Legal Stuff Update September 18, 2024

KSims · ‎Sep 18, 2024

September 18, 2024, Legal Stuff Update

HubSpot recently updated the following legal documents, which are all included in our Customer Terms of Service:

General Terms (previously updated June 4, 2024)
Product Specific Terms (previously updated June 4, 2024)
Sensitive Data Terms (previously updated August 5, 2024)
Data Processing Agreement (previously updated June 4, 2024)
Sub-Processors Page (previously updated June 4, 2024)
Regional Data Hosting Policy (previously updated June 4, 2024)
Privacy Policy (previously updated January 3, 2024)
Jurisdiction Specific Terms (previously updated June 4, 2024)
Jurisdiction Specific Terms - India (NEW!)
Jurisdiction Specific Terms - Colombia (previously updated May 5, 2023)
Acceptable Use Policy (previously updated May 5, 2023)

Additionally, HubSpot also recently updated the following documents, which we are including here for your convenience, that may apply to your use of our services or websites:

Business Partner DPA (previously updated September 1, 2023)
Affiliate Program Agreement (previously updated March 5, 2024)

We wanted to give you some information on what's changed below. Please remember that this is just an informal, high-level summary of the most recent changes to these documents, and that you should always make sure you’ve read and understood the complete Customer Terms of Service before you use our products or services.

We’ve also made minor drafting clean-ups and clarifications across the terms.

____________________________________________________

General Terms

We’ve updated the definition of Personal Data, which now matches the definition of Personal Data in the DPA.
We worked to improve the ‘Sales Tax’ section by including additional jurisdictions subject to VAT and clarify other tax information.
The new Breeze Intelligence enrichment products are now available!

HubSpot honors customers’ choices about what data to share with us. With the release of the Breeze Intelligence enrichment products, several terms have changed across our Agreement.
To provide customers time to learn about our new services and make meaningful choices about their data sharing preferences, existing customers will have until December 1, 2024, to modify the account settings that enable HubSpot to use the HubSpot Tracking Code data to improve our products and services. If you do not update your settings by December 1, 2024, your account will automatically enable data sharing associated with the HubSpot Tracking Code.
As a result of the additional features and functionality available with Breeze Intelligence products, we updated the ‘Customer Proprietary Rights’ and ‘Limits on HubSpot’ sections to reflect updated data use.
You’ll also see new language around the HubSpot Tracking Code, which can be used with the Breeze Intelligence enrichment products.
In an effort to ease your review, we’ve included a reference to the new Controller-to-Controller terms in the DPA as it relates to the HubSpot Tracking Code and the Breeze Intelligence enrichment products, including information on how you can control data sharing from your account.

We removed the references to the previous AI Product FAQ, and now support AI technical questions in our AI Model Cards available at https://behindhubspotai.com.

Product Specific Terms

The P&S catalog now reflects the number of users supported in the Free Services, so we removed user limit information from the Product Specific terms.
Based on the updates we made to the DPA to include a definition of ‘Customer Personal Data’ we updated the Product Specific Terms to match the new terms to enhance continuity across the Agreement.
We worked to clarify language in the ‘Consulting Services’ section to clarify when the HubSpot Solutions Partner Program Agreement will apply.
The new Breeze Intelligence enrichment products are now available!

We replaced the legacy ‘Insights and Enrichment Data’ section with the new ‘HubSpot Enrichment Products’ section.
This section also includes information that applies when you use the HubSpot Tracking Code.
This is where you can learn how data may be ingested into the HubSpot commercial dataset based on your account and configuration choices.

We are excited to support AI technical and data questions in our AI Model Cards available at https://behindhubspotai.com. Therefore, the references to the previous AI Product FAQ have been removed.

Sensitive Data Terms

HubSpot now supports Protected Health Information subject to HIPAA! We’ve updated the Covered Services Table to include:

Permitted Sensitive Data to include HIPAA data
Additional Covered Services supporting all Sensitive Data types

HubSpot now supports Highly Sensitive Data as a Beta Service, so we’ve similarly updated the Beta Covered Services table to reflect Highly Sensitive Data as Permitted Sensitive Data.
Based on the updated scope of Permitted Data and Covered Services, we’ve updated the definition of Prohibited Sensitive Data to more accurately reflect what data is now prohibited.
You can learn more in the Store Sensitive Data in HubSpot knowledge base article.

Data Processing Agreement

We’ve made changes throughout the Data Processing Agreement to reflect HubSpot processing data in two ways: as a Data Processor and as a Data Controller. Please review the DPA directly for specific details.
In an effort to provide terms that are clear and understandable, we’ve updated the introduction of the DPA to clarify where HubSpot may act as a Data Processor and where HubSpot may act as a Data Controller. We’ve also updated the section links to match the updates throughout the document.
We’ve updated several subsections within the ‘Definitions’ section of the DPA:

The definitions section now includes ‘Controller Personal Data’ and ‘Customer Personal Data’ as defined terms, which you’ll see used throughout the updated terms.
The definitions section includes an updated term for ‘Customer Personal Data Breach’, which you’ll see used throughout the updated terms.
The definition of ‘Data Protection Laws’ was updated to include references to India and Canada for the avoidance of doubt.
The definitions section includes an updated term for ‘Restricted Transfer’, which you’ll see used throughout the updated terms.

The ‘Customer Responsibilities’ section now includes requirements reflecting adequate notice for data subjects and honoring opt-out preferences.
If you would like to delete data from HubSpot, you can export your content and delete your information by following the steps in this knowledge base article. You do not need to submit a request to delete or export data, so we’ve updated the terms of the DPA accordingly.
We’ve updated the ‘Transfer Mechanism’ section in the DPA, including the Data Privacy Framework information, applicable Standard Contractual Clauses, and other alternative transfer mechanism details.
We’ve included a new ‘Controller-to-Controller’ section in the DPA as it relates to the HubSpot Tracking Code and the new Breeze Intelligence enrichment products. As a result, we also made the following changes:

We added “HubSpot as Processor” to the title of ‘Annex 1A - Details of Processing - HubSpot as Processor.’
We included ‘Annex 1B - Details of Processing - HubSpot as Controller’ in the DPA, including the applicable details.

We updated the Sub-Processors Page incorporated into the DPA to update and sub-processor entity names and use case language as part of our ongoing diligence.

Sub-Processors Page

We updated the Sub-Processors Page incorporated into the DPA to update and sub-processor entity names and use case language as part of our ongoing diligence.

Regional Data Hosting Policy

We’ve updated the Regional Data Hosting Policy throughout the document, so be sure to refer to the RDHP directly for details.
We refined the introduction of the RDHP in an effort to be more concise.
We will align future updates to the RDHP with the notice process for the Terms of Service, so we removed the language relating to separate notice requirements.
The ‘Regional Data Hosting and Customer Data’ section has been redrafted to include detailed information in a more clear structure in an effort to easily address common hosting questions.
We updated the RDHP entity information, use cases language, and location details as part of our ongoing diligence.

Privacy Policy

In an effort to provide terms that are clear and understandable, we’ve updated the introduction of the Privacy Policy to illustrate instances where HubSpot may act as a Data Processor or as a Data Controller.

We’ve made changes throughout the Privacy Policy to reflect how HubSpot processes personal data for its own purposes, as a data controller.
You can review the HubSpot DPA for more information about how we process personal data in other ways.
We’ve also updated the quick links following the introduction for your ease of reference.

We updated the ‘Google Products and Integrations’ language to align with third-party requirements and reorganized the terms into a new section in an effort to ease review.
The new Breeze Intelligence enrichment products are now available!

HubSpot honors customers’ choices about what data to share with us. With the release of the Breeze Intelligence enrichment products, several terms have changed across our Agreement.
To provide customers time to learn about our new services and make meaningful choices about their data sharing preferences, existing customers will have until December 1, 2024, to modify the account settings that enable HubSpot to use the HubSpot Tracking Code data to improve our products and services. If you do not update your settings by December 1, 2024, your account will automatically enable data sharing associated with the HubSpot Tracking Code.
We’ve added the ‘Information We Collect and Process in Connection with our Enrichment Products’ section, accordingly. If you’d like to remove your Personal Data from our commercial dataset, complete and submit this form.
We’ve added the ‘Information We Collect and Process via the HubSpot Tracking Code’ section, which may be used with or independent of the Breese Intelligence enrichment products.
We’ve added the ‘Information We Collect and Process via the HubSpot Tracking Code’ section, which may be used with or independent of the Breese Intelligence enrichment products.
In an effort to make your data choices more easily accessible to you, you can now opt out of having your Customer Data used for machine learning by following the instructions on the Opt out of HubSpot's Machine Learning Data Use knowledge base article.
In the ‘How We Share Data’ section, we’ve added a subsection, ‘HubSpot Customers in Connection with our Enrichment Products,’ to provide information about our commercial database.

We updated the ‘California Privacy Rights’ section to reflect updates in data being “sold” or “shared.”

Certain data may be “sold” or “shared” (as defined under the CCPA), including identifiers, to our advertising partners.
Data enrichment services offered under the new Breese Intelligence products include certain data being “sold” or “shared” (as defined under the CCPA), including identifiers, approximate location data, and professional data to our customers.
If you’d like your information to be removed from our commercial dataset, or would like to opt out from the "sharing" of your Personal Data for our advertising and marketing activities, please fill out this form.

We’ve updated the ‘Your Privacy Rights and Choices’ section.

You can now use this form to exercise your privacy rights, such as unsubscribing from email lists.
If you’d like your information to be removed from our commercial dataset, or would like to opt out from the sharing of your Personal Data for our advertising and marketing activities, please submit this form.

Jurisdiction Specific Terms

We’ve updated the table to support local contracting in India coming soon!

Jurisdiction Specific Terms - India

Coming soon! We’re excited to support direct contracting in India in the near future.
If you are a current customer in India, your existing contracting entity will not automatically change; therefore, we may not send an additional notice to existing customers when the India Jurisdiction Specific Terms are available to new customers.

Jurisdiction Specific Terms - Colombia

We’ve updated the ‘Compliance with Laws’ section to include additional SAGRILAFT and PTEE Compliance provisions for customers who contract with HubSpot Latin America S.A.S.

Acceptable Use Policy

We’ve updated the ‘Prohibited Email Actions’ section in an effort to provide additional clarity about prohibited email practices.
We also updated the ‘Proper Usage of the HubSpot Services’ to include information related to the storage and use of Sensitive Data now supported in HubSpot.