1. In the United States, CBRE’s collection, use and disclosure of certain personal information through CBRE’s public websites and professional interactions with CBRE employees is governed by the CBRE Global Web Privacy & Cookie Policy, as well as the following state-specific policies, as applicable:

     

    California Consumer Privacy Notice

    Effective Date: January 1, 2020

    Last Reviewed on: December 18, 2019

    This California Consumer Privacy Notice (“Notice”) supplements the information provided in CBRE’s Global Web Privacy & Cookie Policy. This Notice applies solely to consumers who reside in the State of California (“you”) and generally explains how CBRE Group, Inc. and its subsidiaries (“CBRE”) collect and use Personal Information in relation to your use of our global public websites, your participation in CBRE events and CBRE’s marketing and our business development practices. We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws.

    We reserve the right to update this Notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your Personal Information.

    1. How “Personal Information” Is Defined in this Notice

    2. Personal Information We Collect, Purposes of Use and Sources

    3. Disclosure of Your Personal Information

    4. Sale of Your Personal Information

    5. Right to Know, Access, and to Delete Your Personal Information

    6. How to Exercise Your Rights

    7. Non-Discrimination for Exercising Rights

    8. Disclosures for Third Parties’ Direct Marketing

    1. How “Personal Information” Is Defined in this Notice

      “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household. “Personal information” does not include information publicly and lawfully made available in government records, deidentified or aggregate information about California consumers or households, and information excluded from the CCPA’s scope (for example, health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) and personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994).

    2. Personal Information We Collect, Purposes of Use and Sources

      In this section we set out what categories of Personal Information we collect about you, how we use it, and the sources of such Personal information. This section is to be read together with, and supplements, the information we provide in our Global Web Privacy & Cookie Policy.

      1. General Information

        For general notice on the categories of personal information we may collect and the business or commercial purposes for the use of such Personal Information, please refer to the following information in the Global Web Privacy & Cookie Policy:

      2. Your Right to Know About Personal Information Collected in the last 12 months

        In the last 12 months, CBRE has collected the categories of Personal Information described in the table below. The categories included in the table have been defined in a way that we believe will be meaningful to you:

        • In the second column, we have provided reference to the corresponding category or categories of Personal Information specified in the CCPA. A description of such categories follows directly after this table.

        • In the third column, we set out the business or commercial purpose for use of such information.

        • In the fourth column, we set out the categories of sources from which such information was collected.

         

        Categories of PI collected

        CCPA Category (See Below)

        Business or Commercial Purpose(s)

        Categories of Sources

        Contact information (such as your name, postal or e-mail address, and phone number), Professional Information (such as your name, business or personal email, business phone, business address, country in which you do business, your industry, job title or role, information about your education and qualifications)

        A, B, I

        To communicate with clients, prospective clients, job candidates, and others with whom we have or are inquiring about establishing a business relationship

        To provide offerings and services in which you expressed interest

        To send newsletters and marketing to you

        For other business and marketing purposes

        To identify potential candidates for job openings at CBRE. For more information on our recruitment practices, please see our US Job Applicant Privacy Notice.

        Individual directly or indirectly

        Publicly-available websites

        Third parties, including third party vendors who may share personal information they collect from you with us

        Account information (such as username and password)

        A, B

        We may require you to create an account to access certain information offerings or services

        Individual directly

        Client Relationship Data (such as business contact information, country in which you do business, your industry, job title or role, professional interactions and relationship data, including your primary CBRE contacts and your record of interactions with CBRE, your contact preferences, and information you provide to us which assist us in serving the business relationship, such as the types of investments you are interested in)

        A, B, D

        To provide offerings and services in which you expressed interest

        To send newsletters and marketing to you

        For other business and marketing purposes

        To generate aggregated and de-identified data analytics to improve and better manage our client relationships

        Individual directly or indirectly

         

        Event Attendance Information

        A, B, D

        To administer and facilitate your attendance at any of our events

        Individual directly

        Online identifiers (such as your mobile device advertising identifier and geo-location data)

        A, D, F, G

        To operate, evaluate and improve our online business offerings, including developing new products and services

        To manage our communications

        To determine the effectiveness of and optimize our advertising

        To analyze our products, services, websites, mobile applications and any other digital assets

        To facilitate the functionality of our websites, and mobile applications and any other digital assets

         

         

        Individual directly or indirectly

        Third party vendors

         

        Cookie data

        For more information regarding our use of cookies, see our Cookie Policy.

        A, D, F, K

         

        Individual directly or indirectly

        Third party vendors

         

        Social media interactions with us (for example, when you “like” a post on social media platforms)

        A, B, F, K

         

        Individual directly or indirectly

        Third party vendors

         

        Marketing Data & Technical information from advertisements we place on third party websites (such as your IP address, browser type and version, device identifiers, location and time zone setting)

        A, C, D, F, K

        To better target our advertising and to provide pertinent offers in which we think you would be interested

        Third party vendors

         

         

        The 11 enumerated categories under the definition of “Personal Information” in the CCPA, some of which are referenced in the second column of the table above, are:

        1. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

        2. Any categories of personal information described in subdivision (e) of Section 1798.80 of the California Civil Code.

        3. Characteristics of protected classifications under California or federal law, including age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

        4. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

        5. Biometric information (defined in the CCPA as an individual’s physiological, biological or behavioral characteristics, including an individual’s deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information).

        6. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.

        7. Geolocation data.

        8. Audio, electronic, visual, thermal, olfactory, or similar information.

        9. Professional or employment-related information.

        10. Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).

        11. Inferences drawn from any other type(s) of Personal Information as defined by the CCPA to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

    3. Disclosure of Your Personal Information

      1. General Information

        For general information on the categories of third parties with whom we share your Personal Information, please refer to the following information in the Global Web Privacy & Cookie Policy:

      2. Your Right to Know About Personal Information Shared in the last 12 months

        In the last twelve (12) months, in the course of operating our business, CBRE has disclosed all of the categories of Personal Information identified in column 1 of the table above to the following categories of third parties for a business purpose.

        • Our affiliates.

        • Service providers.

        • Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you, including in government filings.

    4. Sale of Your Personal Information

      1. Your Right to Know About the Sale of Your Personal Information

        California law requires that we provide you with information about certain disclosures of Personal Information to third parties, where the disclosure involves monetary or other consideration. California treats these disclosures as “sales” of information, even if no money changes hands. In the twelve (12) months preceding January 1, 2020, we “sold” certain categories of Personal Information to third parties for a business or commercial purpose, as described in the chart below. As of January 1, 2020, we do not engage in the sale of Personal Information.

      2. Categories of Personal Information Sold

        Categories of PI collected

        CCPA Category (See Above)

        Categories of Third Parties to whom such PI categories were sold

        Contact information & Your Professional Information

        A, B

        Sponsors & Business Partners

        Event Attendance Information

        A, B, D

        Sponsors & Business Partners

         

        Cookie data

        A, F, K

        Advertising Networks

         

         

    5. Right to Know, Access, and to Delete Your Personal Information

      As a consumer residing in the state of the State of California, you have the right to request that: (i) CBRE discloses the categories of Personal Information that we collected, the categories of the sources of such Personal Information, the business or commercial purposes for collecting such Personal Information, the categories of third parties to whom we disclosed such Personal Information, and/or, if we sold or disclosed your Personal Information, the categories of Personal Information that each category of recipient purchased or obtained, and/or (i) that we provide you with copies of such Personal Information. You may make two such (2) requests in any 12-month period.

      Subject to certain exceptions, you may also request that we delete any Personal Information about you that we may hold. We may have grounds to deny your deletion request as provided for in the CCPA.

      Upon receipt of your request to know, for access, or for deletion, we will need to reasonably verify that you are the person about whom we collected Personal Information. We may do so by asking for additional information (“Verifiable Information”) to compare against the information we hold about you, or if you have an account with us, by asking you to log in to that account. We will only use Verifiable Information to verify your identity or authority to make the request. We may also ask you to provide additional detail or clarify your request to allow us to properly understand, evaluate and respond to it.

      Types of Verifiable Information we may ask for depend on the context of your relationship with CBRE, but may include:

      • Name of a CBRE employee with whom you interacted,

      • Date or other details of a transaction you had with CBRE,

      • Email address, phone number, or other contact information we may have on file for you.

    6. How to Exercise Your Rights

      You may exercise your rights to know, access, delete or opt out by completing the form in our Data Subject Rights Portal or by calling us at +1 (866) 428 4722. We will ask for your name, email address, and your relationship to us in order to begin processing your request.

      You may authorize someone to submit a rights request on your behalf. You may do this by providing that person with power of attorney pursuant to the California Probate Code. Alternatively, you may provide that person with signed, written permission to submit requests on your behalf, but we will still require you to verify your identity with us directly by one of the methods listed above. In either case, we will also require that person to verify their personal identity via one of the above methods, or, in the case of a business entity, by response to communications directed at a well-known internet domain associated with that business or to contacts provided in that entity’s official filings with the California Secretary of State.

    7. Non-Discrimination for Exercising Rights

      We are prohibited from discriminating against you because you exercised any of your rights to know, access, delete or opt-out of the sale of your Personal Information.

    8. Disclosures for Third Parties’ Direct Marketing

      Under California’s Shine the Light Act, users of our Website who are California residents may request certain information regarding our disclosure of their Personal Information to third parties (if any), if such information is used for such third parties’ direct marketing purposes. (See Section 4 above). To make such a request, please send an email [email protected] or write us at: CBRE, Inc., 321 North Clark Street, Suite 3400, Chicago, Illinois 60654, Attention: Global Director, Data Privacy.