Global Envoy Supplementary Privacy Notice

This Envoy supplementary privacy notice (“Notice”) is issued by CBRE, Inc and its subsidiaries (“CBRE”).¹ This notice will help you understand our data collection and handling practices when you provide CBRE with your personal data for these purposes.

This document supplements our Global Privacy and Cookie Notice and applies where we act as a Data Controller or equivalent (as defined in the General Data Protection Regulation (EU) 2016/679 or other applicable data privacy law/regulation) for the purposes listed below.

Personal Data We Collect, the Purposes of Collection, and Sources of the Data

CBRE processes your personal data to manage the safety of visitors to our premises and maintain the security of those premises. Further details of how we process your personal data are included in the table below.

ACTIVITY

INFORMATION COLLECTED

SPECIFIC PURPOSES

Registration of visitors

Identifiers such as your name and email address

Professional or employment related information such as your employer or company name

We process this information to understand who is on, or has been on, CBRE’s premises. This information helps us maintain the security of our premises, your safety, and the safety of other people on the premises. We process this information on the legal basis of our legitimate business interest or your consent if required by the applicable local law.

CCTV

Audio, electronic, visual, thermal, olfactory, or similar information such as CCTV imagery

We process CCTV imagery to maintain the security of our premises, your safety, and the safety of other people on the premises. This information also helps us to configure our alarm systems. We process this information on the legal basis of our legitimate business interest.

Sources of Your Personal Data

We collect your personal data directly from you via a webform, when you are invited to attend our premises. We also collect your personal data via our CCTV cameras.

Consequences of Not Providing Personal Data

If you do not provide the personal data on arrival at our premises, you will not be permitted to enter our premises.

Sharing Your Personal Data

We will only share your data in limited circumstances with:

Envoy, Inc and its subsidiaries in the United States, who provide CBRE with visitor management software and data storage; and
Law enforcement agencies, such as the police, to assist in the reporting of any crimes that we believe may have taken place.
Other CBRE entities. CBRE Group is a global firm and the personal information CBRE collects or you provide may be shared and processed with CBRE entities as necessary for the purposes identified above.

International Transfers

CBRE is a global organisation. Accordingly, CBRE employees and the third parties identified above may be located in a country other than your own. Additionally, data in our systems may be stored on CBRE or third party platforms that are located in other countries. CBRE uses appropriate safeguards to protect your personal data when transferred to, or accessed from, other countries.

If required by the applicable local law, we rely on your consent for international transfers of your personal data as described above.

Legally Compelled Disclosure

CBRE may be legally compelled to disclose your personal data to governmental and regulatory authorities, law enforcement agencies, courts or litigants; for example, in response to a court order or other lawful, legally binding request, which may be to meet national security or law enforcement agencies’ requirements, or in connection with legal proceedings or similar processes to exercise or defend our legal rights.

CBRE is committed to not disclose your personal data in response to an international court order or subpoena, or other legal obligation unless we are legally compelled to do so under applicable law.

Retention of Personal Data

CBRE will retain your name, employer or company name, and your email address for a period of two years from the date of your visit to our premises; and we will retain CCTV imagery of you from the date of your visit to our premises, until a limited period permitted by local laws, and no longer than is necessary.

How We Secure Personal Data

CBRE implements appropriate technical and organisational security measures to safeguard the personal data that we collect and process against loss and unauthorised alteration and disclosure.

Where we share your personal data with our service provides, we have assessed that their technical and organisational measures provide an appropriate level of security and have also entered into agreements with them requiring the confidentiality and security of your personal data.

California Privacy Policy

If you are a resident of the State of California (“Consumer”), CBRE’s California Privacy Policy (“California Policy”) supplements the information provided in this Notice and includes information about your privacy rights and how to exercise them. The California Policy applies solely to personal information we have collected from individuals who are residents of the State of California in the twelve (12) months preceding the date on which the California Policy was last updated.

CBRE does not sell nor share Personal Information or Sensitive Personal Information as defined under applicable California law.

Your Data Privacy Rights

You may have certain rights with respect to your personal data under applicable law. Please refer to our Global Privacy and Cookie Policy for more information about your rights and how to exercise them.

Contact CBRE

You are always welcome to contact CBRE’s Global Data Privacy Office by emailing [email protected].