Effective date: January 1, 2020
Last updated: December 31, 2020

This Privacy Notice (“Notice”) is being provided by CBRE, Inc. (“CBRE”, “we”, “us”, our”) to help you understand:

  • what personal information we collect about you,
  • how we use, disclose and safeguard your personal information,
  • how you can update, manage, export, and delete your information,
  • how you can use settings within your device to control your privacy, and
  • how you can contact us about our privacy practices.

Questions Regarding Our Privacy Practices

 

If you have any questions about this Privacy Notice, the processing of your personal data, or would like to be directed to a Data Protection Officer (DPO), please contact [email protected]. Contact information for our global DPOs is also available in our Global Privacy Policy.
We may update this Privacy Notice from time to time.


The Types of Information We Collect and How We Use It

 

The categories of personal information we collect and how we use such information is set out below.

Personal information we collect and how we use it:

Employment Information—the name of your employer, your business email address, and your office location

We collect your business email address when you register with Host Work and verify it with Employment Information provided by your employer to offer you Host Work and to manage our relationship with you, including to contact you about Host Work services. We have a legitimate business interest to use this information for these purposes.

When you purchase food or beverages through the Marketplace or register for events or classes, we may share your name, office location, and email address with our third-party vendors to enable them to fulfill your order or give you access to an event or class. We have a legitimate business purpose to use this information for these purposes.

Your Personal Contact Information—personal (non-business) email address

If you provide us with your personal email address, we will collect that information to provide you with Host Work. We have a legitimate business interest in collecting this information for these purposes.

Device Information—Calendar information

We collect information your work calendar to determine your availability for meetings and to allow you to reserve space at your workplace. We also use room reservation information from your calendar to determine space usage at your workplace. We have a legitimate business interest to collect this information for these purposes.

Device Information—unique ID, frequency of use, click tracking

We generate a unique customer ID for the mobile device on which you download the Host Work app. We collect information on how you use the app, such as how often you use it and which items you click on and combine it with this unique customer ID to enable us to generate anonymized analytics and reports. We do this to improve our app and better serve our customers. We have a legitimate business interest to collect this information for these purposes.

Device Location—Data Location tracking

When you are at your employer’s workplace where Host Work is enabled, we track your device location to connect you with coworkers who are at the same workplace, to enable wayfinding within your office, and to offer you other location-based services. We rely on your express consent to collect this information for these purposes. You may withdraw this consent at any time by adjusting your device settings to not permit the Host Work app to use your location.

Payment Card Information—name, payment card number, expiration date and security code

If you add your payment card information (PCI) into the Host Work app, we send that data to Stripe, our payment card vendor. We do not store your PCI. Your device will store your PCI and send your PCI to Stripe whenever you make a purchase through Host Work. We have a legitimate interest in collecting and transmitting your PCI to Stripe to allow you to make purchases through Host Work.

Food and Beverage Purchase History—the food and beverages order and the cost

When you purchase food or beverages from a third-party vendor through Host Work, we will collect information relating to such purchases to customize our services for you, including providing recommendations. We rely on your express consent to collect this information for these purposes.

Marketplace Orders and Registrations—information collected by our vendors

When you purchase food or beverages through the Marketplace or register for events or classes, we may facilitate the collection of information by our vendors through the app. These vendors are the controllers of this information, and we encourage you to read our vendors’ privacy notices to understand how they will use and store your information.

Service Requests—any information you voluntarily provide

When you submit a service request through the app, we may use any information you provide in order to fulfill your request. We have a legitimate business interest to use this information for these purposes.

Your Contact Information provided by a Third Party—name, business or personal (non-business) email addresses

For any person who visits a Host Work workplace, other than a registered Host Work user, a third party (i.e. a Host Work user) may provide us with your name and business or personal email address. We use this information to allow you access to our workplace. We have a legitimate business interest in collecting this information for these purposes.

Other Uses


We may also use the personal information we obtain about you for the following purposes:

  • Creating and managing any accounts you may have with us and responding to your inquiries;
  • Operating, evaluating and improving our business (including developing new products and services; managing our communications; determining the effectiveness of and optimizing our services; analyzing our products and services; and facilitating the functionality of the Host Work app)
  • Preparing and furnishing aggregated data reports to your employer containing anonymized or pseudonymized information
  • Enforcing our Terms and Conditions or other legal rights.

If you object to us using information in other ways you may communicate your objection to us as specified below under Your Privacy Rights


Third Parties with Whom We Share Your Personal Information


Vendors and Service Providers


We may share your personal information with companies acting as our authorized agents in providing our services, including the following categories of service provider:

  • infrastructure and IT service providers, including cloud service providers
  • external auditors and advisors
  • cookie analytics providers
  • online advertisers
  • providers of website testing / analytics services

Each service provider must agree to implement and maintain reasonable security procedures and practices appropriate to the nature of your information in order to protect your personal information from unauthorized access, destruction, use, modification or disclosure. Because we operate globally, we may transfer your information to countries or jurisdictions that do not provide the same level of data protection as the country in which you are based. If we make such a transfer, we will, or our vendors will, as applicable, provide for the proper safeguards required by applicable law to ensure that your information is protected. More information on International Data Transfers of your personal information is below.

Where we share your personal information for our legitimate interests you can object to this disclosure. Please be aware that when you object to disclosure of your personal information for CBRE’s legitimate interests it may affect the services we provide to you. More information on Your Privacy Rights is below.

Merger or Sale


In the event that CBRE shall be or is merged, or in the event of an intended or actual transfer of our assets, Site or operations, CBRE may disclose or transfer your personal information to third parties is connection with such transaction. In the event of a merger or transfer, CBRE will notify you via email or by posting a prominent notice on our Site for 30 days of any such change in ownership of CBRE resulting in a change of control over your personal information.

Legally Compelled Disclosure


We will also disclose your personal information when required to do so by law or as necessary in connection with legal proceedings or similar processes, for example, in response to a court order or a subpoena or other legal obligation, in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, or in special cases when we have reason to believe that disclosing your personal information is necessary to identify, contact, or bring legal action against someone who may be causing injury or interference with (whether intentionally or unintentionally) our rights or property.

CBRE is committed not to disclose your personal information in response to a court order or a subpoena or other legal obligation unless it is legally compelled to do so. In particular, CBRE, Inc. has assessed and is of the view that it does not qualify as a provider of an electronic communication service, as defined in 18 U.S.C § 2510, nor a provider of a remote computing service, as defined in 18 U.S.C. § 2711, and thus US public authorities cannot issue a data disclosure demand under the US Foreign Intelligence Surveillance Act (FISA) upon CBRE, Inc. You can find further information and our transparency report as regards data disclosures received from public authorities in our Global Privacy Policy.

International Data Transfers 


CBRE is a global business. We may transfer the personal information we collect about you to recipients, and your personal information may be stored and processed, in countries other than the country in which the information was originally collected, including the United States and elsewhere that may have less stringent data protection laws than the country in which you initially provided the information.

When we transfer your information to countries other than the country in which the information was originally collected, we will protect your information as described in this Notice and will comply with all applicable data protection laws in making such transfers.

If you are located outside the United States, the transfer of personal information is necessary to provide you with the requested information and/or to perform any requested service. To the extent permitted by law, such submission also constitutes your consent for the cross-border transfer.

With respect to transfers originating from the European Economic Area or United Kingdom to the United States and other non-EEA jurisdictions, CBRE has executed EU Standard Contractual Clauses with respect to personal information collected in the European Economic Area and transferred to CBRE in the United States and elsewhere.

Where allowed by applicable law, you may ask for further information on the safeguards that we have put in place to safeguard the transfer of your data to outside of the EEA or UK by contacting us as indicated above.

Security


We use appropriate technical and organizational security measures to safeguard the personal data we collect and process about you from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. These security measures are designed to provide a level of security appropriate to the risk. We also have a process to address and remediate any suspected personal data breach and will notify you and any applicable regulator in the event of a breach where we are legally required to do so. 

How Long We Keep Your Personal Information


We will only retain the personal information we collect about you for as long as necessary for the purpose for which that information was collected, and to the extent permitted by applicable laws. We take steps to ensure that when we no longer need to use your personal information, we remove it from our systems and records and/or take steps to anonymize it so that you can no longer be identified from it (unless we need to keep your information to comply with legal or regulatory obligations to which we are subject).

 

Your Privacy Rights


The privacy laws in many countries grant you certain rights concerning your personal data. CBRE honors requests to exercise rights granted to you by applicable law.

European Economic Area


If we collect or process your data in the context of our operations within the European Economic Area, you have the following rights under Regulation 2016/679, the General Data Protection Regulation (GDPR):

  • The right to request access to your data
  • The right to request a copy of your data in a portable format
  • The right to request the correction data we hold about you
  • The right to request that we erase your data
  • The right to request restriction of the processing of your data
  • The right to object to our processing of your data
  • Where we process data based on your consent, the right to withdraw that consent at any time

To exercise any of these rights, please submit a request through our Data Subject Rights Portal or contact us at [email protected].

You also have the right to file a complaint with the applicable Data Protection Authority. A list of Data Protection Authorities is available from the European Data Protection Board.

California


As a consumer residing in the state of the State of California, you may find information about your rights and how to exercise them online in our California Consumer Privacy Policy.

Brazil


If we collect or process your data within the national territory of Brazil, you have the following rights under the Lei Geral de Proteção de Dados Pessoais, Law No. 13,709 of August 14, 2018 (LGPD):

  • The right to confirm that we process your data
  • The right of access to your data
  • The right to a copy of your data in portable format
  • The right of correction of data we hold about you
  • The right to request that we delete or anonymize data that is unnecessary, excessive, or unlawfully processed
  • The right to deletion of data that was processed with your consent
  • The right to information on third parties with whom we have shared your data
  • The right to information on the possibility of not giving consent and about the consequences of the refusal
  • Where we process data on the basis of your consent, the right to revoke consent

To exercise any of these rights, please submit a request through our Data Subject Rights Portal or contact us at [email protected].

You also have the right to bring a complaint about our processing of your data before the Autoridade Nacional de Proteção de Dados (ANPD).

Latin America


We respect the rights that you have under the laws of your country, which may include some or all of the following:

  • The right to confirm that we process your data
  • The right to request access to your data
  • The right to request a copy of your data in portable format
  • The right to request correction of data we hold about you
  • The right to request that we delete or anonymize data that is unnecessary, excessive, or unlawfully processed
  • The right to revoke your consent
  • The right to refuse to provide your data or object to its processing, and information on the consequences of doing so
  • The right to request information on third parties with whom we have shared your data

To exercise any of these rights, please submit a request through our Data Subject Rights Portal or contact us at [email protected].

You may also have the right to lodge a complaint with a supervisory authority. Information on privacy laws and supervisory authorities around the world is available from the French Commission Nationale de l'Informatique et des Libertés.

Elsewhere


You may have rights under applicable law to request to review, access, correct, delete, port or object to us processing your personal information. If so, you may do so by making a request on CBRE’s Data Subject Rights Portal or submitting your request to [email protected]. You may also have the right to lodge a complaint with a supervisory authority. Information on privacy laws and supervisory authorities around the world is available from the French Commission Nationale de l'Informatique et des Libertés.

California Residents Privacy Notice


If you are a California resident, the personal information we collect about you, and the commercial or business purposes for which it is used, is detailed above under The Types of Information We Collect and How We Use It. For more information on our privacy practices and how to exercise your rights under California law, please see our California Consumer Privacy Policy.

Our Privacy Policy


For more information on CBRE, Inc.’s privacy practices, consult our Privacy Policy.