HubSpot Marketing Hub

The Data Protection Officer

Workflows with behavioural event triggers and unlimited automated actions exist from Professional upward (up to 300/1,000 workflows per account), plus journey analytics over 15 phases — that clears the single-trigger autoresponder floor. But the evidence is silent on branching, waits, goals, entry/exit conditions, and entirely silent on collision handling: no frequency capping, no suppression across journeys, no priority, no versioning, no per-contact journey state. 2

Report an error

The Data Protection Officer

Automatic lead scoring is confirmed at Professional+ driven by behavioural events, with up to 10,000 logged interactions per contact at Enterprise — but nothing on configurable rules, decay, lifecycle stages, routing or score history. From my chair the decisive absence is explainability: the evidence offers nothing on how a score is computed, so nothing here could be assessed under Art. 22, let alone contested by the individual it scores. 2

Report an error

The Data Protection Officer

Email send limits per tier are explicit and 'omni-channel marketing automation' is asserted at Professional+, but the evidence never names a second channel — no SMS, no push, no on-site personalisation, no ad sync. Crucially there is no evidence that channels share one profile and one consent state; what I see is a tracking code under which HubSpot itself acts as controller of visitor data, which is not a unified customer-controlled profile. 2 3

Report an error

The Data Protection Officer

There is real consent capture tooling — up to 100 banners with geotargeting and GPC support — and a full subject-rights list including objection and consent withdrawal, plus a delete-or-anonymise retention statement. But retention has no fixed period and no per-data-category execution, there is no evidence of a stored consent record with source or wording version, no per-contact switch for tracking or profiling, and nothing on deletion of derived scores; I also note HubSpot positions itself as controller of data collected via the tracking code, which weakens the customer's accountability position. 2 3

Report an error

The Data Protection Officer

A 2,000-app marketplace evidences that integrations exist, and custom-event ingestion and a data agent writing 'smart properties' show the model is extensible in some fashion. But the evidence says nothing about sync mechanics: no bidirectional sync, no field mapping, no deduplication rules, no conflict resolution, no identity resolution between anonymous and known states — the join that decides who a person is is simply undocumented here. 2

Report an error

The Data Protection Officer

The vendor is HubSpot, Inc. of Cambridge, Massachusetts, provenance rest-of-world, and every sovereignty attribute — residency, contracting entity, subprocessors — is unknown; the privacy policy confirms transfers to HubSpot affiliates acting as subprocessors under a DPA annex we cannot see. Behavioural profiles of named EU residents processed by a US controller with unnamed infrastructure and no stated safeguard in evidence: this is close to the floor, softened only marginally by the existence of a processing agreement. 3

Report an error

The Data Protection Officer

The public pricing page states tier boundaries where automation actually begins (1 action free, 10 Starter, unlimited plus omni-channel from Professional), send limits relative to contact tier, workflow and dashboard caps, and even metered credit rates for the AI agents — better than a bare headline. But no currency amounts are quoted in evidence, and overage rates, mandatory onboarding, minimum term and VAT treatment are all absent, so a real annual invoice is not computable from these pages. 1 2

Report an error