Hotjar

hotjar.com · facts updated 2 days ago

Privacy facts at a glance

Jurisdictions: FR · US · GB · IL · SG · ES · DE · JP · AE · IT · EG · CA · NL · PT · AU · IE
Subprocessors: 30
Retention: Retention duration is specified in Schedule 1 of the DPA depending on the CS Service used, but no specific number of days is stated in the excerpts provided.
Breach notification: The DPA references a 'Personal Data Incident' definition but does not state a specific notification timeframe in the excerpts provided.
Transfer mechanism: SCCs (EU SCCs and UK SCCs), DPF (EU-U.S. Data Privacy Framework), and adequacy decisions used for cross-border transfers.
DPA available: Yes
Certifications: ISO 27001 · ISO 27701 · ISO 27017 · ISO 27018
GDPR addressed: Yes
CCPA addressed: Yes

Named subprocessors

Amazon Web Services, Inc. Microsoft Azure Atlassian Pty Ltd (Jira) Zendesk, Inc. Ada Support, Inc. Content Square SAS Content Square, Inc. Content Square Ltd. Hotjar Germany GmbH Hotjar UK Limited Hotjar Netherlands BV Loris Technologies, Ltd.

Tracked documents

https://www.hotjar.com/privacy/ checked 8 hours ago

https://www.hotjar.com/legal/policies/terms-of-service/ checked 7 hours ago

Data processing agreement

https://contentsquare.com/privacy-center/data-processing-agreement/ checked 8 hours ago

Subprocessor list

https://contentsquare.com/privacy-center/subprocessors/ checked 7 hours ago

Security / trust page

https://www.hotjar.com/security/ checked 6 hours ago

Recent changes

Document updated.

Data processing agreement 3 days ago

Document updated.

major Subprocessor list 4 days ago

Hotjar (Contentsquare) updated the subprocessor list from v2026.3 to v2026.4, expanding the scope of AWS Bedrock and Microsoft Azure LLM processing for the Growth plan from 'Sense Chat feature only' to all Sense AI features, and renumbered sections 2.3/2.4 to 2.2/2.3.

minor Data processing agreement 2 weeks ago

Hotjar's DPA shows removal of version/date metadata and introductory preamble text referencing Contentsquare as the contracting entity, with additions not fully shown in the diff.

major Subprocessor list 2 weeks ago

Hotjar (Contentsquare) updated its subprocessor list from v2026.2 to v2026.3, adding transfer mechanisms (SCCs, DPF, adequacy decisions) to all affiliate and third-party subprocessor entries, adding a new 'Professional Services Sub-processors (OPT-IN ONLY)' section with 10 named processors, removing the 'Client-facing Adoption Dashboard' sub-section (which included Salesforce/Tableau as a subprocessor), and renaming section 2.1 from 'Client-facing Adoption Dashboard' to 'User Lifecycle Extension'.

Subprocessor list 2 weeks ago

Document updated.

Public summary; per-account review history visible to subscribers tracking this vendor.

Track Hotjar in your workspace.

Get notified when Hotjar adds a subprocessor, changes retention, updates their DPA, or quietly amends their privacy posture.

Start tracking — 14-day trial

No card required.