Zoho vs HubSpot: Comparing Data Ownership

This is the third piece in a short series that started with HubSpot's withdrawn enrichment terms and continued through data sovereignty and legitimate interests under UK GDPR. This one is more direct: a factual, side-by-side comparison of how Zoho and HubSpot actually handle customer data, drawn from each vendor's own published policies rather than either company's marketing.

We work with Zoho, so we will say upfront that this comparison is not neutral in the sense of having no stake in the outcome. What we have tried to keep neutral is the sourcing. Every claim below is attributed to a specific published policy, dated where the date matters, with the caveat that vendor policies change and you should verify the current wording yourself before making a decision based on it.

Data Ownership and Advertising, Side by Side

Two rows are worth reading carefully rather than skimming. HubSpot's own privacy policy is explicit about sharing data with advertising partners for personalised ads, which is a materially different starting position from a vendor that states outright it does not run an ad-tech business. On the other side, HubSpot publishes a specific, dated government-request transparency report, which is a level of disclosure we could not find an equivalent public document for on Zoho's side during our research. Neither vendor comes out ahead on every row.

What Actually Happened, and What Didn't

It's worth being precise about the July episode, since the coverage has ranged from measured to alarmist.

What Changed at HubSpot

On 1 July 2026, HubSpot updated five linked documents, its customer terms of service, product-specific terms, privacy policy, sub-processors page, and Data Processing Agreement, to enable a new Contact Discovery feature built on pooled enrichment data. Participation was reported to be on by default, with customers needing to actively opt out before 4 August. Reporting also indicated that enrichment participation, AI model training, and tracking-code intent sharing sat as three separate settings, meaning turning one off did not turn off the others.

What Didn't Happen

No regulator intervened, and no lawsuit was filed. The reversal was driven entirely by public criticism, mainly on LinkedIn and in HubSpot's own community forum, over the four days between the announcement and the withdrawal. No customer data was reported to have actually been pooled under the new terms before they were withdrawn, since the underlying feature had not gone live.

Zoho's Position, By Comparison

Zoho has not announced a comparable cross-customer enrichment programme. Its published privacy materials state a long-standing position of not selling personal data and not building an advertising business on customer data. That is Zoho's own stated position, not an independently audited guarantee, and the same standard of verification applies: read the current Zoho privacy policy and DPA yourself rather than taking any summary, including this one, as final.

Who This Actually Matters To

Four Questions for Comparing Any Two CRM Vendors

What This Means for UK and Irish Businesses

If you are choosing between Zoho and HubSpot, or reviewing either one you already use, the comparison above is a starting point, not a verdict. Zoho's stated position on advertising and cross-customer data sharing is genuinely different from what HubSpot's own privacy policy currently describes, and that difference is worth weighing if it matters to your business. It is equally fair to note that HubSpot's public transparency reporting on government data requests is more detailed than anything we could find published in the same format by Zoho, which is a point in HubSpot's favour worth acknowledging rather than glossing over.

The broader lesson from this three-part series holds regardless of which vendor you choose: read the current terms yourself, check every relevant toggle rather than one, and treat a vendor's public commitments as a starting point for your own due diligence rather than a substitute for it.

If you would like help working through either vendor's current terms against your own compliance requirements, we are happy to talk it through with you, no obligation attached.

Legitimate Interests Under UK GDPR: A Business Guide

Two pieces on this site have circled the same underlying issue without quite landing on it directly. In our look at HubSpot's withdrawn enrichment terms, the sticking point was whether "legitimate interests" could really justify pooling customer contact data across accounts. In our piece on data sovereignty, the question was whose laws govern your data once it sits inside a vendor's platform. Both pieces kept bumping into the same legal mechanic: lawful basis, and specifically, the legitimate interests basis that most CRM and marketing processing actually relies on.

This piece goes into that mechanic properly. Not as legal advice, and not as a substitute for your own data protection officer or solicitor, but as a plain-language explanation of how the legitimate interests balancing test actually works, what changed in UK data protection law earlier this year, and where the right to object fits in. If your business runs CRM, marketing automation, or enrichment tools of any kind, this is the test sitting underneath most of what you do with contact data day to day.

The Lawful Bases at a Glance

UK GDPR requires a lawful basis before you process any personal data. There are now seven, following a change earlier in 2026, and most CRM-related processing sits on one of three.

That seventh basis, recognised legitimate interest, is new. It was introduced by the Data (Use and Access) Act 2025, came into force on 5 February 2026, and the ICO published its final guidance on it on 23 March 2026. It is worth knowing it exists, but its five pre-approved conditions are narrow and mostly public-interest focused, so most commercial CRM and marketing processing will still sit on the ordinary legitimate interests basis and its three-part test, not this new one.

How the Legitimate Interests Balancing Test Works

The ICO breaks ordinary legitimate interests down into three stages, sometimes called a Legitimate Interests Assessment or LIA. You need to satisfy all three before you rely on this basis, not just one.

The Purpose Test

First, identify the actual interest you are pursuing, and check it is legitimate. This can be a broad commercial interest, such as running effective sales prospecting, provided it is a genuine and specific reason rather than a vague catch-all.

The Necessity Test

Second, check that the processing is actually necessary to achieve that purpose, not merely convenient. If there is a less intrusive way to achieve the same result, the necessity test becomes harder to satisfy.

The Balancing Test

Third, and usually the hardest, weigh your interest against the rights and reasonable expectations of the person whose data it is. The ICO's own guidance points to a key question here: would this person reasonably expect their data to be used this way? Data collected in the context of one customer relationship being pooled into a shared enrichment dataset for other companies' benefit is exactly the kind of use that tends to fail this expectation test, which is broadly what played out in the HubSpot episode covered in our earlier piece.

Where the Right to Object Fits In

Four Steps to Run Your Own Legitimate Interests Assessment

What This Means for UK and Irish Businesses

None of this is exotic. Most UK and Irish businesses running a CRM already rely on legitimate interests for a good chunk of their day-to-day processing, and in most cases that is entirely appropriate. The HubSpot episode did not fail because legitimate interests can never justify enrichment, it failed the balancing test specifically, because pooling one customer's contact data to benefit other customers is not something most people would reasonably expect when they first handed over their details.

The practical takeaway is the same one raised in our sovereignty piece: ask the specific question rather than accepting a vendor's general assurance. Does your CRM vendor's enrichment or AI training feature rely on legitimate interests, and if so, has that balancing test actually been documented anywhere you can see it? Zoho, like any vendor, expects customers to configure consent and legitimate interest settings correctly themselves. Reading the current settings and the current Data Processing Addendum is still your responsibility as data controller, whichever platform you use.

If you would like a plain-language walkthrough of your current lawful basis position across your CRM and marketing tools, we are happy to talk it through with you, no obligation attached.

HubSpot's Data U-Turn: What It Means for Your CRM

On 1 July 2026, HubSpot told customers it was updating its terms of service to feed enrichment data from customer accounts into a shared commercial dataset, opted in by default. Four days later, following vocal pushback from customers on LinkedIn, HubSpot reversed the change entirely. Co-founder and CTO Dharmesh Shah replied to one of the loudest critics with a one-line admission: "You are right. We made a mistake and have taken steps to correct it."

The episode was brief, but it exposed a question that most businesses running their operations through a SaaS CRM rarely stop to ask: once your customer and prospect data sits inside someone else's platform, who actually controls what happens to it next? For UK and Irish businesses working under UK GDPR, the answer matters more than a single terms-of-service update. It touches data governance, data sovereignty, and how much scrutiny you give a vendor's privacy policy before you sign up.

What Different SaaS Data Models Actually Do With Your Data

Not every CRM vendor treats customer data the same way. The table below sets out three broad approaches, based on how HubSpot's withdrawn Contact Discovery terms were reported and on the publicly available privacy positions of major CRM vendors.

I do not have a verified source confirming that every SaaS vendor in the market avoids cross-customer data pooling entirely, so treat the third row as Zoho's own stated position rather than an independently audited guarantee. It is still worth reading any vendor's current privacy policy yourself before relying on a summary, including this one.

How CRM Data Enrichment Actually Works

Data enrichment is not inherently a problem. Most CRMs use it to fill gaps in a contact record, adding a job title, a company size, or a verified email address so your sales team spends less time on manual research. The question that HubSpot's July announcement raised was not whether enrichment happens, but where the enrichment data comes from and who else benefits from it.

What Counts as Enrichment Data

According to HubSpot's own communications at the time, the fields in scope included names, job titles, company affiliations, work email addresses, and company-level data. Records such as deal notes, call recordings, and custom fields were reportedly excluded. That distinction between "business card" data and deeper CRM content is one worth checking with any vendor, because the line between the two is a policy decision, not a technical necessity.

Where the Shared Dataset Comes In

The reported HubSpot model would have used enrichment data drawn from participating customer accounts to improve records across other customers' accounts too, effectively pooling contact intelligence across the platform. That is a different proposition from enrichment sourced purely from public records or licensed third-party data, because it turns each customer's own CRM into a contributor to everyone else's dataset.

Why GDPR Sits at the Centre of This

Under UK GDPR and the EU GDPR, personal data collected for one purpose, such as running your own sales pipeline, generally needs a proper lawful basis before it is repurposed for another, such as improving a third party's dataset. Vendors often rely on "legitimate interests" as that basis, which requires a genuine balancing test against the individual's rights, not just a line in a terms update. I am not a lawyer and this is not legal advice, so if your business relies on a vendor's enrichment features, it is worth having your data protection officer or legal adviser review the current terms directly rather than relying on any summary, including this article.

Where This Shows Up in Your Business

Four Steps to Check Your Own CRM Data Governance

What This Means for UK and Irish Businesses

The HubSpot reversal was fast, and the company's public apology was direct, but the underlying tension has not gone away. As CRM vendors build more AI-driven prospecting and enrichment features, the value of pooling data across customers keeps growing, and so does the pressure to find a version of that idea customers will accept. Duncan Lennox, HubSpot's Chief Product and Technology Officer, said the company still believes in the underlying goal of better-targeted outreach, and intends to revisit it with what he described as a fully and transparently opt-in model, though with no confirmed date.

For businesses operating under UK GDPR, this is a reasonable moment to ask a vendor directly, in writing, exactly how enrichment, AI model training, and cross-customer data sharing work in your account today, and where your data is hosted. Zoho publishes its privacy and GDPR positions openly, including its stated commitment not to sell personal data or use it for advertising, and offers EU-region hosting and a GDPR-aligned Data Processing Addendum on request. That does not remove your own responsibility as data controller, but it does give you a clearer starting point for the conversation.

If you are reviewing your CRM setup, your data processing agreements, or simply want a second pair of eyes on your current privacy and enrichment settings, we are happy to have that conversation without the sales pressure.