending on your location and applicable laws, you may have the following data protection rights:

·(i) Access, Correction or Deletion. You can request access, correction, updates or deletion of your Personal Data.

·(ii) Objection or Restriction. You can object to our processing of your Personal Data, ask us to restrict processing of your Personal Data or request portability of your Personal Data.

·(iii) Withdraw Consent. If we have collected and processed your Personal Data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Data conducted in reliance on lawful processing grounds other than consent.

·To exercise any of these rights:

·(i) for HubSpot, including our websites and product or services, please use the HubSpot Privacy Request Form;

·(ii) for the Hustle, please contact us at privacy@thehustle.co.

·If you'd like your information to be removed from our commercial dataset, or would like to opt out from the sharing of your Personal Data for our advertising and marketing activities, please fill out the Your Privacy Preferences form.

·For all HubSpot brands (including the Hustle), you may also write to us by e-mail at privacy@hubspot.com.

·Please note that to protect Personal Data, we may verify your identity by a method appropriate to the type of request you are making. Depending on where you reside, you may be entitled to empower an "authorized agent" to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.

·We will respond to your request to change, correct, or delete your data within a reasonable timeframe and notify you of the action we have taken. In some instances, your rights may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights. Depending on your location, and applicable laws, you may have the right to complain to a data protection authority about our collection and use of your Personal Data. Contact details for data protection authorities in the EEA are available on the European Data Protection Board member page here.

·If you are a customer, prospect, or otherwise interact with a HubSpot customer that uses our Subscription Service and would like to access, correct, amend or delete your data controlled by the customer, please contact the relevant customer directly. HubSpot acts as a processor for our customers in most cases and will work with our customers to fulfill these requests when applicable.

7.27.2 Anti-Spam Policy. Our Acceptable Use Policy applies to us and to our customers and, among other things, prohibits use of the Subscription Service to send unsolicited commercial email in violation of applicable laws, and requires the inclusion in every email sent using the Subscription Service of an "opt-out" mechanism and other required information. We require all of our customers to agree to adhere to the Acceptable Use Policy at all times, and any violations of the Acceptable Use Policy by a customer can result in immediate suspension or termination of the Subscription Service.

7.37.3 To Unsubscribe From Our Communications. You may unsubscribe from our marketing communications through the following methods:

·(i) by clicking on the "unsubscribe" link located on the bottom of our e-mails;

·(ii) updating your communication preferences;

·(iii) for HubSpot, by contacting us on the HubSpot Privacy Request Form;

·(iv) for the Hustle by contacting us at privacy@thehustle.co; or

·Customers cannot opt out of receiving transactional emails related to their HubSpot Account or the Subscription Service.

7.47.4 To Unsubscribe From Our Customers' Communications. Our customers are solely responsible for their own marketing emails and other communications; we cannot unsubscribe you from their communications. Individuals who interact with a HubSpot customer can unsubscribe from our customers' marketing communications by clicking on the "unsubscribe" link located on the bottom of their emails, or by contacting them directly. 8. CALIFORNIA PRIVACY RIGHTS

8.18.1 Applicability. This section applies only to California consumers. For purposes of this section "Personal Information" has the meaning given in the California Consumer Privacy Act ("CCPA"). It describes how we collect, use, and share California consumers' Personal Information in our role as a business, and the rights applicable to such residents.

·If you are unable to access this Privacy Policy due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access.

8.28.2 How We Collect, Use, and Disclose Your Personal Information. We have collected the following statutory categories of Personal Information in the past twelve (12) months:

·(i) Identifiers, such as name, e-mail address, mailing address, and phone number. We collect this information directly from you or from third party sources.

·(ii) Commercial information, such as subscription records. We collect this information directly from you.

·(iii) Internet or network information, such as browsing and search history. We collect this information directly from your device or from emails sent through our platform.

·(iv) Geolocation data, such as IP address. We collect this information from your device.

·(v) Financial information, such as Payment Information or financial account numbers in the process of providing you with a subscription. We collect this information from you.

·(vi) Professional data, such as your job title and company.

·(vii) Other Personal Data, in instances when you interact with us online, by phone or mail in the context of receiving help through our help desks or other support channels; participation in customer surveys or contests; or in providing the Subscription Service.

·(viii) Inferences drawn from any of the above categories, alone or in combination.

·The business and commercial purposes for which we collect this information are described in this Privacy Policy. The categories of third parties to whom we "disclose" this information for a business purpose are described in the "How We Share Personal Data" section of this Privacy Policy. The period of time for which we retain this information is described in the "How We Store and Secure Personal Data" section of this Privacy Policy.

·In the preceding 12 months, we have "sold" or "shared" (as defined under the CCPA) certain information, including identifiers, to our advertising partners. We have also "sold" or "shared" certain information, including identifiers, approximate location data, and professional data to our customers.

8.38.3 Your California Rights. You have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law. These rights include:

·(i) The right of access means that you have the right to request that we disclose what Personal Data we have collected and maintained about you in the past 12 months.

·(ii) The right of deletion means that you have the right to request that we delete Personal Data collected or maintained by us, subject to certain exceptions.

·(iii) The right of correction means that you have the right to request that we correct any inaccurate Personal Data that we maintain about you.

·(iv) The right to request information concerning the categories of Personal Data (if any) that we disclose to third parties or affiliates for their direct marketing purposes.

·(v) The right to limit the use of sensitive personal information means that you have the right to direct businesses to only use your sensitive personal information for limited purposes. We only collect sensitive personal information (such as your payment information), as defined by applicable laws for the purposes allowed by law or with your consent. We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.

·(vi) The right to appeal means that you can appeal any decision by us to deny your privacy rights under applicable laws.

·(vii) The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.

·We respond to all appeal requests as soon as we reasonably can, and no later than legally required.

8.48.4 How to Exercise Your California Rights. You can exercise your rights yourself or you can alternatively designate an authorized agent to exercise these rights on your behalf. Please note that to protect your Personal Data, we will verify your identity by a method appropriate to the type of request you are making. Depending on your request, we will ask for information such as your name and your email address. We may also request that your authorized agent have written permission from you to make requests on your behalf, and we may also need to verify your authorized agent's identity to protect your Personal Data. We may deny a request from an agent that does not submit proof that they have been authorized to act on your behalf.

·We will respond within the time frame permitted by applicable law. Please note that we may charge a reasonable fee for multiple requests in the same 12-month period, as permitted by law.

·Please use the contact details below, or see the "Your Privacy Rights and Choices" section above, if you would like to:

·(i) Access this policy in an alternative format;

·(ii) Exercise any of your rights described above;

·(iii) Learn more about your rights or our privacy practices; or

·(iv) Designate an authorized agent to make a request on your behalf.

8.58.5 Right to Opt Out of "Sale" or "Sharing". HubSpot collects data from publicly available sources or other third-party sources and discloses that information to our customers who purchase our enrichment products. This may be considered a "sale" or "sharing" under certain state privacy laws, such as the CCPA. Please see the "Information We Collect and Process in connection with our enrichment products" section for more information.

·We may also "share" your Personal Data, as defined under the CCPA , with third party advertising partners to deliver personalized ads on HubSpot's behalf on other companies' sites or mobile apps. Please see the "Advertising Partners" section for more information.

·If you'd like your information to be removed from our commercial dataset, or would like to opt out from the "sharing" of your Personal Data for our advertising and marketing activities, please fill out this form.

·You can also control the personalized advertising you see by using these services: https://optout.networkadvertising.org/ or https://optout.aboutads.info/ (or if located in the European Union, by clicking here: http://www.youronlinechoices.eu/). Please note this does not opt you out of being served advertising and you will continue to receive generic ads.

·We do not knowingly "sell" or "share" Personal Data of children under 16 years of age. 9. OTHER IMPORTANT PRIVACY INFORMATION

9.19.1 Information About Children. HubSpot's websites, products, and services are not intended for or targeted at children under 16, and we do not knowingly or intentionally collect Personal Data about children under 16. If you believe that we have collected Personal Data about a child under 16, please contact us here, so that we may delete the information.

9.1.19.1.1 Children's Information In the Subscription Service. Our product, or the Subscription Service, allows our customers to collect children's information, which may be included in Customer Data, under our Customer Terms of Service. For more information about how we process data on behalf of our customers as a processor, review the 'Information We Process on Behalf of Customers When They Use the Subscription Service' subsection of this privacy policy. 10. GOOGLE PRODUCTS AND INTEGRATIONS

·You can learn more about data collected by Google and what this data is used for in Google's Privacy Policy. Additional information on Google services and products is available in Google's Terms of Service.

10.110.1 Google reCAPTCHA. We have implemented Google reCAPTCHA Enterprise on our websites and products for security, fraud, and abuse prevention.

10.210.2 Google Speech to Text. We use Google Speech to Text to transcribe Customer Data that is in audio format (for example, a call audio recording) into text. We use the resulting text to provide our Subscription Services to you.

10.310.3 Google Maps Integration. We use the Google Maps API to provide address autocompletion and validation to provide our products and services to you. When you use features powered by Google Maps, information you enter such as address inputs may be transmitted to Google to provide these features. Google processes this data as an independent data controller under its own privacy policy and the Google Maps/Google Earth Additional Terms of Service.

10.410.4 Gmail Integration. If you use the Gmail integration or choose to integrate any other Google Workspace application with HubSpot, you will be asked to give us access to information from your Gmail or Google account.

·By using the Gmail integration with the Subscription Service you will grant the Subscription Service access to information associated with your account, including contacts, emails, calendar, distribution lists, subject lines, and URLs of tracked links from your email, if you use the email tracking functionality. In addition, the Subscription Service will be able to read, modify, create, and send emails from your connected Gmail account. The Subscription Service will scan the content of your emails to identify which emails you have elected to track in order to provide you with the notifications feature and updates to your Services. The Subscription Service will store replies, outgoing mail, email headers, subject line, distribution lists, aliases, time sent, and email bodies. Your email may contain sensitive, private, or highly confidential information, such as names of your contacts, your private communications, or financial or medical information. You understand that the correspondences you track will be visible to other users on your Subscription team.

·If you connect your Gmail account via IMAP (or Generic Inbox Connection), the Subscription Service will have access only to email address, password, server information, email metadata, and message bodies. Additionally, connecting your Gmail account via IMAP does not require you to connect any other Google Workspace applications.

·HubSpot Terms Tip: You can learn more about how we access this data in the "Connect your personal email" knowledge base article.

10.510.5 Google Calendar Integration. The Subscription Service will have access to both your Google Calendar and any other calendar you access via Google in order to power our Meetings tool, and allow you to associate events with contacts in your HubSpot account. The Subscription Service will have the ability to: create or change your calendars, and update individual calendar events.

10.610.6 Google Drive Integration. As part of connecting your Google Drive, the Subscription Service will be able to: see your documents, sheets, and slides, upload and download your documents, sheets, and slides, and store contents and titles of your documents, sheets, and slides.

10.710.7 Google Search Console. As part of this integration, the Subscription Service will be able to view, manage and store properties which include the list of sites and domains you control in HubSpot and the Search Console data for your connected properties.

10.810.8 Chrome Extensions.

10.8.110.8.1 Sales Extension. You can install the HubSpot Sales Chrome Extension to track Gmail and Google Workspace emails through your Chrome browser. Once installed, the Extension can read and change all your data on the websites you visit and display notifications. It logs all emails from Gmail and can be used in conjunction with the Inbox Integration.

10.8.210.8.2 Social Extension. The HubSpot Social Chrome Extension allows sharing of pages, text, and images from around the web with the HubSpot Social Composer tool. You are able to draft or schedule posts, assign campaigns, and then see posts on the Social Calendar tool or in Social Reports once published.

10.910.9 Additional Limits on Use of Your Google User Data.

10.9.110.9.1 Google API Limits. HubSpot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

10.9.210.9.2 Google Workspace API Limits. Google Workspace APIs are not used to develop, improve, or train generalized AI and/or ML models.

10.9.310.9.3 YouTube API Limits. HubSpot complies with the YouTube API Services Developer Policies available at https://developers.google.com/youtube/terms/developer-policies. Any stored public YouTube API data is refreshed or completely deleted within 30 calendar days, or deleted immediately upon user request.

·HubSpot Terms Tip: The Social Extension only accesses information about the current page, after its toolbar button is clicked, utilizing the permissions granted at this ''Install and use the HubSpot Social Chrome extension" knowledge base article.

10.1010.10 YouTube Integration. If you are a HubSpot Customer and choose to use the YouTube integration with your HubSpot Subscription Services, you will be asked to give us access to information from your YouTube account and have the option to link your accounts.

·By using the YouTube integration with the Subscription Service you grant the HubSpot Subscription Service access to information associated with your YouTube account. The Subscription Service will scan the content of your YouTube account to identify content you have elected to track in order to provide you with features in the Subscription Services. The Subscription Service will store information from your YouTube account. You understand that the information from your YouTube Account you track in the Subscription Services may be visible to other Users within your HubSpot Account.

·Your use of HubSpot's YouTube integration is subject to the YouTube Terms of Service available at https://www.youtube.com/t/terms and the Google Privacy Policy available at http://www.google.com/policies/privacy.

·In addition to the typical data deletion functionality supported in the Subscription Services, Customers may have the option to revoke the YouTube integration from your HubSpot account, in the Google security settings page at https://security.google.com/settings/security/permissions.

·HubSpot Terms Tip: You can learn more about how we access information or remove access to your Google account by following the steps in the "Remove access to HubSpot in your Google account" knowledge base article. 11. CONTACT US

·If you have any questions about this Privacy Policy or our privacy practices, or if you have a disability and need to access this notice in a different format:

·(i) for HubSpot contact us at privacy@hubspot.com;

·(ii) for the Hustle please contact us at privacy@thehustle.co; or

·(iii) You may also contact us by postal mail for all HubSpot brands at:Attn: Privacy and Data Protection OfficerHubSpot, Inc.Two Canal ParkCambridge, MA 02141 USA

·Legal Center

·HUBSPOT DATA PROCESSING AGREEMENT

·Last Modified: September 16, 2026

·HubSpot Data Processing Agreement

·[Need a signed copy (including the full text of the SCCs, UK Addendum, and Sub-Processors)? Click here.]

·This HubSpot Data Processing Agreement and its Annexes ("DPA") is incorporated into and forms part of the HubSpot Customer Terms of Service between you and us (the "Agreement"). This DPA reflects the parties' agreement with respect to (i) the Processing of Customer Personal Data by us as a Processor on your behalf, and (ii) the Processing of Controller Personal Data by each party as a Controller in connection with our enrichment products and your use of the HubSpot tracking code.

·In case of any conflict or inconsistency with other terms included in the Agreement, this DPA will take precedence to the extent of such conflict or inconsistency.

·The Controller-to-Processor terms apply solely to the extent that HubSpot is a Processor of Customer Personal Data in connection with the Subscription Services.

·The Controller-to-Controller terms apply solely to the extent that Customer uses our enrichment products or the HubSpot Tracking Code with Intent data sharing enabled, and each party is considered a Controller under Data Protection Laws.

·We update these terms from time to time. If you have an active HubSpot subscription, we will let you know when we do through an in-app notice (or via email if you have subscribed to receive email notifications via the link in our General Terms). You can find archived versions of the DPA in our archives at https://legal.hubspot.com/legal-stuff/archive.

·The term of this DPA will follow the term of the Agreement. Terms not otherwise defined in this DPA will have the meaning as set forth in the Agreement. 1. Definitions 2. Customer Responsibilities 3. HubSpot Obligations as Processor 4. Data Subject Requests 5. Sub-Processors 6. Data Transfers 7. Demonstration of Compliance

88. Additional Provisions for European Data

99. Additional Provisions for California Personal Information 10. Controller-to-Controller Terms 11. Transfer Mechanisms 12. General Provisions 13. Parties to this DPA

Annex 1Annex 1(A) - Details of Processing-HubSpot as Processor

Annex 1Annex 1(B) - Details of Processing - HubSpot as Controller Annex 2 - Security Measures Annex 3 - Sub-Processors 1. DEFINITIONS

·"California Personal Information" means Customer Personal Data that is subject to the protection of the CCPA.

·"CCPA" means California Civil Code Sec. 1798.100 et seq. (also known as the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 or "CPRA").

·"Consumer," "Business," "Sell," "Service Provider," and "Share" will have the meanings given to them in the CCPA.

·"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of Processing Personal Data.

·"Controller Personal Data" means Personal Data that each party Processes as a Controller in connection with the enrichment products or the HubSpot Tracking Code, and each party is considered a Controller under Data Protection Laws.

·"Customer Personal Data" means Personal Data contained within Customer Data that HubSpot Processes as a Processor on behalf of Customer.

·"Customer Personal Data Breach" means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Customer Personal Data transmitted, stored, or otherwise Processed by us and/or our Sub-Processors in connection with the provision of the Subscription Services. "Customer Personal Data Breach" will not include unsuccessful attempts or activities that do not compromise the security of Customer Personal Data, including unsuccessful log-in attempts, pings, port scans, denial of service attacks, and other network attacks on firewalls or networked systems.

·"Data Privacy Framework" means the EU-U.S. Data Privacy Framework, the Swiss-U.S. Data Privacy Framework and the UK Extension to the EU-U.S. Data Privacy Framework self-certification programs (as applicable) operated by the U.S. Department of Commerce; as may be amended, superseded, or replaced."Data Privacy Framework Principles" means the Principles and Supplemental Principles contained in the relevant Data Privacy Framework; as may be amended, superseded, or replaced.

·"Data Protection Laws" means all applicable worldwide legislation relating to data protection and privacy which applies to the Processing of Personal Data under the Agreement, including without limitation European Data Protection Laws, the CCPA, and other applicable U.S. federal and state privacy laws, and the data protection and privacy laws of Australia, Canada, Singapore, India, and Japan, in each case as amended, repealed, consolidated, or replaced from time to time.

·"Data Subject" means the individual to whom Personal Data relates.

·"Europe" means the European Union, the European Economic Area and/or their member states, Switzerland, and the United Kingdom.

·"European Data" means Customer Personal Data that is subject to the protection of European Data Protection Laws.

·"European Data Protection Laws" means data protection laws applicable in Europe, including: (i) Regulation 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data (General Data Protection Regulation) ("GDPR"); (ii) Directive 2002/58/EC concerning the processing of Personal Data and the protection of privacy in the electronic communications sector; and (iii) applicable national implementations of (i) and (ii); or (iii) GDPR as it forms parts of the United Kingdom domestic law by virtue of Section 3 of the European Union (Withdrawal) Act 2018 ("UK GDPR"); and (iv) Swiss Federal Data Protection Act and its Ordinance ("Swiss DPA"); in each case, as may be amended, superseded, or replaced.

·"Instructions" means the written, documented instructions issued by Customer to HubSpot, and directing HubSpot to perform a specific or general action with regard to Customer Personal Data (including, but not limited to, depersonalizing, blocking, deletion, and making available).

·"Permitted Affiliates" means any of your Affiliates that (i) are permitted to use the Subscription Services pursuant to the Agreement, but have not signed their own separate agreement with us and are not a "Customer" as defined under the Agreement, (ii) qualify as a Controller of Customer Personal Data or Controller Personal Data, and (iii) are subject to European Data Protection Laws.

·"Personal Data" means any information relating to an identified or identifiable individual where such information is protected similarly as personal data, personal information, or personally identifiable information under Data Protection Laws.

·"Processing" means any operation or set of operations which is performed on Personal Data, encompassing the collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction or erasure of Personal Data. The terms "Process," "Processes," and "Processed" will be construed accordingly.

·"Processor" means a natural or legal person, public authority, agency, or other body which Processes Personal Data on behalf of the Controller.

·"Restricted Transfer" means transfer of Personal Data originating from Europe to a country that does not provide an adequate level of protection within the meaning of applicable European Data Protection Laws.

·"Standard Contractual Clauses" means the standard contractual clauses annexed to the European Commission's Decision (EU) 2021/914 of 4 June 2021 currently found at https://eur-lex.europa.eu/eli/dec_impl/2021/914, as may be amended, superseded, or replaced.

·"Sub-Processor" means any Processor engaged by us or our Affiliates to assist in fulfilling our obligations with respect to the Processing of Customer Personal Data under the Agreement. Sub-Processors may include third parties or our Affiliates but will exclude any HubSpot employee or consultant.

·"UK Addendum" means the International Data Transfer Addendum issued by the UK Information Commissioner under section 119A(1) of the Data Protection Act 2018 currently found at https://ico.org.uk/media2/migrated/4019539/international-data-transfer-addendum.pdf , as may be amended, superseded, or replaced. 2. CUSTOMER RESPONSIBILITIES

2.12.1. Compliance with Laws. Within the scope of the Agreement and your use of the services, you will be responsible for complying with all requirements that apply to you under Data Protection Laws with respect to your Processing of Personal Data.

·In particular but without prejudice to the generality of the foregoing, you acknowledge and agree that you will be solely responsible for: (i) the accuracy, quality, and legality of Customer Personal Data and the means by which you acquired such data; (ii) complying with all necessary transparency and lawfulness requirements under Data Protection Laws for the collection and use of Customer Personal Data, including providing adequate notices, obtaining any necessary consents and authorizations, and honoring opt-out preferences (particularly for use by Customer for marketing purposes); (iii) ensuring you have the right to transfer, or provide access to, the Customer Personal Data to us for Processing in accordance with the terms of the Agreement (including this DPA); (iv) complying with all laws applicable to any emails or other content created, sent, or managed through the Subscription Services (including those relating to obtaining consents to send emails, the content of emails, and email deployment practices); and (v) ensuring that your use of Controller Personal Data complies with Data Protection Laws and is strictly limited to the purposes set out in the Agreement (including this DPA). You will inform us without undue delay if you are not able to comply with your responsibilities under this 'Compliance with Laws' section or Data Protection Laws.

2.22.2 Customer Instructions. You are responsible for ensuring that your Instructions to us regarding the Processing of Customer Personal Data comply with applicable laws, including Data Protection Laws. The parties agree that the Agreement (including this DPA), together with your use of the Subscription Service in accordance with the Agreement, constitute your complete Instructions to us in relation to HubSpot's Processing of Customer Personal Data, so long as you may provide additional instructions during the Subscription Term that are consistent with the Agreement and the nature and lawful use of the Subscription Service.

2.32.3 Security. You are responsible for independently determining whether the data security provided for in the Subscription Service adequately meets your obligations under Data Protection Laws. You are also responsible for your secure use of the Subscription Service, including protecting the security of Personal Data in transit to and from the Subscription Service (including to securely backup or encrypt such data). 3. HUBSPOT OBLIGATIONS AS PROCESSOR

3.13.1 Compliance with Instructions. We will only Process Customer Personal Data for the purposes described in this DPA or as otherwise agreed within the scope of your lawful Instructions, except where and to the extent otherwise required by applicable law. We are not responsible for compliance with any Data Protection Laws applicable to you or your industry that are not generally applicable to us.

3.23.2 Conflict of Laws. If we become aware that we cannot Process Customer Personal Data in accordance with your Instructions due to a legal requirement under any applicable law, we will (i) promptly notify you of that legal requirement to the extent permitted by the applicable law; and (ii) where necessary, cease all Processing (other than merely storing and maintaining the security of the affected Customer Personal Data) until such time as you issue new Instructions with which we are able to comply. If this provision is invoked, we will not be liable to you under the Agreement for any failure to perform the applicable Subscription Services until such time as you issue new lawful Instructions with regard to the Processing.

3.33.3 Security. We will implement and maintain appropriate technical and organizational measures to protect Customer Personal Data from Customer Personal Data Breaches, as described under Annex 2 to this DPA ("Security Measures"). Notwithstanding any provision to the contrary, we may modify or update the Security Measures at our discretion provided that such modification or update does not result in a material degradation in the protection offered by the Security Measures.

3.43.4 Confidentiality. We will ensure that any personnel whom we authorize to Process Customer Personal Data on our behalf is subject to appropriate confidentiality obligations (whether a contractual or statutory duty) with respect to that Customer Personal Data.

3.53.5 Customer Personal Data Breaches. We will notify you without undue delay, but no later than seventy-two (72) hours, after we become aware of any Customer Personal Data Breach and will provide timely information relating to the Customer Personal Data Breach as it becomes known or reasonably requested by you. At your request, we will promptly provide you with such reasonable assistance as necessary to enable you to notify relevant Customer Personal Data Breaches to competent authorities and/or affected Data Subjects, if you are required to do so under Data Protection Laws.

3.63.6 Deletion or Return of Customer Personal Data. We will delete or return all Customer Data, including Customer Personal Data (including copies thereof) Processed pursuant to this DPA, on termination or expiration of your Subscription Service in accordance with the procedures set out in our Product Specific Terms. This term will apply except where we are required by applicable law to retain some or all of the Customer Data, or where we have archived Customer Data on back-up systems, which data we will securely isolate and protect from any further Processing and delete in accordance with our deletion practices.

·If you need help retrieving your Customer Data during the Subscription Term, we will provide reasonable assistance to you, at your cost, and in accordance with the 'Confidentiality' section of the General Terms. We will notify you in advance of any applicable costs which will be commercially reasonable.

·You may request the deletion of your HubSpot account after expiration or termination of your subscription by following the steps at the "Cancel your subscription and delete your HubSpot account" knowledge base article. We strongly recommend retrieving your Customer Data prior to the end of your Subscription Term by following the instructions at the following knowledge base articles: "Export your Content and Data"; "Export your Records"; "Export your Ad Performance Data"; "Export your Marketing Email Performance Data"; "Perform a permanent delete in HubSpot." 4. DATA SUBJECT REQUESTS

·The Subscription Service provides you with a number of controls that you can use to retrieve, correct, delete, or restrict Customer Personal Data, which you can use to assist you in connection with your obligations under Data Protection Laws, including your obligations relating to responding to requests from Data Subjects to exercise their rights under Data Protection Laws ("Data Subject Requests").

·To the extent that you are unable to independently address a Data Subject Request through the Subscription Service, then upon your written request we will provide reasonable assistance to you to respond to any Data Subject Requests or requests from data protection authorities relating to the Processing of Customer Personal Data under the Agreement. You will reimburse us for the commercially reasonable costs arising from this assistance, and we will notify you of these costs in advance.

·If a Data Subject Request or other communication regarding the Processing of Customer Personal Data under the Agreement is made directly to us, we will promptly inform you and will advise the Data Subject to submit their request to you. You will be solely responsible for responding substantively to any such Data Subject Requests or communications involving Customer Personal Data. 5. SUB-PROCESSORS

·You agree we may engage Sub-Processors to Process Customer Personal Data on your behalf, and we do so in three ways. First, we may engage Sub-Processors to assist us with hosting and infrastructure. Second, we may engage with Sub-Processors to support product features and integrations. Third, we may engage with HubSpot Affiliates as Sub-Processors for service and support. Some Sub-Processors will apply to you as default, and some Sub-Processors will apply only if you opt in.

·We have currently appointed, as Sub-Processors, the third parties and HubSpot Affiliates listed in Annex 3 to this DPA. You may subscribe to receive notifications by email if we make changes to the HubSpot Sub-Processors Page by completing the form available at https://legal.hubspot.com/subscribe-subprocessor-updates. If you opt in to receive such email, we will notify you at least 30 days prior to any such change.

·We will give you the opportunity to object to the engagement of new Sub-Processors on reasonable grounds relating to the protection of Customer Personal Data within 30 days of notifying you. If you do notify us of such an objection, the parties will discuss your concerns in good faith with a view to achieving a commercially reasonable resolution. If no such resolution can be reached, we will, at our sole discretion, either not appoint the new Sub-Processor, or permit you to suspend or terminate the affected Subscription Service in accordance with the termination provisions of the Agreement without liability to either party (but without prejudice to any fees incurred by you prior to suspension or termination).

·Where we engage Sub-Processors, we will impose data protection terms on the Sub-Processors that provide at least the same level of protection for Customer Personal Data as those in this DPA, to the extent applicable to the nature of the services provided by such Sub-Processors. We will remain responsible for each Sub-Processor's compliance with the obligations of this DPA and for any acts or omissions of such Sub-Processor that cause us to breach any of its obligations under this DPA. 6. DATA TRANSFERS

·You acknowledge and agree that we may access and Process Customer Personal Data on a global basis as necessary to provide the Subscription Service in accordance with the Agreement, and in particular that Customer Personal Data may be transferred to and Processed by HubSpot, Inc. in the United States and to other jurisdictions where HubSpot Affiliates and Sub-Processors have operations. Wherever Customer Personal Data is transferred outside its country of origin, each party will ensure such transfers are made in compliance with the requirements of Data Protection Laws. 7. DEMONSTRATION OF COMPLIANCE

·We will make all information reasonably necessary to demonstrate compliance with this DPA available to you and allow for and contribute to audits, including inspections conducted by you or your auditor in order to assess compliance with this DPA, where required by applicable law. You acknowledge and agree that you will exercise your audit rights under this DPA by instructing us to comply with the audit measures described in this 'Demonstration of Compliance' section. You acknowledge that the Subscription Service is hosted by our hosting Sub-Processors who maintain independently validated security programs (including SOC 2 and ISO 27001) and that our systems are audited annually as part of SOC 2 compliance and regularly tested by independent third party penetration testing firms. Upon request, we will supply (on a confidential basis) our SOC 2 report and summary copies of our penetration testing report(s) to you so that you can verify our compliance with this DPA. You may download copies of these documents from HubSpot's Security website at trust.hubspot.com. Further, at your written request, we will provide written responses (on a confidential basis) to all reasonable requests for information made by you necessary to confirm our compliance with this DPA, provided that you will not exercise this right more than once per calendar year unless you have reasonable grounds to suspect noncompliance with the DPA.

88. ADDITIONAL PROVISIONS FOR EUROPEAN DATA

8.18.1 Scope. This 'Additional Provisions for European Data' section will apply only with respect to European Data that HubSpot Processes on your behalf under the Agreement.

8.28.2 Role of Parties. When Processing European Data in accordance with your Instructions, the parties acknowledge and agree that you are acting either as the Controller, or as a Processor on behalf of another Controller, and we are the Processor under the Agreement.

8.38.3 Instructions. If we believe that your Instruction infringes European Data Protection Laws (where applicable), we will inform you without delay.

8.48.4 Data Protection Impact Assessments and Consultation with Supervisory Authorities. To the extent that the required information is reasonably available to us, and you do not otherwise have access to the required information, we will provide reasonable assistance to you with any data protection impact assessments, and prior consultations with supervisory authorities (for example, the French Data Protection Agency (CNIL), the Berlin Data Protection Authority (BlnBDI) and the UK Information Commissioner's Office (ICO)) or other competent data privacy authorities to the extent required by European Data Protection Laws.

8.58.5 Data Transfers. HubSpot will not transfer European Data to any country or recipient not recognized as providing an adequate level of protection for Customer Personal Data (within the meaning of applicable European Data Protection Laws), unless it first takes all such measures as are necessary to ensure the transfer is in compliance with applicable European Data Protection Laws. Such measures may include (without limitation) (i) transferring such data to a recipient that is covered by a suitable framework or other legally adequate transfer mechanism recognized by the relevant authorities or courts as providing an adequate level of protection for Customer Personal Data, including the Data Privacy Framework; (ii) to a recipient that has achieved binding corporate rules authorization in accordance with European Data Protection Laws; or (iii) to a recipient that has executed the Standard Contractual Clauses in each case as adopted or approved in accordance with applicable European Data Protection Laws.

99. ADDITIONAL PROVISIONS FOR CALIFORNIA PERSONAL INFORMATION

9.19.1 Scope. The 'Additional Provisions for California Personal Information' section of the DPA will apply only with respect to California Personal Information that HubSpot Processes on your behalf under the Agreement.

9.29.2 Role of Parties. When processing California Personal Information in accordance with your Instructions, the parties acknowledge and agree that you are a Business and we are a Service Provider for the purposes of the CCPA.

9.39.3 Responsibilities. We certify that we will Process California Personal Information as a Service Provider strictly for the purpose of performing the Subscription Services and Consulting Services under the Agreement (the "Business Purpose") or as otherwise permitted by the CCPA, including as described in the 'Usage Data' section of our Privacy Policy. Further, we certify that we will not (i) Sell or Share California Personal Information; (ii) Process California Personal Information outside the direct business relationship between the parties, unless required by applicable law; or (iii) combine California Personal Information included in Customer Data with Personal Data that we collect or receive from another source (other than information we receive from another source in connection with our obligations as a Service Provider under the Agreement).

9.49.4 Compliance. We will (i) comply with the obligations applicable to us as a Service Provider under the CCPA; (ii) provide the same level of protection for California Personal Information as is required by the CCPA; and (iii) notify you if we make a determination that we can no longer meet our obligations as a Service Provider under the CCPA.

9.59.5 CCPA Audits. You will have the right to take reasonable and appropriate steps to help ensure that we use California Personal Information in a manner consistent with your obligations under the CCPA. Upon notice, you will have the right to take reasonable and appropriate steps in accordance with the Agreement to stop and remediate unauthorized use of California Personal Information.

9.69.6 Not a Sale. The parties acknowledge and agree that the disclosure of California Personal Information by Customer to HubSpot does not form part of any monetary or other valuable consideration exchanged between the parties. 10. CONTROLLER-TO-CONTROLLER TERMS

10.110.1 Scope. This 'Controller-to-Controller Terms' section will apply to the extent that the parties Process Controller Personal Data in connection with Customer's uses of our enrichment products and the HubSpot Tracking Code when Intent data sharing is enabled.

10.210.2 Role of Parties. The parties acknowledge and agree that they act as Controllers of Controller Personal Data and will comply with their respective obligations under Data Protection Laws when Processing Controller Personal Data. For clarity, nothing in the Agreement or this 'Controller-to-Controller Terms' section shall restrict HubSpot in any way from collecting, using, or sharing data that HubSpot would otherwise Process independently of Customer's use of the Subscription Services, including our enrichment products.

10.310.3 Compliance with Laws. Each party will ensure that the Controller Personal Data it shares or makes available to the other party has been collected in compliance with Data Protection Laws, including (i) providing adequate notices and obtaining any required consents from Data Subjects; (ii) establishing a lawful basis for its Processing of Controller Personal Data; (iii) implementing appropriate technical and organizational measures to protect Controller Personal Data; and (iv) complying with any reporting obligations concerning personal data breaches involving Controller Personal Data. As between the parties, Customer is responsible for providing all necessary notices, consents, and opt-out mechanisms for the use of the HubSpot Tracking Code, and ensuring that its website discloses the use of third-party tracking technology in compliance with Data Protection Laws. If a Data Subject contacts either party to exercise their rights under Data Protection Laws, the contacted party shall either fulfill the request directly or, if this is not feasible, promptly notify and coordinate with the other party to ensure the request is fulfilled in accordance with Data Protection Laws. Customer agrees to delete Enrichment Outputs (as defined under HubSpot's Product Specific Terms) if Customer determines that Customer does not have any independent lawful basis (or substantively similar terms) for Processing such data under Data Protection Laws.

10.410.4 Demonstration of Compliance. If either party receives any complaint, notice, or communication from a supervisory authority or other governmental authority which relates to the other party's: (i) Processing of Controller Personal Data; or (ii) potential failure to comply with Data Protection Laws with respect to the Processing of Controller Personal Data, that party shall direct the supervisory authority or governmental authority to the other party and, in the case of intertwined obligations, claims, or Controller Personal Data at issue, shall provide reasonable assistance to the other party in responding to the supervisory authority or governmental authority.

10.510.5 Security. We will implement and maintain reasonable security measures to protect Controller Personal Data. All Controller Personal Data is protected using appropriate physical, technical, and organizational measures. For more on security at HubSpot, please see https://trust.hubspot.com.

10.610.6 CCPA Compliance. To the extent that the CCPA applies to the Processing of Controller Personal Data, each party acknowledges and agrees that: (i) such Controller Personal Data is made available to the other party solely for the limited and specified purposes set forth in the Agreement; (ii) the party receiving such Controller Personal Data shall comply with and provide the same level of privacy protection as is required by the CCPA; (iii) the party receiving such Controller Personal Data shall promptly notify the other party if it determines it can no longer meet its obligations under the CCPA; and (iv) the party providing such Controller Personal Data shall have the right, upon reasonable notice, to take reasonable and appropriate steps to ensure that the receiving party uses the Controller Personal Data in a manner consistent with its obligations under the CCPA and stop and remediate unauthorized uses of the Controller Personal Data. 11. TRANSFER MECHANISMS

·Where the transfer of Customer Personal Data or Controller Personal Data between the parties involves a Restricted Transfer and European Data Protection Laws require putting in place appropriate safeguards, HubSpot and Customer will comply with the following:

11.111.1 Data Privacy Framework. HubSpot, Inc. participates in and certifies compliance with the Data Privacy Framework. Where and to the extent the Data Privacy Framework applies to the Restricted Transfer, HubSpot, Inc. will (i) provide at least the same level of protection to Customer Personal Data and Controller Personal Data required by the Data Privacy Framework Principles and (ii) inform you if we determine that we are unable to comply with this requirement.

11.211.2 Standard Contractual Clauses. The Standard Contractual Clauses will be incorporated by reference and apply to the Restricted Transfer as follows:

·(A) In relation to Customer Personal Data (i) the Module Two terms apply to the extent Customer is a Controller and the Module Three terms apply to the extent Customer is a Processor of Customer Personal Data; (ii) in Clause 7, the optional docking clause applies; (iii) in Clause 9, Option 2 applies and changes to Sub-Processors will be notified in accordance with the 'Sub-Processors' section of this DPA; (iv) in Clause 11, the optional language is deleted; (v) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes will be determined in accordance with the Jurisdiction Specific Terms of the Agreement or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); (vi) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; and (vii) the supervisory authority that will act as competent supervisory authority will be determined in accordance with GDPR.

·(B) In relation to Controller Personal Data (i) the Module One terms apply; (ii) in Clause 7, the optional docking clause applies; (iii) in Clause 11, the optional language is deleted; (iv) in Clauses 17 and 18, the parties agree that the governing law and forum for disputes will be determined in accordance with the Jurisdiction Specific Terms of the Agreement or, if such section does not specify an EU Member State, the Republic of Ireland (without reference to conflicts of law principles); (v) the Annexes of the Standard Contractual Clauses will be deemed completed with the information set out in the Annexes of this DPA; and (vi) the supervisory authority that will act as competent supervisory authority will be the Irish Data Protection Commission.

·(C) In relation to Customer Personal Data and Controller Personal Data that is subject to the UK GDPR, the Standard Contractual Clauses will apply in accordance with sub-section (A) and the following modifications (i) the Standard Contractual Clauses will be modified and interpreted in accordance with the UK Addendum, which will be incorporated by reference and form an integral part of the Agreement; (ii) Tables 1, 2 and 3 of the UK Addendum will be deemed completed with the information set out in the Annexes of this DPA and Table 4 will be deemed completed by selecting "neither party"; and (iii) any conflict between the terms of the Standard Contractual Clauses and the UK Addendum will be resolved in accordance with Section 10 and Section 11 of the UK Addendum.

·(D) In relation to Customer Personal Data and Controller Personal Data that is subject to the Swiss DPA, the Standard Contractual Clauses will apply in accordance with sub-section (A) and the following modifications (i) references to "Regulation (EU) 2016/679" will be interpreted as references to the Swiss DPA; (ii) references to "EU," "Union," and "Member State law" will be interpreted as references to Swiss law; and (iii) references to the "competent supervisory authority" and "competent courts" will be replaced with the "the Swiss Federal Data Protection and Information Commissioner" and the "relevant courts in Switzerland."

·(E) In relation to Customer Personal Data that HubSpot Processes as a Processor, you agree that by complying with our obligations under the 'Sub-Processors' section of this DPA, HubSpot, Inc. fulfills its obligations under Section 9 of the Standard Contractual Clauses. For the purposes of Clause 9(c) of the Standard Contractual Clauses, you acknowledge that we may be restricted from disclosing Sub-Processor agreements but we will use reasonable efforts to require any Sub-Processor we appoint to permit it to disclose the Sub-Processor agreement to you and will provide (on a confidential basis) all information we reasonably can. You also acknowledge and agree that you will exercise your audit rights under Clause 8.9 of the Standard Contractual Clauses by instructing us to comply with the measures described in the 'Demonstration of Compliance' section of this DPA.

·(F) If and to the extent the Standard Contractual Clauses conflict with any provision of this DPA, the Standard Contractual Clauses will prevail to the extent of such conflict. Where the HubSpot contracting entity under the Agreement is not HubSpot, Inc., such contracting entity (not HubSpot, Inc.) will remain fully and solely responsible and liable to you for the performance of the Standard Contractual Clauses by HubSpot, Inc., and you will direct any instructions, claims or enquiries in relation to the Standard Contractual Clauses to such contracting entity. If HubSpot cannot comply with its obligations under the Standard Contractual Clauses for any reason, and you intend to suspend or terminate the transfer of Personal Data to HubSpot, you agree to provide us with reasonable notice to enable us to cure such non-compliance and reasonably cooperate with us to identify what additional safeguards, if any, may be implemented to remedy such noncompliance. If we have not or cannot cure the non-compliance, you may suspend or terminate the affected part of the Subscription Service in accordance with the Agreement without liability to either party (but without prejudice to any fees you have incurred prior to such suspension or termination).

11.311.3 Alternative Transfer Mechanism. In the event that HubSpot is required to adopt an alternative transfer mechanism under European Data Protection Laws, in addition to or other than the mechanisms described above, such alternative transfer mechanism will apply automatically instead of the mechanisms described in this DPA (but only to the extent such alternative transfer mechanism complies with European Data Protection Laws), and you agree to execute such other documents or take such action as may be reasonably necessary to give legal effect such alternative transfer mechanism. 12. GENERAL PROVISIONS

12.112.1 Amendments. Notwithstanding anything else to the contrary in the Agreement and without prejudice to the 'Compliance with Instructions' or 'Security' sections of this DPA, we reserve the right to make any updates and changes to this DPA and the terms that apply in the 'Amendment; No Waiver' section of the General Terms will apply.

12.212.2 Severability. If any individual provisions of this DPA are determined to be invalid or unenforceable, the validity and enforceability of the other provisions of this DPA will not be affected.

12.312.3 Limitation of Liability. Each party and each of their Affiliates' liability, taken in aggregate, arising out of or related to this DPA (including any other data processing agreements between the parties) and the Standard Contractual Clauses, where applicable, whether in contract, tort or under any other theory of liability, will be subject to the limitations and exclusions of liability set out in the 'Limitation of Liability' section of the General Terms and any reference in such section to the liability of a party means aggregate liability of that party and all of its Affiliates under the Agreement (including this DPA). For the avoidance of doubt, if HubSpot, Inc. is not a party to the Agreement, the 'Limitation of Liability' section of the General Terms will apply as between you and HubSpot, Inc., and in such respect any references to 'HubSpot', 'we', 'us' or 'our' will include both HubSpot, Inc. and the HubSpot entity that is a party to the Agreement. In no event will either party's liability be limited with respect to any individual's data protection rights under this DPA (including any other DPAs between the parties and the Standard Contractual Clauses, where applicable) or otherwise.

12.412.4 Governing Law. This DPA will be governed by and construed in accordance with the 'Contracting Entity; 'Applicable Law; Notice' sections of the Jurisdiction Specific Terms, unless required otherwise by Data Protection Laws. 13. PARTIES TO THIS DPA

13.113.1 Permitted Affiliates. By signing the Agreement, you enter into this DPA (including, where applicable, the Standard Contractual Clauses) on behalf of yourself and in the name and on behalf of your Permitted Affiliates. For the purposes of this DPA only, and except where indicated otherwise, the terms "Customer," "you," and "your" will include you and such Permitted Affiliates.

13.213.2 Authorization. The legal entity agreeing to this DPA as Customer represents that it is authorized to agree to and enter into this DPA for and on behalf of itself and, as applicable, each of its Permitted Affiliates.

13.313.3 Remedies. The parties agree that (i) solely the Customer entity that is the contracting party to the Agreement will exercise any right or seek any remedy any Permitted Affiliate may have under this DPA on behalf of its Affiliates, and (ii) the Customer entity that is the contracting party to the Agreement will exercise any such rights under this DPA not separately for each Permitted Affiliate individually but in a combined manner for itself and all of its Permitted Affiliates together. The Customer entity that is the contracting entity is responsible for coordinating all Instructions, authorizations and communications with us under the DPA and will be entitled to make and receive any communications related to this DPA on behalf of its Permitted Affiliates.

13.413.4 Other Rights. The parties agree that you will, when reviewing our compliance with this DPA pursuant to the 'Demonstration of Compliance' section, take all reasonable measures to limit any impact on us and our Affiliates by combining several audit requests carried out on behalf of the Customer entity that is the contracting party to the Agreement and all of its Permitted Affiliates in one single audit. A. LIST OF PARTIES

·Data exporter:

·Name: The Customer, as defined in the HubSpot Customer Terms of Service (on behalf of itself and Permitted Affiliates)

·Address: The Customer's address, as set out in the Order Form

·Contact person's name, position and contact details: The Customer's contact details, as set out in the Order Form and/or as set out in the Customer's HubSpot account

·Activities relevant to the data transferred under these Clauses: Processing of Customer Personal Data in connection with Customer's use of the HubSpot Subscription Services under the HubSpot Customer Terms of Service

·Role (controller/processor): Controller (either as the Controller; or acting in the capacity of a Controller, as a Processor, on behalf of another Controller)

·Data importer:

·Name: HubSpot, Inc.

·Address: Two Canal Park, Cambridge, MA 02141, USA

·Contact person's name, position and contact details: Nicholas Knoop, Data Protection Officer, HubSpot, Inc., Two Canal Park, Cambridge, MA 02141 USA

·Activities relevant to the data transferred under these Clauses: Processing of Customer Personal Data in connection with Customer's use of the HubSpot Subscription Services under the HubSpot Customer Terms of Service Role (controller/processor): Processor

·B. DESCRIPTION OF TRANSFERCategories of Data Subjects whose Personal Data is Transferred

·You may submit Customer Personal Data in the course of using the Subscription Service, the extent of which is determined and controlled by you in your sole discretion, and which may include, but is not limited to Customer Personal Data relating to the following categories of Data Subjects:

·Your Contacts and other end users including your employees, contractors, collaborators, customers, prospects, suppliers and subcontractors. Data Subjects may also include individuals attempting to communicate with or transfer Customer Personal Data to your end users.

·Categories of Personal Data TransferredYou may submit Personal Data to the Subscription Services, the extent of which is determined and controlled by you in your sole discretion, and which may include but is not limited to the following categories of Personal Data:

11. Contact information (as defined in the General Terms).2. Any other Personal Data submitted by, sent to, or received by you, or your end users, via the Subscription Service.

·Sensitive Data Transferred and Applied Restrictions or SafeguardsThe processing of Sensitive Data is subject to the scope limitations, restrictions, and safeguards mutually agreed upon by the parties, as reflected in the Agreement. Frequency of the TransferContinuous

·Nature of the ProcessingCustomer Personal Data will be Processed in accordance with the Agreement (including this DPA) and may be subject to the following Processing activities:

11. Storage and other Processing necessary to provide, maintain and improve the Subscription Services provided to you; and/or

22. Disclosure in accordance with the Agreement (including this DPA) and/or as compelled by applicable laws.

·Purpose of the Transfer and Further Processing

·We will Process Customer Personal Data as necessary to provide the Subscription Services pursuant to the Agreement, as further specified in the Order Form, and as further instructed by you in your use of the Subscription Services.

·Period for which Personal Data will be retained

·Subject to the 'Deletion or Return of Customer Personal Data' section of this DPA, we will Process Customer Personal Data for the duration of the Agreement, unless otherwise agreed in writing.

·A. LIST OF PARTIESData exporter/importer: Customer

·Name: The Customer, as defined in the HubSpot Customer Terms of Service (on behalf of itself and Permitted Affiliates)

·Address: The Customer's address, as set out in the Order Form

·Contact person's name, position, and contact details, including email: The Customer's contact details, as set out in the Order Form and/or as set out in the Customer's HubSpot account

·Activities relevant to the data transferred under these Clauses: Processing of Controller Personal Data in connection with Customer's use of enrichment products and the HubSpot Tracking Code Role (controller/processor): Controller

·Data exporter/importer: HubSpot, Inc.

·Name: HubSpot, Inc.

·Address: Two Canal Park, Cambridge, MA 02141, USA

·Contact person's name, position, and contact details: Nicholas Knoop, Data Protection Officer, HubSpot, Inc., Two Canal Park, Cambridge, MA 02141 USA

·Activities relevant to the data transferred under these Clauses: Processing of Controller Personal Data in connection with Customer's use of enrichment products and the HubSpot tracking codeRole (controller/processor): Controller B. DESCRIPTION OF TRANSFER

·Categories of Data Subjects whose Personal Data is Transferred Individuals associated with a company or other institution

·Categories of Personal Data Transferred Professional data, which may include, but is not limited to, first and last name, business email address, business employer, business role, professional title, IP address, online identifiers, and other similar information

·Sensitive Data Transferred and Applied Restrictions or Safeguards The parties do not anticipate the transfer of sensitive data. Frequency of the TransferContinuous

·Nature of the Processing Controller Personal Data will be Processed in accordance with the Agreement and may be subject to the following Processing activities: (1) storage and other Processing of Website Data (such as IP addresses and other online identifiers) and Professional Enrichment Data (such as business email addresses) by HubSpot necessary to provide, maintain, append, improve, and develop HubSpot's commercial dataset and the Subscription Services; and/or(2) disclosure in accordance with the Agreement and/or as compelled by applicable laws.

·Purpose(s) of the Transfer and Further Processing Controller Personal Data will be transferred for the purposes contemplated in the Agreement, including to provide Customer with business information and to provide, maintain, append, improve, enhance, and develop HubSpot's commercial dataset and the Subscription Services.

·Period for which Personal Data will be Retained

·Controller Personal Data will be Processed and retained by the parties in accordance with their respective data retention policies or as otherwise set out under the Agreement.

·We currently observe the Security Measures described in this Annex 2. All capitalized terms not otherwise defined herein will have the meanings as set forth in the General Terms. For more information on these security measures, please refer to HubSpot's SOC 2 Type II Report, SOC 3 Report, Security Overview and Penetration Test Summaries, available at trust.hubspot.com. 1. INFORMATION SECURITY POLICY

·We maintain and adhere to an internal, written Information Security Policy. You can visit the HubSpot Trust Center, which provides an overview of our security standards. 2. ACCESS CONTROL

2.12.1 Preventing Unauthorized Product Access. Outsourced processing: We host our Service with outsourced cloud infrastructure providers. Additionally, we maintain contractual relationships with vendors in order to provide the Service in accordance with our DPA. We rely on contractual agreements, privacy policies, and vendor compliance programs in order to protect data processed or stored by these vendors.

·Physical and environmental security: We host our product infrastructure with multi-tenant, outsourced infrastructure providers. We do not own or maintain hardware located at the outsourced infrastructure providers' data centers. Production servers and client-facing applications are logically and physically secured from our internal corporate information systems. The infrastructure providers' physical and environmental security controls are audited for SOC 2 Type II and ISO 27001 compliance, among other certifications.

·Authentication: We implement a uniform password policy for our customer products. Customers who interact with the products via the user interface must authenticate before accessing Customer Personal Data in their HubSpot account.

·Authorization: Customer Data is stored in multi-tenant storage systems accessible to Customers via only application user interfaces and application programming interfaces. Customers are not allowed direct access to the underlying application infrastructure. The authorization model in each of our products is designed to ensure that only the appropriately assigned individuals can access relevant features, views, and customization options. Authorization to data sets is performed through validating the user's permissions against the attributes associated with each data set.

·Application Programming Interface (API) access: Public product APIs may be accessed using Oauth authorization or private app tokens.

2.22.2 Preventing Unauthorized Product Use. We implement industry standard access controls and detection capabilities for the internal networks that support its products.

·Access controls: Network access control mechanisms are designed to prevent network traffic using unauthorized protocols from reaching the product infrastructure. The technical measures implemented differ between infrastructure providers and include Virtual Private Cloud (VPC) implementations, security group assignment, and traditional firewall rules.

·Intrusion detection and prevention: We implement a Web Application Firewall (WAF) solution to protect hosted customer websites and other internet-accessible applications. The WAF is designed to identify and prevent attacks against publicly available network services.

·Static code analysis: Code stored in our source code repositories is checked for best practices and identifiable software flaws using automated tooling.

·Endpoint Harding: Endpoints are hardened in accordance with industry standard practice. Workstations are protected using anti-malware and endpoint detection & response tools, receiving regular definition and signature updates.

2.32.3 Limitations of Privilege and Authorization Requirements. Privileged Access Management: Privileged access in our product environment is controlled, monitored, and removed in a timely fashion through "just in time access" (or "JITA") controls. Non-personal accounts used for system access are stored in a secure vault with additional controls governing privilege elevation and account check out processes.

·Product access: A subset of our employees have access to the products and to customer data via controlled interfaces. The intent of providing access to a subset of employees is to provide effective customer support, product development and research, to troubleshoot potential problems, to detect and respond to security incidents and implement data security. Access is enabled through JITA requests for access; all such requests are logged. Employees are granted access by role, and reviews of high risk privilege grants are initiated daily. Administrative or high risk access permissions are reviewed at least once every six months. 3. TRANSMISSION CONTROL

·In-transit: We require HTTPS encryption (also referred to as SSL or TLS) on all login interfaces and for free on every customer site hosted on the HubSpot products. Our HTTPS implementation uses industry standard algorithms and certificates.

·At-rest: We store user passwords following policies that follow industry standard practices for security. We take a layered approach of at-rest encryption technologies to ensure Customer Data and Customer-identified Permitted Sensitive Data are appropriately encrypted.

44. INCIDENT MANAGEMENT, LOGGING, AND MONITORING

·Incident Response Plan: We maintain a written Incident Response Plan, playbooks, and other necessary processes and procedures to fulfill the standards and obligations reflected therein.

·Detection: We designed our infrastructure to log extensive information about the system behavior, traffic received, system authentication, and other application requests. Internal systems aggregate log data and alert appropriate employees of malicious, unintended, or anomalous activities. Our personnel, including security, operations, and support personnel, are responsive to known incidents.

·Response and tracking: We maintain a record of known security incidents that includes description, dates and times of relevant activities, and incident disposition. Suspected and confirmed security incidents are investigated by security, operations, or support personnel; and appropriate resolution steps are identified and documented. For any confirmed incidents, we will take appropriate steps to minimize product and Customer damage or unauthorized disclosure. Notification to you will be in accordance with the terms of the Agreement. 5. AVAILABILITY CONTROL

·Infrastructure availability: The infrastructure providers use commercially reasonable efforts to ensure a minimum of 99.95% uptime. The providers maintain a minimum of N+1 redundancy to power, network, and heating, ventilation and air conditioning (HVAC) services.

·Fault tolerance: Backup and replication strategies are designed to ensure redundancy and fail-over protections during a significant processing failure. Customer data is backed up to multiple durable data stores and replicated across multiple availability zones.

·Online replicas and backups: Where feasible, production databases are designed to replicate data between no less than 1 primary and 1 secondary instance. All databases are backed up and maintained using at least industry standard methods.

·Disaster Recovery Plans: We maintain and regularly test disaster recovery plans to help ensure availability of information following interruption to, or failure of, critical business processes.

·Our products are designed to ensure redundancy and seamless failover. The server instances that support the products are also architected with a goal to prevent single points of failure. This design assists our operations in maintaining and updating the product applications and backend while limiting downtime. 6. VULNERABILITY MANAGEMENT PROGRAM

·Vulnerability Remediation Schedule: We maintain a vulnerability remediation schedule aligned with industry standards. We take a risk-based approach to determining a vulnerability's applicability, likelihood, and impact in our environment.

·Vulnerability scanning: We perform daily vulnerability scanning on our products using technology and detection standards aligned with industry standards.

·Penetration testing: We maintain relationships with industry-recognized penetration testing service providers for penetration testing of both the HubSpot web application and internal corporate network infrastructure at least annually. The intent of these penetration tests is to identify security vulnerabilities and mitigate the risk and business impact they pose to the in-scope systems.

·Bug bounty: A bug bounty program invites and incentivizes independent security researchers to ethically discover and disclose security flaws. We implement a bug bounty program in an effort to widen the available opportunities to engage with the security community and improve the product defenses against sophisticated attacks. 7. PERSONNEL MANAGEMENT

·We staff qualified personnel to develop, maintain, and enhance our security program. We train all employees on security policy, processes, and standards relevant to their role and in accordance with industry practice.

·Background checks: Where permitted by applicable law, HubSpot employees undergo a third-party background or reference check. In the United States, employment offers are contingent upon the results of a third-party background check. All HubSpot employees are required to conduct themselves in a manner consistent with company guidelines, non-disclosure requirements, and ethical standards.

·To help HubSpot deliver the Subscription Service, we engage Sub-Processors to assist with our data processing activities. A list of our Sub-Processors and our purpose for engaging them is located on our HubSpot Sub-Processors Page available at https://legal.hubspot.com/sub-processors-page, which is incorporated into this DPA.