--- title: "HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks" description: "HubSpot privacy and GDPR compliance in Germany require a DPA, transfer review, EU data hosting assessment, and works council analysis." image: "https://compound.law/assets/images/og-image-en.webp" source: "https://compound.law/en-DE/tools/hubspot/" language: "en" --- ![HubSpot privacy and GDPR compliance for German businesses](https://compound.law/assets/images/tools/tools_3.webp) tools # HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks 3 June 2026 How does HubSpot privacy compliance work in Germany? HubSpot can be used in a GDPR-compliant way in Germany, but not by default. German businesses need a signed DPA acting as an AVV, a review of SCC-based transfers and EU data hosting limits, valid legal bases for CRM and marketing use, and often a works council review for employee-related features. - Sign HubSpot's DPA and document the processor relationship in your Article 30 records of processing activities. - Review EU data hosting, subprocessors, and SCC-backed transfers for any data flows touching the US or other third countries. - Assess email tracking, call analysis, and user activity reporting for co-determination rights under §87(1) No. 6 BetrVG. **HubSpot privacy compliance in Germany is possible, but only with a DPA, transfer review, appropriate configuration, and often works council alignment.** For German businesses, the real question is not whether HubSpot is generically “allowed”, but whether CRM, marketing, and tracking features are deployed in a way that fits **GDPR**, **SCCs**, **EU data hosting**, and **Betriebsrat** requirements. > **Quick buyer check** > > - Is the **Data Processing Agreement (DPA/AVV)** signed and internally approved? > - Have **third-country transfers** been assessed under SCCs and your internal transfer process? > - Is it clear **which HubSpot data can stay in the EU** and which support or infrastructure paths remain global? > - Do tracking, reporting, or call features trigger **works council** rights in Germany? If you are specifically evaluating **HubSpot Breeze AI** or other AI features, use our dedicated guide on [HubSpot Breeze AI GDPR compliance](https://compound.law/en-DE/tools/hubspot-breeze-ai-gdpr/). This page is intentionally focused on the base **HubSpot CRM and marketing compliance** question. This article provides general information only and does not replace legal advice for your specific implementation. For the processor-contract layer, see also our guide to the [Data Processing Agreement / AVV](https://compound.law/en-DE/compliance/data-processing-agreement/). ## HubSpot privacy in Germany: is HubSpot GDPR compliant? **HubSpot is not automatically GDPR compliant, but it can be used lawfully.** Your company remains the controller deciding why and how personal data is processed, while HubSpot typically acts as a processor for many product functions. For German businesses, that means: - the **DPA/AVV** must be in place before live use - legal bases for CRM storage, email communication, cookies, and lead capture should be assessed separately - international transfers should be documented under **SCCs** and your broader transfer assessment - the actual setup should match **data minimization**, retention, access control, and where relevant **works council** requirements HubSpot’s own GDPR materials make the same basic point: the platform can support compliant workflows, but it does not make a customer’s deployment compliant by itself. ## What DPA does HubSpot provide? HubSpot provides a **Data Processing Agreement** that functions as the **Article 28 GDPR processor agreement**, commonly referred to in Germany as the **AVV**. In its DPA, HubSpot addresses the processing of customer personal data and incorporates the **EU Standard Contractual Clauses** for relevant third-country transfers. When reviewing the DPA, focus on more than document existence: 1. **Product scope:** Are the actual hubs, add-ons, and integrations you use included? 2. **Subprocessors:** Which downstream providers are involved, and in which regions? 3. **Transfer structure:** Which SCC modules apply to your controller/processor relationship? 4. **Security and deletion:** Are the TOMs, incident commitments, and deletion mechanics adequate for your use case? HubSpot’s published DPA states that, depending on the role setup, **Module 2** or **Module 3** SCC terms apply to customer personal data. That distinction matters where your organization is operating within a processor chain. ## Where does HubSpot store personal data? HubSpot promotes **EU data hosting** and launched an EU data center on **July 19, 2021**. That is helpful for German businesses, but it should not be read as a blanket “EU only” conclusion. In practice: - some product data can be hosted in the EU - not every data flow will remain exclusively in the EU - support, security, or group-company access may still create global processing touchpoints - subprocessors and connected tools may add further third-country transfers That is why legal, procurement, and IT teams should review the real data architecture rather than relying on a single “EU hosting” label. Comparable questions also arise with tools such as [Salesforce Einstein](https://compound.law/en-DE/tools/salesforce-einstein/) and [Zapier](https://compound.law/en-DE/tools/zapier/), especially where integrations extend the vendor chain. ## What privacy risks remain even with a signed DPA? A signed DPA solves the contract layer only. The common residual risks sit in the **way HubSpot is used**. ### Legal basis for CRM and marketing HubSpot deployments often combine lead capture, newsletter handling, sales communication, website tracking, and internal CRM notes. Those activities do not all rest on the same legal basis. HubSpot’s own GDPR guidance distinguishes between the basis for **processing/storing** data and the basis for **communicating** with contacts. ### Data minimization and deletion Many HubSpot environments expand over time. Old contacts, marketing lists, notes, and tracking records then remain longer than necessary. For German businesses, this is often a **governance issue** more than a software issue: fields, retention rules, exports, and user roles need deliberate control. ### International transfers Even where SCCs are incorporated into HubSpot’s DPA, controllers still need their own view of what data goes where, who can access it, and whether supplementary measures are appropriate in light of post-Schrems II expectations. ### Employee data and performance visibility Once HubSpot is used for sales management, email tracking, call analysis, or activity reporting, the review shifts beyond customer data and into **employee data**. In Germany, that often triggers employment-law and co-determination analysis alongside GDPR review. ## When is the standard review no longer enough? The baseline review of DPA, SCCs, privacy notice, and records of processing is often not enough where: - special-category or high-volume personal data is processed in HubSpot - the deployment sits in highly regulated sectors such as healthcare, finance, or the public sector - HubSpot is used for employee monitoring, sales performance measurement, or call review - **Breeze AI** or similar AI functions are activated with separate data-flow and transparency questions - it is unclear whether a **DPIA** under Article 35 GDPR is required At that point, the review should deepen into data-flow mapping, transfer analysis, permissions design, deletion logic, Article 30 documentation, and coordinated rollout across privacy, HR, IT, and works council stakeholders. ## HubSpot privacy checklist for German businesses Use this as a **procurement and rollout checklist**, not just a marketing recap: - [ ] **DPA signed:** HubSpot’s DPA approved, accepted, and stored in version-controlled vendor records. - [ ] **Product scope defined:** Clear inventory of hubs, add-ons, and integrations in use. - [ ] **Data categories mapped:** Customer, prospect, employee, and tracking data separated in your review. - [ ] **Legal bases documented:** Storage, communications, cookies, and automation assessed individually. - [ ] **EU data hosting checked:** Reviewed against actual product limits and data paths, not only feature labels. - [ ] **SCC transfer review documented:** US or other third-country transfers captured in your privacy process. - [ ] **Subprocessors reviewed:** Current list checked and aligned with vendor-management expectations. - [ ] **Article 30 records updated:** HubSpot added to your records of processing activities. - [ ] **Privacy notices updated:** Website, customer, applicant, or employee notices aligned to real use. - [ ] **Retention rules set:** Contacts, logs, exports, and lists have defined deletion logic. - [ ] **Access model reviewed:** Only necessary teams can access personal data and exports. - [ ] **Works council assessed:** Tracking, reporting, and activity features screened for co-determination. - [ ] **Works agreement prepared:** Where employee data is involved, consultation addressed before rollout. - [ ] **DPIA threshold reviewed:** Article 35 GDPR analysis documented where the use case is higher risk. - [ ] **AI reviewed separately:** For Breeze AI, continue with the dedicated [HubSpot Breeze AI GDPR guide](https://compound.law/en-DE/tools/hubspot-breeze-ai-gdpr/). ## Bottom line for legal, privacy, and procurement **HubSpot is usable for many German businesses, but GDPR compliance has to be actively built.** A DPA alone is not enough. The decisive issues are the real data flows, the split between CRM and marketing legal bases, the transfer assessment, the meaning of **EU data hosting** in practice, and the role of the **works council** once employee-related features are enabled. Compound Law advises businesses across Germany and the DACH region on [compliance and privacy questions](https://compound.law/en-DE/compliance/) as well as vendor contract, transfer, and works council reviews. For a concrete assessment, you can also [book a call](https://compound.law/en-DE/#booking). ## Related Tool Guides [![Canva DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_3.webp)](https://compound.law/en-DE/tools/canva-dpa/) [tools](https://compound.law/en-DE/tools/canva-dpa/) ### [Does Canva Offer a DPA? Yes — Canva DPA Guide for Germany](https://compound.law/en-DE/tools/canva-dpa/) [Yes — Canva provides a Data Processing Addendum on paid plans. See what the Canva DPA covers clause by clause: SCCs, subprocessors, audits, German-law gaps.](https://compound.law/en-DE/tools/canva-dpa/) [![Cursor DPA data processing agreement Art. 28 GDPR review for Germany](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/cursor-dpa/) [tools](https://compound.law/en-DE/tools/cursor-dpa/) ### [Cursor DPA: Yes — What the Anysphere Data Processing Agreement Covers](https://compound.law/en-DE/tools/cursor-dpa/) [Yes, Cursor offers a DPA at cursor.com/terms/dpa. What the Cursor data processing agreement covers under GDPR Art. 28 — and how German buyers should review it.](https://compound.law/en-DE/tools/cursor-dpa/) [![ElevenLabs DPA data processing addendum reviewed under Article 28 GDPR](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/elevenlabs-dpa/) [tools](https://compound.law/en-DE/tools/elevenlabs-dpa/) ### [Does ElevenLabs Offer a DPA? Yes — ElevenLabs DPA Guide for Germany](https://compound.law/en-DE/tools/elevenlabs-dpa/) [Yes — ElevenLabs publishes a Data Processing Addendum at elevenlabs.io/dpa. What the ElevenLabs DPA covers clause by clause under Article 28 GDPR.](https://compound.law/en-DE/tools/elevenlabs-dpa/) [![Synthesia GDPR compliance facts: AI video training policy, DPA, and EU data storage](https://compound.law/assets/images/tools/tools_4.webp)](https://compound.law/en-DE/tools/synthesia/) [tools](https://compound.law/en-DE/tools/synthesia/) ### [Synthesia GDPR: Training, DPA & German Compliance Facts](https://compound.law/en-DE/tools/synthesia/) [No — Synthesia does not train on customer content. GDPR-usable for German firms: Art. 28 DPA and EU storage in Ireland. What to verify before rollout.](https://compound.law/en-DE/tools/synthesia/) [![Claude Pro GDPR compliance review — no DPA means Claude Pro is not suitable for business personal data](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-pro-privacy/) [tools](https://compound.law/en-DE/tools/claude-pro-privacy/) ### [Claude Pro GDPR Compliance: Not for Business, Team vs Enterprise](https://compound.law/en-DE/tools/claude-pro-privacy/) [Claude Pro is not the GDPR-compliant business tier. Claude Team adds the Article 28 DPA; Enterprise adds stronger controls and EU residency options.](https://compound.law/en-DE/tools/claude-pro-privacy/) [![Claude EU hosting options with AWS Bedrock Frankfurt and Google Vertex AI for GDPR compliance](https://compound.law/assets/images/tools/tools_1.webp)](https://compound.law/en-DE/tools/claude-eu-hosting/) [tools](https://compound.law/en-DE/tools/claude-eu-hosting/) ### [Where Is Claude Hosted? EU Hosting & Data Residency Facts (2026)](https://compound.law/en-DE/tools/claude-eu-hosting/) [Where is Claude hosted? No EU residency by default; EU path is Bedrock/Vertex AI](https://compound.law/en-DE/tools/claude-eu-hosting/) Tool Library ### Browse More AI Tools by Topic Compare more tools, privacy issues, and deployment scenarios in the full AI tool library. [View all AI tools](https://compound.law/en-DE/tools/) - [Claude ZDR: What It Covers, Who Qualifies, How to Get It tools](https://compound.law/en-DE/tools/claude-zdr/) - [Cursor DPA: Where to Find It and Which Plan German Teams Need tools](https://compound.law/en-DE/tools/cursor/) - [Is DeepSeek GDPR Compliant? What German Companies Need to Know tools](https://compound.law/en-DE/tools/deepseek/) - [Is Zapier GDPR Compliant? Germany Guide 2026 tools](https://compound.law/en-DE/tools/zapier/) - [Claude Code Data Privacy: GDPR, DPA & No Training Policy tools](https://compound.law/en-DE/tools/claude-code-gdpr/) - [Claude GDPR: Which Claude Plans Work for Germany in 2026 tools](https://compound.law/en-DE/tools/claude-gdpr/) - [Anthropic SCCs: GDPR Data Transfer Guide for Module 2 and 3 tools](https://compound.law/en-DE/tools/anthropic-scc/) - [Zoom AI Companion GDPR Compliance for German Businesses tools](https://compound.law/en-DE/tools/zoom/) - [Claude Team vs Enterprise: Which Plan Is GDPR-Compliant for Your Team? tools](https://compound.law/en-DE/tools/claude-business/) - [Claude Team vs Enterprise: Plan Comparison for German Businesses tools](https://compound.law/en-DE/tools/claude-team-vs-enterprise/) - [Claude Enterprise for Law Firms and Legal Teams tools](https://compound.law/en-DE/tools/claude-enterprise-legal-teams/) - [Anthropic Data Processing Addendum: Where to Find the Official DPA tools](https://compound.law/en-DE/tools/anthropic-data-processing-addendum/) - [Anthropic DPA: GDPR Article 28 Guide for German Companies tools](https://compound.law/en-DE/tools/anthropic-dpa/) - [Claude Enterprise GDPR: DPA Yes, EU Residency No by Default tools](https://compound.law/en-DE/tools/claude-enterprise/) - [Claude Team Plan DPA & GDPR Compliance Guide tools](https://compound.law/en-DE/tools/claude-team-gdpr/) ## Frequently asked questions HubSpot can be used in a GDPR-compliant manner if the DPA is in place, transfers are properly assessed, your legal bases and privacy notices match the real use case, and the concrete configuration is reviewed under German employment and data protection rules. The platform does not make your use automatically compliant. Yes. HubSpot provides a Data Processing Agreement that functions as the Article 28 GDPR processor agreement, commonly called an AVV in Germany. You should still confirm that the actual products, subprocessors, integrations, and transfer mechanisms used in your setup are covered. HubSpot offers EU data hosting for certain data, but depending on product scope, support access, and subprocessor chains, some data flows may still involve processing outside the EU. The right question is not only where data is stored, but also how it is accessed, transferred, and supported. Often yes. If HubSpot allows employee activity, performance, email tracking, call data, or usage logs to be monitored, co-determination rights under German works council law are commonly triggered. A works agreement or comparable consultation should be addressed before rollout. ## Structured data ```json [ { "@context": "https://schema.org", "@type": [ "Organization", "LegalService" ], "@id": "https://compound.law/#organization", "name": "Compound Law", "alternateName": "Compound Law — AI Law Firm", "url": "https://compound.law/", "logo": { "@type": "ImageObject", "url": "https://compound.law/press/logos/PNG/Compound_Law_Icon.png", "width": 1024, "height": 1024 }, "image": "https://compound.law/assets/images/og-image.webp", "description": "The AI-native law firm in Berlin for start-ups, mid-sized companies and corporates: commercial and contract law, data protection, the EU AI Act, trademarks, corporate law, and restructuring and insolvency. A lawyer reviews every result, billed at a flat fee.", "foundingDate": "2026", "founder": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] } ], "employee": [ { "@type": "Person", "name": "Marko Bradic", "jobTitle": "CEO", "url": "https://compound.law/en-DE/tech-team/marko-bradic/", "sameAs": [ "https://www.linkedin.com/in/markobradic/" ], "knowsAbout": [ "Product strategy and development", "Scaling technology companies", "FinTech and financial services", "AI-powered product innovation", "Business operations and growth", "Digital transformation" ] }, { "@type": "Person", "name": "Mohit Tilwani", "jobTitle": "CTO", "url": "https://compound.law/en-DE/tech-team/mohit-tilwani/", "sameAs": [ "https://www.linkedin.com/in/mohit-tilwani/" ], "knowsAbout": [ "Engineering leadership and architecture", "Scaling high-traffic systems", "AI and machine learning infrastructure", "FinTech platform development", "Cloud infrastructure and DevOps", "Product engineering" ] }, { "@type": "Person", "name": "Julian Jantze", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/julian-jantze/", "sameAs": [ "https://www.linkedin.com/in/julian-jantze-957b95158/" ], "knowsAbout": [ "Corporate law and corporate governance for technology companies", "Employment law and HR compliance", "EU AI Act compliance and AI governance", "Employee participation models (VSOP/ESOP)", "Regulatory compliance for tech companies", "Legal operations and Legal Tech implementation" ] }, { "@type": "Person", "name": "Marc Schuba", "jobTitle": "Founding Partner, Rechtsanwalt (German attorney)", "url": "https://compound.law/en-DE/lawyers/marc-schuba/", "sameAs": [ "https://www.linkedin.com/in/marcschuba/" ], "knowsAbout": [ "IP and IT law", "SaaS and IT contracts, IT outsourcing", "Software and open-source licensing", "Data protection law (GDPR)", "AI law and the EU AI Act" ] }, { "@type": "Person", "name": "Dr. Markus Dreißigacker", "jobTitle": "Rechtsanwalt", "url": "https://compound.law/en-DE/lawyers/markus-dreissigacker/", "sameAs": [ "https://www.linkedin.com/in/markusdreissigacker" ], "knowsAbout": [ "M&A (Due diligence, post-merger integration, IPO readiness)", "Corporate Law (Governance, board work, restructuring)", "Commercial Law (Customer contracts, supplier agreements, NDAs)", "IP (Trademark management, IP transfer agreements)", "Compliance & ESG (Global compliance programs, human rights, sustainability)", "Data Protection (GDPR strategy, DPO experience, privacy programs)" ] }, { "@type": "Person", "name": "Philipp Brandt", "jobTitle": "Partner, Rechtsanwalt (German attorney), Specialist Lawyer for Intellectual Property Law", "url": "https://compound.law/en-DE/lawyers/philipp-brandt/", "sameAs": [ "https://www.linkedin.com/in/philipp-brandt-81b446a/" ], "knowsAbout": [ "Restructuring and insolvency law (crisis advice for management, protective shield and insolvency plan proceedings, insolvency administration)", "Intellectual property (trademarks, unfair competition, copyright, trade secrets, licence agreements)", "Data protection law (data breaches, regulatory fine proceedings, access and damages claims)", "Distribution and commercial law (distribution agreements, acquisition and sale of industrial plants)" ] } ], "address": { "@type": "PostalAddress", "addressLocality": "Berlin", "addressCountry": "DE" }, "areaServed": [ "Germany", "Austria", "Switzerland", "European Union", "United Kingdom", "United States", "Singapore" ], "availableLanguage": [ "de", "en" ], "serviceType": [ "AI law firm", "AI-native legal services", "legal counsel for start-ups and growth companies", "legal counsel for mid-sized companies and corporates", "Commercial Law", "Corporate Law", "Employment Law", "Regulatory & Compliance", "Intellectual Property", "Insolvency & Restructuring" ], "hasOfferCatalog": { "@type": "OfferCatalog", "name": "Compound Law services", "itemListElement": [ { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Commercial Contracts", "description": "Battle-tested contracts for your sales process", "serviceType": [ "enterprise contracts", "MSA", "DPA", "sales contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "International Employment", "description": "Compliant hiring across borders", "serviceType": [ "international employment", "hiring abroad", "employment contracts" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "VSOP/ESOP Setup", "description": "Employee participation that actually works", "serviceType": [ "VSOP", "ESOP", "employee stock options", "equity incentives" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Funding Round Support", "description": "Clean legal for your next raise", "serviceType": [ "funding round", "term sheet", "SHA", "due diligence", "cap table" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Corporate Housekeeping", "description": "Get your legal house in order", "serviceType": [ "corporate governance", "board resolutions", "shareholder register" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Data Protection & Privacy", "description": "GDPR compliance that doesn't slow you down", "serviceType": [ "GDPR", "data protection", "privacy", "DPA", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "AI Act Compliance", "description": "Navigate EU AI regulation", "serviceType": [ "AI Act", "AI compliance", "AI governance", "EU AI regulation" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "IP & Competition", "description": "Protect and enforce what you've built", "serviceType": [ "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Fractional General Counsel", "description": "In-house legal without the full-time cost", "serviceType": [ "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "FinTech Compliance", "description": "Navigate financial regulation", "serviceType": [ "fintech compliance", "BaFin", "banking regulation", "AML", "KYC" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Legal Retainer", "description": "Predictable legal support when you need it", "serviceType": [ "legal retainer", "legal subscription", "ongoing legal support" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "M&A Preparation", "description": "Get ready for acquisition interest", "serviceType": [ "M&A preparation", "acquisition", "due diligence", "exit" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } }, { "@type": "Offer", "itemOffered": { "@type": "Service", "name": "Restructuring & Insolvency", "description": "From the first liquidity check to the restructuring itself", "serviceType": [ "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ], "areaServed": [ "Germany", "European Union", "United Kingdom", "United States", "Singapore" ] } } ] }, "contactPoint": { "@type": "ContactPoint", "contactType": "sales", "email": "contact@compound.law", "availableLanguage": [ "English", "German" ], "areaServed": [ "DE", "AT", "CH", "EU", "GB", "US", "SG" ] }, "email": "contact@compound.law", "sameAs": [ "https://www.linkedin.com/company/compoundlawfirm", "https://x.com/CompoundLawFirm" ], "knowsAbout": [ "Commercial Contracts", "enterprise contracts", "MSA", "DPA", "sales contracts", "International Employment", "international employment", "hiring abroad", "employment contracts", "VSOP/ESOP Setup", "VSOP", "ESOP", "employee stock options", "equity incentives", "Funding Round Support", "funding round", "term sheet", "SHA", "due diligence", "cap table", "Corporate Housekeeping", "corporate governance", "board resolutions", "shareholder register", "Data Protection & Privacy", "GDPR", "data protection", "privacy", "cookies", "data breach response", "GDPR fines", "Art. 82 GDPR", "AI Act Compliance", "AI Act", "AI compliance", "AI governance", "EU AI regulation", "IP & Competition", "IP protection", "intellectual property", "trademarks", "trademark enforcement", "warning letters", "preliminary injunctions", "unfair competition", "software licensing", "open source compliance", "Fractional General Counsel", "fractional GC", "fractional general counsel", "outsourced legal", "legal retainer", "FinTech Compliance", "fintech compliance", "BaFin", "banking regulation", "AML", "KYC", "Legal Retainer", "legal subscription", "ongoing legal support", "M&A Preparation", "M&A preparation", "acquisition", "exit", "Restructuring & Insolvency", "restructuring", "insolvency", "StaRUG", "self-administration", "insolvency plan", "director liability" ] }, { "@context": "https://schema.org", "@type": "Article", "headline": "HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks", "description": "HubSpot privacy and GDPR compliance in Germany require a DPA, transfer review, EU data hosting assessment, and works council analysis.", "image": "https://compound.law/assets/images/tools/tools_3.webp", "datePublished": "2026-06-03T00:00:00.000Z", "dateModified": "2026-06-03T00:00:00.000Z", "author": { "@type": "Person", "name": "Dr. Markus Dreißigacker", "image": "https://compound.law/assets/images/team/markusdreissigacker.webp" }, "publisher": { "@type": "Organization", "@id": "https://compound.law/#organization", "name": "Compound Law" }, "mainEntityOfPage": { "@type": "WebPage", "@id": "https://compound.law/en-DE/tools/hubspot/" } }, { "@context": "https://schema.org", "@type": "BreadcrumbList", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "Home", "item": "https://compound.law/en-DE/" }, { "@type": "ListItem", "position": 2, "name": "AI Tools", "item": "https://compound.law/en-DE/tools/" }, { "@type": "ListItem", "position": 3, "name": "HubSpot Privacy in Germany: GDPR, DPA, and Works Council Risks", "item": "https://compound.law/en-DE/tools/hubspot/" } ] }, { "@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [ { "@type": "Question", "name": "How does HubSpot privacy compliance work in Germany?", "acceptedAnswer": { "@type": "Answer", "text": "HubSpot can be used in a GDPR-compliant manner if the DPA is in place, transfers are properly assessed, your legal bases and privacy notices match the real use case, and the concrete configuration is reviewed under German employment and data protection rules. The platform does not make your use automatically compliant." } }, { "@type": "Question", "name": "Does HubSpot have a DPA or AVV?", "acceptedAnswer": { "@type": "Answer", "text": "Yes. HubSpot provides a Data Processing Agreement that functions as the Article 28 GDPR processor agreement, commonly called an AVV in Germany. You should still confirm that the actual products, subprocessors, integrations, and transfer mechanisms used in your setup are covered." } }, { "@type": "Question", "name": "Where does HubSpot store data for German customers?", "acceptedAnswer": { "@type": "Answer", "text": "HubSpot offers EU data hosting for certain data, but depending on product scope, support access, and subprocessor chains, some data flows may still involve processing outside the EU. The right question is not only where data is stored, but also how it is accessed, transferred, and supported." } }, { "@type": "Question", "name": "Do I need a works council agreement for HubSpot?", "acceptedAnswer": { "@type": "Answer", "text": "Often yes. If HubSpot allows employee activity, performance, email tracking, call data, or usage logs to be monitored, co-determination rights under German works council law are commonly triggered. A works agreement or comparable consultation should be addressed before rollout." } } ] } ] ```