CBRE Investment Management Privacy Notice

Last Updated: 21/11/2024

Last Reviewed: 21/11/2024

This CBRE Investment Management Privacy Notice (“Notice”) is issued by CBRE Investment Management (UK Funds) Limited to assist you in understanding our data collection and handling practices when you participate in a video interview providing your thoughts, opinions, and experiences in relation to your experience as tenant or investor. CBRE intends to use content generated from your interview, including the entire interview or portions of the interview, your image, quotes from your interview, and comments, observations, opinions, experiences shared by you, as component parts of materials used by CBRE to promote affordable housing (all such materials, “Published Materials”).

This Notice is also intended to assist you in making informed decisions and exercising your data privacy rights under applicable law. Whenever this Notice refers to “CBRE”, “we”, “us” or “our”, it refers to the applicable responsible CBRE Group entity/ies defined in Appendix 1 below.

Summary of Key Information
Full Notice
1. Information About the Responsible CBRE Entity
2. Personal Information We Collect and Sources
3. Use of Personal Information and Legal Bases
4. Sharing of Personal Information
5. Retention of Personal Information
6. How We Secure Personal Information
7. International Data Transfers
8. Your Data Privacy Rights
9. Contact CBRE
10. Changes to this Notice

Summary of key information

SCOPE

This Notice applies to the personal information that is collected and processed when you are interviewed as a part of CBRE’s efforts to promote affordable housing.

responsible ENTITY / DATA CONTROLLER

The Data Controller is CBRE Investment Management (UK Funds) Ltd

Please find information on how to identify your applicable responsible CBRE entity (or entities) in Appendix 1. See details below in Information about the Responsible CBRE Entity / Data Controller.

Personal Information we collect and Sources

We collect and process the following categories of Personal Information directly from you when you are interviewed:

Basic data
General Tenancy Information
Image/Likeness
Interview Content

See details below in Personal Information We Collect and Sources.

Use of your Personal Information and Legal Bases

We will use your Personal Information to create the Published Materials, which will be used to promote affordable housing, whether in private presentations, publicly on the internet, on CBRE’s or its agents’ social media accounts, or in any other format through which CBRE chooses to engage in such promotion.

We process this information based on your consent.

See details below in Use of Personal Data.

Data Sharing

We may share your Personal Information with:

Other CBRE group or affiliate entities
Individuals with whom we share the Published Materials, whether directly, or publicly via online or other publication
Service Providers
Consultants and advisors
Business partners in case of a merger or sale

See details below in Sharing of Personal Data.

DATA RETENTION

We retain the personal information we collect about you for as long as necessary for the purpose for which that information was collected or as otherwise legally required. See details below in Retention of Personal Data.

DATA SECURITY

INTERNATIONAL DATA TRANSFERS

We may share your personal information with other CBRE group or affiliate entities and service providers located outside of your home country. When doing so, we provide appropriate safeguards for international data transfers as required by applicable law. See details below in International Data Transfers.

PRIVACY RIGHTS

Depending on the laws in your country, you may have certain rights to request access, rectification, deletion, objection, or other actions regarding your personal information. See details below, including how to exercise any privacy rights you may have under applicable law, in Your Data Privacy Rights.

Contact CBRE

You are always free to contact us if you have questions or concerns about this Notice or our personal information collection and processing activities. See details below in Contact CBRE.

Data Protection Officer

Where required by law, we have appointed a data protection officer whose contact details are disclosed in this Notice. Click here to learn more.

EU/UK Representative

We have appointed a representative for any responsible CBRE entity located outside of the EEA and the UK that process personal information subject to the EU General Data Protection Regulation and UK data protection law. Click here to learn more.

Changes to this Notice

If we make any material changes to this Notice, we will make changes here and, if the changes are significant, we will provide a more prominent notice. Where required, we will obtain your consent. See details below in Changes to this Notice.

Full Notice

1. Information About the Responsible CBRE Entity / Data Controller

Depending on the legal regulations in your country and the applicable laws to which you are subject (such as in the EU/EEA and UK), you may have the right to information on the CBRE entity (or entities) responsible for collecting and processing your personal information (also known as the data controller in some jurisdictions). CBRE Investment Management (UK Funds) Ltd is the Data Controller in relation to this Notice. Information on how to contact the responsible CBRE entity (or entities) is in Appendix 1.

2. Personal Information We Collect and Sources

a. Categories of Personal Information We Collect

Where we may lawfully do so under applicable law, we collect the following categories of personal information directly from you. (for more information on data sources, see Sources from Whom We Collect Personal Information, below).

Basic data: such as your name, gender, title, organization, job responsibilities, phone number, mailing address, email address, contact details and information about family life (excluding special categories of data) including family, children, hobbies and interests.
General Tenancy Information: such as the fact that you are a tenant in UK a social housing property and the general location of such property (e.g. city, town, village, or borough).
Image/Likeness: your image/likeness as captured on video when you are interviewed, including any still images extracted from any such video.
Interview Content: including any comments, observations, opinions, experiences, or other information you share during the course of being interviewed.

b. Special Categories of Personal Information

CBRE does not intend or expect to collect or process categories of personal information relating to you which (depending on the applicable legal regulations and law in to which you are subject, such as in the EU/EEA and UK) enjoy special protection by qualifying as special categories of personal information, sensitive personal information or similarly. Any such information will only be processed if you volunteer such information in the course of your interview, which interview is conducted subject to your express consent. In the event you share any such information in your interview, CBRE will not include it in the Published Materials.

c. Sources From Whom We Collect Personal Information

We collect the personal information we process in accordance with this Notice directly from you.

d. Consequences of Not Providing Personal Information

If you do not provide the information described in this Notice, CBRE may not be able to feature your image, opinions, thoughts, or experiences in the Published Materials.

3. Use of Personal Information and Legal Bases

The purposes for which we use your personal information and the legal bases for such processing are as follows:

To create the Published Materials in order that such Published Materials may be used to promote investing in affordable housing, whether in private presentations, publicly on the internet, on CBRE’s or its agents’ social media accounts, or in any other format through which CBRE chooses to engage in such promotion, Basic Data, General Tenancy Information, Image/Likeness, and Interview Information. We process this information based on your consent.
To establish,exercise or defend our legal rights, to comply with lawful government requests for disclosure of personal information or otherwise to comply with legal obligations, we use any of the personal information we collect about you where legally permissible to do so. We process this personal information where necessary to comply with CBRE’s legal obligations or for other overriding legitimate business interests.

a. Automated Decision-Making

CBRE does not process any personal data it collects and processes in relation to your interview to make automated decisions.

4. Sharing of Personal Information

Where we can do so lawfully under applicable law, the personal information we collect may be shared and processed with the following categories of recipients, some of whom may be located in a country that does not provide an adequate level of data privacy and protection rights as your home country, as necessary for the purposes identified in Section 3 – Use of Personal Information and Legal Bases, above. CBRE has in place appropriate safeguards regarding internal personal information sharing. See International Data Transfers below for more information.

a. Internally with Other CBRE Entities

CBRE is a global firm and the personal information we collect, or you provide may be shared and processed with CBRE entities as necessary for the purposes identified in Section 3 – Use of Personal Information and Legal Bases, above. The potentially relevant CBRE entities are identified in Appendix 1. In particular:

As part of CBRE’s efforts to promote investing in affordable housing, , CBRE's global matrix structure may require that your personal information (including, Sensitive Data) is transferred to other CBRE entities outside your home country where other CBRE employees who are responsible and accountable for Marketing, Digital & Technology Security, Administration or Maintenance, or CBRE Investment Management shared services are located (e.g., regional or Global Marketing).

b. With Third-Parties

The potentially relevant third-parties include:

Service Providers who assist us with administering the Interviews, creating the Published Materials, insurance claims processing and benefits, IT, cyber security and data hosting providers.
Individuals with whom we share the Published Materials, whether directly, or publicly via online or other publication, for the purposes of promoting investment in affordable housing.
Consultants and advisors who assist us with legal, regulatory, and business operations activities, such as legal counsel, compliance consultants and business auditors.
Business partners in case of a merger or sale, such as if CBRE is merged with another organization, or in the event of a transfer of our assets or operations.

c. Legally Compelled Disclosure

We may be required to disclose your personal information to governmental and regulatory authorities, law enforcement agencies, courts and/or litigants when legally compelled to do so, for example, in response to a court order, subpoena or other lawful, legally-binding request, including to meet national security or law enforcement agencies requirements, or in connection with legal proceedings or similar processes as necessary to exercise or defend our legal rights.

CBRE is committed to not disclose your personal information in response to an international court order or a subpoena or other legal obligation, unless we are legally compelled to do so under applicable law. In particular, CBRE, Inc. has assessed and is of the view that neither it nor its US subsidiaries qualify as a provider of electronic communication service, as defined in 18 U.S.C. § 2510, nor a provider of a remote computing service, as defined in 18 U.S.C. § 2711, and thus US public authorities cannot issue a legally binding demand for disclosure of data under Section 702 of the US Foreign Intelligence Surveillance Act ("FISA 702") upon CBRE, Inc. or its US subsidiaries. In case CBRE nevertheless receives at some point a disclosure demand for personal information under FISA 702, we will publish a Transparency Report on cbre.com and our EEA websites (see our Schrems II statement). All personal data transferred by CBRE to the US is encrypted in transit.

5. Retention of Personal Information

We will retain your personal information only for as long as required to satisfy the purpose for which such information was collected, unless otherwise required by law or regulation to be retained for a longer period of no longer than ten (10) years from the date you are interviewed. Should you require further information as to the retention period, please do not hesitate to contact us.

6. How We Secure Personal Information

We implement appropriate technical and organizational security measures to safeguard the personal information we collect and process about you against loss and unauthorized alteration or disclosure. The information you provide is encrypted in transit and at rest. We utilize role-based access controls to limit access to your personal information on a strict need-to-know basis consistent with the purposes for which we have collected such information. We utilize anti-malware and intrusion detection systems to guard against unauthorized access to our network, and we have an incident response plan in place to quickly respond to any suspected leak or breach of personal information.

Where we share your personal information with our service providers, we have assessed that their technical and organizational measures provide an appropriate level of security.

7. International Data Transfers

Depending on the CBRE entity that is the responsible CBRE entity (see Appendix 1 below) and the recipients (see Sharing of Personal Information above), your personal information may be processed and hosted in countries other than your home country, such as the United States, India, and the Philippines. Those other countries may have less stringent data protection laws than the country in which you reside, in which you initially provided the information and/or in which your information was originally collected.

In case of international data transfers, we will protect your personal information as required by all applicable data protection laws.

a. EEA and UK to Non-EEA Data Transfers

With respect to international data transfers initiated by CBRE from the European Economic Area ("EEA") or UK to recipients in any non-EEA jurisdictions,

some recipients are located in countries which are considered as providing for an adequate level of data protection under EU law (or UK law, as applicable). These transfers do not, therefore, require any additional safeguards under EU (or UK, as applicable) data protection law.
other recipients are located in countries not providing an adequate level of data protection under EU or UK law, and, where required by law, we have implemented appropriate safeguards, such as EU Standard Contractual Clauses, and/or are relying on binding corporate rules of the recipient or an appropriate derogation. Where applicable, we implement supplementary technical and contractual safeguards. Under applicable law you may have the right to ask for further information on such appropriate safeguards (see Section 9 - Contact CBRE below).

As stated above (see Legally Compelled Disclosures), CBRE, Inc. has assessed and is of the view that US public authorities cannot issue a lawful disclosure demand for personal data under FISA 702 upon CBRE, Inc. or its US subsidiaries. All personal data transferred by CBRE to the US is encrypted in transit.

8. Your Data Privacy Rights

Depending on the legal regulations in your country and the applicable laws to which you are subject, you may have all or some of the following rights set out below and may submit a request(s) to exercise any such rights through our Data Subject Rights Portal or by contacting us at [email protected]. Irrespective of the CBRE entity that is responsible for the processing of your personal information, you may use such centralized contact details and CBRE will ensure that the responsible CBRE entity receives your request and addresses it promptly as required by applicable law. CBRE will respond to your request comprehensively, even if you do not identify the particular CBRE entity against whom you make the request.

Right of access: You may have the right to obtain from CBRE confirmation as to whether your personal information is being processed, and, where that is the case, to request access to your personal information. You may have the right to obtain a copy of your personal information undergoing processing. For additional copies requested by you, CBRE may charge a reasonable fee based on administrative costs.
Right to rectification: You may have the right to obtain from CBRE the rectification of inaccurate personal information concerning you.
Right to erasure (right to be forgotten) or anonymization: You may have the right to ask us to erase (or in some jurisdictions, anonymize) your personal information. In some jurisdictions, this right may be limited to deletion or anonymization of data that is unnecessary, excessive, or unlawfully processed, or deletion of data that is processed based on your consent.
Right to restriction of processing: You may have the right to request the restriction of processing your personal information.
Right to data portability: You may have the right to receive your personal information which you have provided to CBRE in a structured, commonly used and machine-readable format and you may have the right to transmit those personal information to another entity without hindrance.
Right to withdraw consent: If we rely on your consent for any personal information processing activities, you have the right to withdraw or revoke this consent at any time with future effect. Such a withdrawal will not affect the lawfulness of the processing prior to the consent withdrawal. This right to withdraw consent applies in particular to consents given for marketing and profiling purposes, if any.
Right to object: Under certain circumstances, you may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal information by CBRE, and CBRE can be required to no longer process your personal information unless CBRE demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims. The right to object may, in particular, not exist if the processing of your personal information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
Right to request an explanation of our processing activity of your personal information
Right to information on the possibility to withhold consent and information on the consequences of doing so.
Right to information on third parties with whom we have shared your data.
Right to lodge a complaint with the competent data protection authority in your home country or in the country in which the responsible CBRE entity is located, in particular with respect to the result of automated decision-making. In the UK, the relevant authority is the UK Information Commissioner’s Office.

2. Contact CBRE

You are always free to contact us if you have questions or concerns regarding this Notice or our data handling practices. We may contact you by email in relation to any Observations, Incidents, and Self-Certifications you report or make. If you prefer us to contact you in an alternative manner, please let us know and we will accommodate your request if possible and appropriate.

a. General Enquiries

You may contact CBRE’s Global Data Privacy Office (“GDPO”) at [email protected] or by writing to us at 321 North Clark Street, Suite 3400, Chicago, Illinois 60654, Attention: Global Director, Data Privacy. You may also raise questions or concerns about the GDPO to CBRE’s Ethics & Compliance department via the CBRE Ethics Helpline.

Individuals in Europe, the Middle East or Africa: If you are located in Europe, the Middle East or Africa, you may also e-mail us via the GDPO at [email protected] or write to us at Henrietta House, Henrietta Place, London, United Kingdom W1G 0 NB, Attention: EMEA Director, Data Privacy.

b. Data Protection Officers

In some countries, CBRE has appointed a Data Protection Officer (“DPO”), whom you may contact with questions or concerns about how CBRE processes your Personal Information. Contact information for our DPOs is available in our Global Privacy and Cookie Notice.

c. EU and UK Representative

We have appointed a representative for the responsible CBRE entities located outside of the EEA and UK that process your Personal Information subject to the EU General Data Protection Regulation and UK data protection law. The representatives contact details are available in our Global Privacy and Cookie Notice.

3. Changes to this Notice

We are a rapidly evolving, global business. We will continue to assess and make changes to this Notice from time to time as required. If we make any material changes to this Notice, we will make changes here and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Notice changes). Where required, we will obtain your consent.

Appendix 1

In the table below, the responsible CBRE entity (also referred to as data controller in some jurisdictions) for your personal information have been identified, depending on various factors of the processing activity.

If it is unclear to you which CBRE entity is the responsible CBRE entity for the processing of your personal information, please contact [email protected] and we will help you identify the responsible CBRE entity.

Processing Activity	Responsible CBRE Entity / Data Controller
Administering the Interview and Creating and Utilising the Published Materials	CBRE Investment Management (UK Funds) Limited Third Floor, One New Change London, EC4M 9AF