Privacy Notice

As the data controller of your personal information for the purposes of the EU General Data Protection Regulation (“GDPR”) and applicable local law and regulation, "CBRE Hana Operations, LLC" (hereinafter: “CBRE Hana”, “we”, “us” or “our”), recognizes the importance of protecting your privacy. This Privacy Notice (the “Notice”) is designed to assist you in understanding how we collect, share, use, and safeguard the Personal Data (as further defined below) we collect and/or process in relation to your query related to the Hana business, and your rights with respect to your Personal Data. It also describes how you can contact us about our privacy practices.

For purposes of this Notice, Personal Data means any information through which we can identify you as an individual, as further described below in "What Personal Data is collected and how it is collected".


Information that you provide directly:

  • We collect and process the following types of information relating to you when submit your request for additional information about CBRE Hana and our Services:

    • Full name and contact details, including address, phone number, email address
    • Country of residence
    • Employer and/or job title
    • Any other information you may provide with your request

Information about other people.

  • If you are providing information about another person or persons, you confirm that they have appointed you to act for them, that you have informed them of our identity, the information you intend to provide to us and the purposes for which such information will be processed, and that you have provided them with a copy of this Notice before providing us with their information.


We collect, share and use your Personal Data for the purposes below (unless otherwise indicated at the point of collection) and on a legal basis as is described below:

To provide you with more information about our Services, as per your request: By submitting your personal information via the Hana website, you are requesting that CBRE Hana contact you via email and/or telephone to provide you with additional information about our service offerings. We will not contact you in relation to any services other than those provided by CBRE Hana.

To comply with our legal obligations: Any data referred to above in the section ‘What Personal Data is collected' may be used to comply with a legal obligation to which we are subject, including, but not limited to, maintaining appropriate business records, complying with lawful requests by governmental agencies and public authorities, complying with our health and safety obligations, and to comply with applicable laws and regulations.


We share your Personal Data internally with other entities within the CBRE Group for the purposes described above. We will also disclose your Personal Data as may be necessary:

  • to our professional advisors, such as lawyers, auditors and accountants
  • to our vendors who provide data processing, IT, software, information security and related services
  • to any competent law enforcement body, regulatory or government agency, court or other third party where we believe disclosure is necessary to comply with applicable law or regulation, exercise, establish or defend our legal rights or the rights of our Property Manager or for the administration of justice, or to protect the vital interests of you or any other person
  • to any person for whom you consent to our making disclosure, and
  • as may otherwise be set out in this Notice or communicated to you at the point of collection.

Our contracts with our professional advisors, vendors and other third parties with whom we share your Personal Data, limit their use of your Personal Data and do not permit use of your Personal Data for their own (marketing) purposes. Consistent with applicable legal requirements, we take commercially reasonable steps to require third parties to adequately safeguard your Personal Data and only process it in accordance with our instructions.


As set out above, we may transfer the Personal Data we collect about you to recipients, and your Personal Data may be stored and processed, in countries other than the country in which the information was originally collected, including the United States and elsewhere that may have less stringent data protection laws than the country in which you initially provided the information, including the United States, Switzerland, and other countries or territories.

When we transfer your Personal Data to countries other than the country in which the information was originally collected, we will protect such data in accordance with applicable data protection laws.


CBRE is a signatory to the E.U.–U.S., and Swiss–U.S. Privacy Shield Frameworks for all HR and non-HR data. Cross-border data transfers from the European Union, United Kingdom, and Switzerland to the United States will be safeguarded pursuant to CBRE’s Privacy Shield commitments.

In compliance with the EU-US and Swiss-US Privacy Shield Principles, CBRE commits to resolve complaints about our collection or use of your personal data. Individuals located within the E.U., United Kingdom, or Switzerland may direct their inquiries or complaints regarding our Privacy Shield policy to


We store your Personal Data on a secure server, and use appropriate technical and organizational measures designed to protect the Personal Data we collect from unauthorized access, destruction, use, modification or disclosure. We take all reasonable measures to ensure that your data is only accessible to those persons or organizations who require it in order to perform their duties or obligations as they relate to your tenancy. Although we will take commercially reasonable security precautions regarding your Personal Data, we cannot guarantee that any of your Personal Data stored on our servers, or transmitted to or from a user, will be free from unauthorized access, and we disclaim any liability for any theft or loss of, unauthorized access or damage to, or interception of any data or communications.


We retain your Personal Data for as long as required to satisfy the purpose for which they were collected and used. It may be necessary to retain certain Personal Data longer in order to comply with applicable legal, obligations or to defend a legal claim.


You have the right to be provided with clear, transparent, and easily understandable information about how we use your Personal Data, and your rights related to your Personal Data under the GDPR and applicable local law and regulation, which information is contained in this Notice.

Additionally, subject to applicable law, you have the right to request, review, correct, update, suppress, restrict or require that we delete Personal Data that you have provided to us, and to request to receive an electronic copy of such Personal Data for purposes of transmitting it to another company, by sending an email to our Data Subject Request Team at specifying your request. Responses to your request will be made consistent with applicable law.

In your request, please tell us what Personal Data you would like to have provided to you, changed, whether suppressed from our database, or otherwise let us know what limitations you would like to put on our use of it. We will try to comply with your request as soon as reasonably practicable.

Please note that we may need to retain certain Personal Data for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion.

In the event your Personal Data is processed on the basis of your consent, you can withdraw consent at any time by sending an email to specifying your request, without affecting the lawfulness of processing based on consent before its withdrawal.

You may lodge a complaint with a supervisory authority, in particular in your EU Member State of residence, if you consider that the collection and use of your Personal Data infringes this Notice or applicable law.


We may update this Notice from time to time in response to legal, technical, operational, or other developments and will take appropriate measures to inform you of any such updates.

Please contact our Data Privacy Director with any questions about this Notice or the Personal Data we hold about you:

Daniel Miller Director, Data Privacy, CBRE Global Investors and Regulated Businesses