ServiceInsight Privacy Policy
Last Updated: 07 April 2026
Last Reviewed: 07 April 2026
This CBRE Global ServiceInsight Privacy and Cookie Notice ("Notice") is issued by CBRE, Inc. and its wholly-owned subsidiaries ("CBRE Group") to assist you in understanding our data collection and handling practices when you use the ServiceInsight platform, and associated websites and applications (collectively, "ServiceInsight").
This Notice is also intended to assist you in making informed decisions and exercising your data privacy rights under applicable law.
Whenever this Notice refers to "CBRE", "we", "us" or "our", it refers to the applicable responsible CBRE Group entity/ies defined in Appendix 1 below. Our data collection and handling practices relating to personal data of employees, contractors, and similarly employed individuals of CBRE are further described in our Employee Privacy Notices, which are available (as applicable) on CBRE's employee Intranet.
Table of Contents
- Information About the Responsible CBRE Entity
- Personal Information We Collect and Sources
- Use of Personal Information and Legal Bases
- Sharing of Personal Information
- Retention of Personal Information
- How We Secure Personal Information
- Our Use of Cookies and Similar Technologies
- International Data Transfers
- Your Data Privacy Rights
- California Privacy Policy
- Automated Decision-Making and Artificial Intelligence
- Contact CBRE
- Changes to this Notice
Summary of Key Information
| SCOPE | This Notice applies to the personal information relating to your use of the ServiceInsight platform, and associated websites and applications. |
| RESPONSIBLE ENTITY / DATA CONTROLLER | The Responsible Entity/Data Controller is the CBRE entity that employs you or with which you (or your employer) have entered into an agreement to provide services as a contractor. Please find information on how to identify your applicable responsible CBRE entity (or entities) in Appendix 1. See details below in Information about the Responsible CBRE Entity / Data Controller. |
| PERSONAL INFORMATION WE COLLECT / SOURCES | We collect the following categories of personal information about your employees to provide our services to you:
We collect this information directly from you, from your employer (if you are not a CBRE employee), from our clients, from ServiceInsight as may be generated when you use ServiceInsight and from CBRE's internal commercial and corporate function teams. See details below in Personal Information We Collect and Sources. |
| SPECIAL CATEGORY / SENSITIVE PERSONAL INFORMATION WE COLLECT | Where we may lawfully do so under applicable law, as part of our facilitating access to ServiceInsight using your device's biometric access features, we may ask that you grant ServiceInsight permission to interface with biometric access features on your device, which features process your biometric information (also known as special category or sensitive personal information in some jurisdictions) ("Sensitive Data"). See details below in Personal Information We Collect and Sources. |
| USE OF YOUR PERSONAL INFORMATION AND LEGAL BASES | We use Personal Information as described in this Notice in order to facilitate the provision of services to CBRE clients and the completion or related activities and obligations, including work order assignment and management, monitoring work order completion, provision and maintenance of ServiceInsight, and management of our workforce.
We process Personal Information as described herein based on our legitimate business interests, or your consent (where permitted or required by law). See details below in Use of Personal Data. |
| DATA SHARING | We may share your personal information with other CBRE entities, your employer (if you are not a CBRE employee), the CBRE client(s) (or their agents/representatives) to whom you provide facilities management services, and various third-parties with whom CBRE has a contractual relationship, including, but not limited to, CBRE's service providers and governmental regulators. See details below in Sharing of Personal Data. |
| DATA RETENTION | We retain the personal information we collect about you for as long as necessary for the purpose for which that information was collected or as otherwise legally required. See details below in Retention of Personal Data. |
| DATA SECURITY | We implement appropriate technical and organizational security measures to safeguard the personal information we collect and process about you against loss and unauthorized alteration or disclosure. See details below in How We Secure Your Personal Information. |
| COOKIES | We use cookies and related technologies to provide a better experience of ServiceInsight websites, subject to your consent except for essential cookies. Please see details in Our Use of Cookies below. |
| INTERNATIONAL DATA TRANSFERS | We may share your personal information with other CBRE entities and service providers located outside of your home country. When doing so, we provide appropriate safeguards for international data transfers as required by applicable law. See details below in International Data Transfers. |
| PRIVACY RIGHTS | Depending on the laws in your country, you may have certain rights to request access, rectification, deletion, objection, or other actions regarding your personal information. See details below, including how to exercise any privacy rights you may have under applicable law, in Your Data Privacy Rights. |
| CALIFORNIA CONSUMER PRIVACY POLICY | Additional disclosures required under California law to be made to individuals who are residents of California, including relating to applicable privacy rights, are provided in CBRE's California Privacy Policy. |
| CONTACT CBRE | You are always free to contact us if you have questions or concerns about this Notice or our personal information collection and processing activities. See details below in Contact CBRE. |
| DATA PROTECTION OFFICER | Where required by law, we have appointed a data protection officer whose contact details are disclosed in this Notice. Click here to learn more. |
| EU/UK REPRESENTATIVE | We have appointed a representative for any responsible CBRE entity located outside of the EEA and the UK that process personal information subject to the EU General Data Protection Regulation and UK data protection law. Click here to learn more. |
| CHANGES TO THIS NOTICE | If we make any material changes to this Notice, we will make changes here and, if the changes are significant, we will provide a more prominent notice. Where required, we will obtain your consent. See details below in Changes to this Notice. |
Full Notice
1. Information About the Responsible CBRE Entity / Data Controller
Depending on the legal regulations in your country and the applicable laws to which you are subject (such as in the EU/EEA and UK), you may have the right to information on the CBRE entity (or entities) responsible for collecting and processing your personal information (also known as the data controller in some jurisdictions). The Responsible Entity/Data Controller is the CBRE entity that employs you or with which you (or your employer) have entered into an agreement to provide services as a contractor. Information on how to identify your applicable responsible CBRE entity (or entities) is in Appendix 1.
2. Personal Information We Collect and Sources
a. Categories of Personal Information We Collect and/or Process
Where we may lawfully do so under applicable law, we collect the following categories of personal information directly from you or from other sources, such as your device (with permission), your Identity Provider or CBRE Call Center (for more information on data sources, see Sources from Whom We Collect Personal Information, below).
| Category Number | Category | Examples |
| 1 | Contact information | Your name, postal or e-mail address, and phone number. |
| 2 | Professional information | Your job title, department and name of organization, office location, employer (if not CBRE), the name and contact details of your supervisor or CBRE contact, your professional memberships, your work, education and training history. |
| 3 | Employee Information | Your CBRE employee ID number, name and email address of your CBRE line manager /supervisor (for CBRE employees only). |
| 4 | Authentication Information | Your account number, username and password. |
| 5 | Geo-location information | Your current location as approximated by your mobile device's GPS, whether at specific point in time, or as monitored throughout the workday. |
| 6 | Cookie, Device and Web Analytics Data | Computer Internet Protocol (IP) address, unique device identifier (UDID), cookies and other data linked to a device, and data about your use of the site. For more information, see 7. Our Use of Cookies and Similar Technologies below. |
b. Special Categories of Personal Information
To the extent we may do so under applicable law, we may collect and process categories of personal information relating to you which (depending on the applicable legal regulations and law to which you are subject, such as in the EU/EEA and UK) enjoy special protection by qualifying as special categories of personal information, sensitive personal information or similarly. Examples of such special categories of personal information include the Sensitive Data described herein. We will collect and process those categories of personal information only where allowed by law, subject to any restrictions and additional safeguards as required by law and where relevant to and necessary to facilitate your access to ServiceInsight.
c. Sources From Whom We Collect Personal Information
We collect and process personal information Personal Information as described in this Notice directly from you, from your employer (if you are not a CBRE employee), from our clients, from ServiceInsight as may be generated when you use ServiceInsight and from CBRE's internal commercial and corporate function teams.
d. Consequences of Not Providing Personal Information
If you do not provide the Personal Information described in this Notice:
- You may not be able to use ServiceInsight.
- We may not be able to fulfill our contractual obligations to our clients.
- We may not be able to fulfill certain of our contractual or legal obligations to you, such as assigning you work orders or managing your payroll.
3. Use of Personal Information and Legal Bases
The purposes for which we use your personal information and the legal bases for such processing are as follows:
| Purpose Number | Purpose of Processing | Categories of Personal Data Processed | Lawful Bases of Processing |
| 1 | Creating and managing any accounts you may have with us and responding to your inquiries on the basis of your consent. This includes responding to service and maintenance requests you submit to us and communicating with you about their status | (1) Contact information; (2) Professional information; (3) Employee information; (4) Authentication information; (5) Geo-location information; (6) Cookie, Device and Web Analytics Data |
|
| 2 | Extracting timesheet data of CBRE employees in relation to service and maintenance requests / work orders for operational and reporting purposes | (1) Contact information; (2) Professional information; (3) Employee information; |
|
| 3 | Creating and assigning work orders for completion in accordance with your contract(s) with CBRE. | (1) Contact information; (2) Professional information; (3) Employee information |
|
| 4 | Verifying the completion of work orders through location tracking and geofencing on the basis of your consent | (5) Geo-location information |
|
| 5 | To fulfill CBRE's interests in operating, evaluating and improving our business (including developing new products and services; managing our communications; analyzing our products, services, websites, mobile applications and any other digital assets; facilitating the functionality of our websites, and mobile applications and any other digital assets) | (1) Contact information; (2) Professional information; (6) Cookie, Device and Web Analytics Data |
|
| 6 | Anonymizing personal information and preparing and furnishing aggregated data reports showing anonymized information | (1) Contact information; (2) Professional information; (3) Employee information; (5) Geo-location information; (6) Cookie, Device and Web Analytics Data |
|
| 7 | Enforcing our Terms and Conditions or other legal rights | (1) Contact information; (2) Professional information; (3) Employee information; (4) Authentication information; (5) Geo-location information; (6) Cookie, Device and Web Analytics Data |
|
| 8 | To establish, exercise or defend our legal rights, to comply with lawful government requests for disclosure of personal information or otherwise to comply with legal obligations | (1) Contact information; (2) Professional information; (3) Employee information; (4) Authentication information; (5) Geo-location information; (6) Cookie, Device and Web Analytics Data |
|
a. Legitimate Business Interests
To the extent, CBRE relies on its overriding legitimate business interests for the processing of your personal information, such business interests are in particular:
- Fulfilling our contractual obligations to provide services to clients under the terms of our commercial agreements.
- Facilitate performance of our obligations under our contracts with our clients (e.g., issuing and processing invoices) and suppliers (e.g. managing the supply of goods and services).
- Monitoring how our ServiceInsight platforms, websites and applications are used in order to improve performance and functionality as well as security.
- To maintain an efficient work order fulfillment platform in order to provide our clients with services in the most timely and effective manner as is possible.
- To facilitate management of our workforce, including assignment of projects, monitoring and documenting work order completion, performing accounting for payroll, and carrying out related employee and human resource management activities.
- Establishing, exercising or defending our legal rights and claims.
To the extent any of the processing purposes listed above require the processing of Special Categories of Information, such processing may in particular be permitted under applicable law as the processing is necessary to carry out certain obligations or exercise certain rights in the field of employment, social security and social protection, to establish, exercise or defend a legal claim, for reasons of substantial public interest or of public interest in the area of public health, and other necessary objectives or based on your consent (if required by law).
b. Automated Decision-Making
CBRE does not process any personal data it collects and process via ServiceInsight to make automated decisions.
4. Sharing of Personal Information
Where we can do so lawfully under applicable law, the personal information we collect may be shared and processed with the following categories of recipients, some of whom may be located in a country that does not provide an adequate level of data privacy and protection rights as your home country, as necessary for the purposes identified in Section 3 – Use of Personal Information and Legal Bases, above. CBRE has in place appropriate safeguards regarding internal personal information sharing. See International Data Transfers below for more information. To the extent possible, personal information is shared in an aggregated, pseudonymized or anonymized format.
a. Internally with Other CBRE Entities
CBRE is a global firm and the personal information we collect, or you provide may be shared and processed with CBRE entities as necessary for the purposes identified in Section 3 – Use of Personal Information and Legal Bases, above. The potentially relevant CBRE entities are identified in Appendix 1. In particular:
- When you log into or use ServiceInsight, CBRE, Inc. and other CBRE entities employing site administrators (referred to as data processors in some jurisdictions) will process certain of your personal information in order to manage your access to, maintain, and improve the functionality of the platform. CBRE, Inc. and these CBRE entities employing site administrators may be located outside your home country.
- As part of CBRE's provision of facilities management services to our clients, CBRE's global matrix structure may require that your personal information is transferred to other CBRE entities outside your home country where other CBRE employees who are responsible and accountable for managing services provided to GWS/Facilities Management client, managing the account(s) of clients for whom you provide facilities management services, and ensuring the health and safety of your workplace and achieving other lawful WHSE objectives are located (e.g., regional or global HS&E, regional or global client account leadership, your matrix manager, your line manager, etc.).
b. With Third-Parties
The potentially relevant third-parties include:
- Your employer, where you are not a CBRE employee.
- CBRE Clients, including owners and operators of sites (or their service providers, agents or representatives, such as property managers) to whom you provide facilities management services or with whom CBRE has a contractual or other legal obligation to share your personal information, and only to the extent legally permissible to do so.
- Service Providers, including (i) landlords who assist us with coordinating and performing work orders; and (ii) service providers who assist us insurance claims processing and benefits, IT, cyber security and data hosting providers.
- Insurers, brokers and/or loss adjusters as necessary to file and manage property and workers insurance claims and benefits.
- Consultants and advisors who assist us with legal, regulatory, and business operations activities, such as legal counsel, compliance consultants and business auditors.
- Governmental Regulators as necessary to comply with CBRE's legal obligations in the fields of employment law and occupational health and safety law in certain countries.
- Business partners in case of a merger or sale, such as if CBRE is merged with another organization, or in the event of a transfer of our assets or operations.
c. Legally Compelled Disclosure
We may be required to disclose your personal information to governmental and regulatory authorities, law enforcement agencies, courts and/or litigants when legally compelled to do so, for example, in response to a court order, subpoena or other lawful, legally-binding request, including to meet national security or law enforcement agencies requirements, or in connection with legal proceedings or similar processes as necessary to exercise or defend our legal rights.
CBRE is committed to not disclose your personal information in response to an international court order or a subpoena or other legal obligation, unless we are legally compelled to do so under applicable law. In particular, CBRE, Inc. has assessed and is of the view that neither it nor its US subsidiaries qualify as a provider of electronic communication service, as defined in 18 U.S.C. § 2510, nor a provider of a remote computing service, as defined in 18 U.S.C. § 2711, and thus US public authorities cannot issue a legally binding demand for disclosure of data under Section 702 of the US Foreign Intelligence Surveillance Act ("FISA 702") upon CBRE, Inc. or its US subsidiaries. In case CBRE nevertheless receives at some point a disclosure demand for personal information under FISA 702, we will publish a Transparency Report on cbre.com and our EEA websites. All personal data transferred by CBRE to the US is encrypted in transit.
5. Retention of Personal Information
We will retain your personal information only for as long as required to satisfy the purpose for which such information was collected, unless otherwise required by law or regulation to be retained for a longer period. The information related to work orders will be retained for 10 years from the date of the relevant work order, unless otherwise specified in the client contract or required by law. Should you require further information as to the retention period, please do not hesitate to contact us.
6. How We Secure Personal Information
We implement appropriate technical and organizational security measures to safeguard the personal information we collect and process about you against loss and unauthorized alteration or disclosure. The information you provide is encrypted in transit and at rest. We utilize role-based access controls to limit access to your personal information on a strict need-to-know basis consistent with the purposes for which we have collected such information. We utilize anti-malware and intrusion detection systems to guard against unauthorized access to our network, and we have an incident response plan in place to quickly respond to any suspected leak or breach of personal information.
Where we share your personal information with our service providers, we have assessed that their technical and organizational measures provide an appropriate level of security.
7. Our Use of Cookies and Similar Technologies
We use cookies and similar technologies to collect your personal information when you browse our ServiceInsight websites ("SI websites"), such as https://cmms.serviceinsight.cbre.eu/, https://cmms.serviceinsight.cbre.com/, and https://enterprise.serviceinsight.cbre.com/PRD*****CFG, where ***** are numeric characters which are private to each ServiceInsight customer.
a. What is a Cookie:
A cookie is a small text file that a website stores on your personal computer, telephone or any other device, with information about your navigation on that website. Cookies serve various purposes such as allowing you to navigate between pages efficiently, remembering your preferences, analyzing the use of the SI websites, and generally improving the user experience. A cookie contains the name of the server it came from, the expiry of the cookie, a value – usually a randomly generated unique number as well as other data relating to your use of the SI websites. Depending on the applicable data protection law, such information and data may qualify as personal information.
b. Cookies Used by Us
How we use Cookies:
We use session cookies, which are temporary cookies that are erased from your device's memory when you close your Internet browser or turn your computer off. We do not use persistent cookies, which are stored on your device until they expire, unless you delete them before that time. We group cookies on our SI websites into four categories.
- Essential Cookies: These cookies are necessary to operate and enable the basic functionality of the site. These cookies may also be used to remember and honor your cookie preferences. They cannot be disabled.
- Functional Cookies: These cookies are used to provide you with a better experience on the SI websites. For example, they may be used to embed a video player.
- Performance Cookies: These cookies are used to measure visits to the SI websites and better understand how these websites are used in order to improve the sites' functionality and performance.
- Integrations Cookies: These cookies are used to enable integrations with other sites. For example, they may be used to enable you to import a photo or video from another application or data base.
Consent requirements:
Depending on the applicable data protection law, Functional Cookies, Performance Cookies and Integrations Cookies may require your consent before being placed.
c. Performance Tracking via Similar Tracking Technologies
We sometimes use performance tracking technologies, such as web beacons, pixel and tags on our SI websites. These performance tracking technologies may be provided by us or by third parties and they help us improve functionality of our systems.
8. International Data Transfers
Depending on the CBRE entity that is the responsible CBRE entity (see Appendix 1 below) and the recipients (see Sharing of Personal Information above), your personal information may be processed and hosted in countries other than your home country, such as the United States. Depending on the CBRE entity that is the responsible CBRE entity (see Appendix 1 below) and the recipients (see Sharing of Personal Information above), your personal information may be processed and hosted in countries other than your home country, such as the United States. Those other countries may have less stringent data protection laws than the country in which you reside, in which you initially provided the information and/or in which your information was originally collected.
In case of international data transfers, we will protect your personal information as required by all applicable data protection laws.
a. EEA and UK to Non-EEA Data Transfers
With respect to international data transfers initiated by CBRE from the European Economic Area ("EEA") or UK to recipients in any non-EEA jurisdictions,
- some recipients are located in countries which are considered as providing for an adequate level of data protection under EU law (or UK law, as applicable). These transfers do not, therefore, require any additional safeguards under EU (or UK, as applicable) data protection law.
- other recipients are located in countries not providing an adequate level of data protection under EU or UK law, (or, while located in the U.S., have not certified under the EU-U.S. DPF or UK Extension) and, where required by law, we have implemented appropriate safeguards, such as EU Standard Contractual Clauses, and/or are relying on binding corporate rules of the recipient or an appropriate derogation. Where applicable, we implement supplementary technical and contractual safeguards. Under applicable law you may have the right to ask for further information on such appropriate safeguards (see Section 12 - Contact CBRE below).
As stated above (see Legally Compelled Disclosures), CBRE, Inc. has assessed and is of the view that US public authorities cannot issue a lawful disclosure demand for personal data under FISA 702 upon CBRE, Inc. or its US subsidiaries. All personal data transferred by CBRE to the US is encrypted in transit.
9. Your Data Privacy Rights
Depending on the legal regulations in your country and the applicable laws to which you are subject, you may have all or some of the following rights set out below and may submit a request(s) to exercise any such rights through our Data Subject Rights Portal or by contacting us at [email protected]. Irrespective of the CBRE entity that is responsible for the processing of your personal information, you may use such centralized contact details and CBRE will ensure that the responsible CBRE entity receives your request and addresses it promptly as required by applicable law. CBRE will respond to your request comprehensively, even if you do not identify the particular CBRE entity against whom you make the request.
- Right of access: You may have the right to obtain from CBRE confirmation as to whether your personal information is being processed, and, where that is the case, to request access to your personal information. You may have the right to obtain a copy of your personal information undergoing processing. For additional copies requested by you, CBRE may charge a reasonable fee based on administrative costs.
- Right to rectification: You may have the right to obtain from CBRE the rectification of inaccurate personal information concerning you.
- Right to erasure (right to be forgotten) or anonymization: You may have the right to ask us to erase (or in some jurisdictions, anonymize) your personal information. In some jurisdictions, this right may be limited to deletion or anonymization of data that is unnecessary, excessive, or unlawfully processed, or deletion of data that is processed based on your consent.
- Right to restriction of processing: You may have the right to request the restriction of processing your personal information.
- Right to data portability: You may have the right to receive your personal information which you have provided to CBRE in a structured, commonly used and machine-readable format and you may have the right to transmit those personal information to another entity without hindrance.
- Right to withdraw consent: If we rely on your consent for any personal information processing activities, you have the right to withdraw or revoke this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. This right to withdraw consent applies in particular to consents given for marketing and profiling purposes, if any.
- Right to object: Under certain circumstances, you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal information by CBRE, and CBRE can be required to no longer process your personal information unless CBRE demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. The right to object may, in particular, not exist if the processing of your personal information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
- Right to request an explanation of our processing activity of your personal information
- Right to information on the possibility to withhold consent and information on the consequences of doing so.
- Right to information on third parties with whom we have shared your data.
- Right to lodge a complaint with the competent data protection authority in your home country or in the country in which the responsible CBRE entity is located, in particular with respect to the result of automated decision-making. A list of European Union Data Protection Authorities is available from the European Data Protection Board. In Brazil, the competent data protection authority is the Autoridade Nacional de Proteção de Dados (ANPD).
a. Brazil
In addition to other rights provided under applicable law, with respect to personal information collected and processed within Brazil, you may have the right to request review of decisions taken solely based on the automated processing of personal data which affects your interests, including decisions aimed at defining their personal, professional, consumption and credit profiles or aspects of their personality.
b. China
In addition to other rights provided under applicable law, with respect to personal information collected and processed within China, you may have a right to deregister as a user of an application and cancel online accounts.
10. California Privacy Policy
If you are a resident of the State of California, CBRE's California Privacy Policy ("California Policy") supplements the information provided in this Notice and includes information about your privacy rights and how to exercise them. The California Policy applies solely to personal information we have collected from individuals who are residents of the State of California in the twelve (12) months preceding date on which the California Policy was last updated.
Depending on how you interact with CBRE and your activity on the ServiceInsight platform and associated applications, we may collect the following categories of personal information about you:
- Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers.
- Any personal information described in subdivision (e) of Section 1798.80 of the California Consumer Privacy Act of 2018, as amended by The California Privacy Rights Act of 2020.
- Characteristics of protected classifications under California or federal law.
- Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
- Biometric information.
- Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement.
- Geolocation data.
- Audio, electronic, visual, thermal, olfactory, or similar information.
- Professional or employment-related information.
- Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
- Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
- Sensitive personal information.
CBRE uses this information to achieve the purposes outlined in the 3. Use of Personal Information and Legal Bases section above.
CBRE does not sell nor share Personal Information or Sensitive Personal Information as defined under applicable California law.
11. Automated Decision-Making and Artificial Intelligence
CBRE may use IT systems with artificial intelligence ("AI") to achieve the purposes identified in Processing Purposes and Legal Bases. Any such processing with AI is subject to robust prior screening to ensure that it meets applicable ethical, legal and contractual requirements, complies with this Notice and is subject to human intervention and oversight. In compliance with applicable law, CBRE may also use your Personal Information, generally in aggregated, anonymized or pseudonymized form, for AI development and improvement to increase the quality and efficiency of our service delivery.
12. Contact CBRE
You are always free to contact us if you have questions or concerns regarding this Notice or our data handling practices.
a. General Enquiries
You may contact CBRE's Global Data Privacy Office ("GDPO") at [email protected] or by writing to us at 300 N. La Salle Dr., Suite 600, Chicago IL 60654, Attention: Global Director, Data Privacy. You may also raise questions or concerns about the GDPO to CBRE's Ethics & Compliance department via the CBRE Ethics Helpline.
Individuals in Europe, the Middle East or Africa:
If you are located in Europe, the Middle East or Africa, you may also e-mail us via the GDPO at [email protected] or write to us at Henrietta House, Henrietta Place, London, United Kingdom W1G 0 NB, Attention: EMEA Director, Data Privacy.
Individuals in Asia or the Pacific:
If you are located in Asia or the Pacific, you may also e-mail us via the GDPO at [email protected] or write to us at 15/F M1 Tower, 141 H.V. Dela Costa Street, Salcedo Village, Makati City, Philippines 1227, Attention: APAC Senior Manager, Data Privacy.
b. Data Protection Officers
We have appointed, in accordance with local law, data protection officers ("DPOs") for Responsible CBRE Entities located in France, Germany, Romania, other EU countries (other than France, Germany, and Romania), the UK, Australia, New Zealand, Brazil, Canada, the Dubai International Finance Center, South Korea, the Philippines, and Vietnam. If you have any questions or concerns about our personal information policies or practices, you may contact the appropriate DPO using the following contact details:
EU and UK
| Germany: CBRE GmbH, CBRE PREUSS VALTEQ GmbH, and CBRE Capital Advisors GmbH | [email protected] |
| Germany: CBRE Global Investors Germany GmbH | [email protected] |
| Germany: CBRE GWS Industrial Services GmbH and CBRE GWS IFM Industrie GmbH | [email protected] |
| France | [email protected] |
| Poland | [email protected] |
| Romania | [email protected] |
| Other EU countries (other than France, Germany and Romania) | [email protected] |
| UK | [email protected] |
Outside EU and UK
| Pacific (Australia and New Zealand) | [email protected] |
| Brazil | [email protected] |
| Canada: CBRE Limited | [email protected] |
| Dubai | [email protected] |
| South Korea | [email protected] |
| Malaysia | [email protected] |
| Philippines | [email protected] |
| Singapore | [email protected] |
| Thailand | [email protected] |
| Vietnam | [email protected] |
c. EU and UK Representative
We have appointed a representative for the responsible CBRE entities located outside of the EEA and UK that process your Personal Information subject to the EU General Data Protection Regulation and UK data protection law. The representatives contact details are available in our Global Privacy and Cookie Notice.
13. Changes to this Notice
We are a rapidly evolving, global business. We will continue to assess and make changes to this Notice from time to time as required. If we make any material changes to this Notice, we will make changes here and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Notice changes). Where required, we will obtain your consent.
Appendix 1
In the table below, the responsible CBRE entity (also referred to as data controller in some jurisdictions) for your personal information have been identified, depending on various factors of the processing activity.
If it is unclear to you which CBRE entity is the responsible CBRE entity for the processing of your personal information, please contact [email protected] and we will help you identify the responsible CBRE entity.
| Processing Activity | Responsible CBRE Entity / Data Controller | |
| A. | Processing of your personal information relating to your use of the ServiceInsight platform, and associated websites and applications | The relevant CBRE entity that employs you or with which you (or your employer) have entered into an agreement to provide services as a contractor. |
| B. | Processing of your cookie and web analytics data | CBRE, Inc. 2100 McKinney Avenue, Suite 1250 Dallas, TX 75201 Tel +1 214 979 6100 |