Privacy Notice

As the data controller of your personal information for the purposes of the EU General Data Protection Regulation (“GDPR”) and applicable local law and regulation, "CBRE Hana Operations, LLC" (hereinafter: “CBRE Hana”, “we”, “us” or “our”), recognizes the importance of protecting your privacy. This Privacy Notice (the “Notice”) is designed to assist you in understanding how we collect, share, use, and safeguard the Personal Data (as further defined below) we collect and/or process in relation to your query related to the Hana business, and your rights with respect to your Personal Data. It also describes how you can contact us about our privacy practices.

For purposes of this Notice, Personal Data means any information through which we can identify you as an individual, as further described below in "What Personal Data is collected and how it is collected".

WHAT PERSONAL DATA IS COLLECTED AND HOW IT IS COLLECTED

Information that you provide directly:

  • We collect and process the following types of information relating to you when submit your request for additional information about CBRE Hana and our Services:

    • Full name and contact details, including address, phone number, email address
    • Country of residence
    • Employer and/or job title
    • Any other information you may provide with your request

Information we gather about you:

  • Information about your use of our websites, such as the date and time that you visit, your general geographic location (based on IP address), how you reached our site (including search terms used), and which pages you visit

Information about other people.

  • If you are providing information about another person or persons, you confirm that they have appointed you to act for them, that you have informed them of our identity, the information you intend to provide to us and the purposes for which such information will be processed, and that you have provided them with a copy of this Notice before providing us with their information.

WHY PERSONAL DATA IS COLLECTED AND HOW IT IS USED

We collect, share and use your Personal Data for the purposes below (unless otherwise indicated at the point of collection) and on a legal basis as is described below:

To provide you with more information about our Services, as per your request: By submitting your personal information via the Hana website, you are requesting that CBRE Hana contact you via email and/or telephone to provide you with additional information about our service offerings. We will not contact you in relation to any services other than those provided by CBRE Hana.

We may share information about how you use our Site with third-party vendors to present you with more relevant advertising. For example, your browsing activity on our Site may be tracked by our vendors using cookies to show you ads based on your interests when you browse the Web or use social media. Our vendors may also share information about your browsing activity on our Site with us for analytics purposes. CBRE Hana relies on your consent for such processing of your personal information. More information on these cookies, including how to provide or revoke your consent, may be found below under Cookies.To comply with our legal obligations: Any data referred to above in the section ‘What Personal Data is collected' may be used to comply with a legal obligation to which we are subject, including, but not limited to, maintaining appropriate business records, complying with lawful requests by governmental agencies and public authorities, complying with our health and safety obligations, and to comply with applicable laws and regulations.

PERSONAL DATA WE SHARE

We share your Personal Data internally with other entities within the CBRE Group for the purposes described above. We will also disclose your Personal Data as may be necessary:

  • to our professional advisors, such as lawyers, auditors and accountants
  • to our vendors who provide data processing, IT, software, information security and related services
  • to any competent law enforcement body, regulatory or government agency, court or other third party where we believe disclosure is necessary to comply with applicable law or regulation, exercise, establish or defend our legal rights or the rights of our Property Manager or for the administration of justice, or to protect the vital interests of you or any other person
  • to any person for whom you consent to our making disclosure, and
  • as may otherwise be set out in this Notice or communicated to you at the point of collection.

Our contracts with our professional advisors, vendors and other third parties with whom we share your Personal Data, limit their use of your Personal Data and do not permit use of your Personal Data for their own (marketing) purposes. Consistent with applicable legal requirements, we take commercially reasonable steps to require third parties to adequately safeguard your Personal Data and only process it in accordance with our instructions.

INTERNATIONAL DATA TRANSFERS

As set out above, we may transfer the Personal Data we collect about you to recipients, and your Personal Data may be stored and processed, in countries other than the country in which the information was originally collected, including the United States and elsewhere that may have less stringent data protection laws than the country in which you initially provided the information, including the United States, Switzerland, and other countries or territories.

When we transfer your Personal Data to countries other than the country in which the information was originally collected, we will protect such data in accordance with applicable data protection laws.

PRIVACY SHIELD FRAMEWORKS

CBRE is a signatory to the E.U.–U.S., and Swiss–U.S. Privacy Shield Frameworks for all HR and non-HR data. Cross-border data transfers from the European Union, United Kingdom, and Switzerland to the United States will be safeguarded pursuant to CBRE’s Privacy Shield commitments.

In compliance with the EU-US and Swiss-US Privacy Shield Principles, CBRE commits to resolve complaints about our collection or use of your personal data. Individuals located within the E.U., United Kingdom, or Switzerland may direct their inquiries or complaints regarding our Privacy Shield policy to Privacy.Office@CBRE.com.

SECURITY

We store your Personal Data on a secure server, and use appropriate technical and organizational measures designed to protect the Personal Data we collect from unauthorized access, destruction, use, modification or disclosure. We take all reasonable measures to ensure that your data is only accessible to those persons or organizations who require it in order to perform their duties or obligations as they relate to your tenancy. Although we will take commercially reasonable security precautions regarding your Personal Data, we cannot guarantee that any of your Personal Data stored on our servers, or transmitted to or from a user, will be free from unauthorized access, and we disclaim any liability for any theft or loss of, unauthorized access or damage to, or interception of any data or communications.

COOKIES

A cookie is a small text file that a website stores on your computer, smartphone, or other device with information about your navigation on that website A cookie contains the name of the server it came from, an expiration date, and a value—usually a randomly generated unique number. Cookies do not give access to nor damage your computer.

We use browser session cookies, which are temporary cookies that are erased from your device’s memory when you close your Internet browser or turn your computer off, and persistent cookies, which are stored on your device until they expire, unless you delete them before that time. We group browser cookies on our site into three categories, which you can manage through our preference manager:

  • Required cookies: These cookies are necessary to enable the basic features of this site to function, such as identifying you as a valid user, ensuring that no one else can sign on simultaneously with your account from another computer and helping us serve you better based on your registration preferences. These cookies also allow you to select your cookie preferences.
  • Functional cookies: These cookies allow us to analyze your use of the site to evaluate and improve our performance. They may also be used to provide a better customer experience on this site. For example, providing us information about how our site is used and helping us facilitate any promotions or surveys that we provide.
  • Advertising cookies: These cookies may be used to share data with advertisers so that the ads you see are more relevant to you, allow you to share certain pages with social networks, or allow you to post comments on our site.

Our preference manager allows you to restrict our use of cookies other than Required Cookies. If you use our preference manager on a mobile device, we process your device’s Advertising Identifier. When you access our preference manager, session cookies will be set by the ad networks listed in our preference manager to honor your preferences if you choose not to receive interest-based advertising. If you clear your browser cookies, this will remove all cookies including the opt-out cookies set by the companies. You will need to access our preference manager again to reset your preferences. Our cookie only knows your last set of preferences and does not reflect the current state of cookies on your browser.

DATA RETENTION

We retain your Personal Data for as long as required to satisfy the purpose for which they were collected and used. It may be necessary to retain certain Personal Data longer in order to comply with applicable legal, obligations or to defend a legal claim.

YOUR RIGHTS

You have the right to be provided with clear, transparent, and easily understandable information about how we use your Personal Data, and your rights related to your Personal Data under the GDPR and applicable local law and regulation, which information is contained in this Notice.

Additionally, subject to applicable law, you have the right to request, review, correct, update, suppress, restrict or require that we delete Personal Data that you have provided to us, and to request to receive an electronic copy of such Personal Data for purposes of transmitting it to another company, by sending an email to our Data Subject Request Team at DSR@cbre.com specifying your request. Responses to your request will be made consistent with applicable law.

In your request, please tell us what Personal Data you would like to have provided to you, changed, whether suppressed from our database, or otherwise let us know what limitations you would like to put on our use of it. We will try to comply with your request as soon as reasonably practicable.

Please note that we may need to retain certain Personal Data for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion.

In the event your Personal Data is processed on the basis of your consent, you can withdraw consent at any time by sending an email to Privacy.Office@cbre.com specifying your request, without affecting the lawfulness of processing based on consent before its withdrawal.

You may lodge a complaint with a supervisory authority, in particular in your EU Member State of residence, if you consider that the collection and use of your Personal Data infringes this Notice or applicable law.

UPDATES, CONTACT

We may update this Notice from time to time in response to legal, technical, operational, or other developments and will take appropriate measures to inform you of any such updates.

Please contact our Data Privacy Director with any questions about this Notice or the Personal Data we hold about you:

Daniel Miller Director, Data Privacy, CBRE Global Investors and Regulated Businesses Daniel.Miller@cbre.com

HANA - CALIFORNIA RESIDENTS PRIVACY NOTICE

Effective Date: January 1, 2020 Last Reviewed on: December 26, 2019

This California Personal Information Privacy Notice (“Notice”) supplements the Hana Privacy Notice. This Notice applies solely to Hana Members who are consumers in the State of California (“you”) and generally explains how Hana collects and uses your Personal Information when you visit our marketing websites. We adopt this Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws.

We reserve the right to update this Notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your Personal Information.

CONTENTS

  1. How “Personal Information” is Defined in this Notice
  2. Personal Information We Collect, Purposes of Use and Sources
  3. Disclosure of Your Personal Information
  4. Sale of Your Personal Information
  5. Right to Know, Access, and to Delete Your Personal Information
  6. How to Exercise Your Rights
  7. Non-Discrimination for Exercising Rights
  8. Disclosures for Third Parties’ Direct Marketing

1. HOW “PERSONAL INFORMATION” IS DEFINED IN THIS NOTICE “Personal Information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household. “Personal information” does not include information publicly and lawfully made available in government records, deidentified or aggregate information about California consumers or households, and information excluded from the CCPA’s scope (for example, health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) and personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994).

2. PERSONAL INFORMATION WE COLLECT, PURPOSES OF USE AND SOURCES In this section we set out what categories of Personal Information we collect about you, how we use it, and the sources of such Personal information. This section is to be read together with, and supplements, the information we provide in the Hana Privacy Notice.

a. General Information For general notice on the categories of personal information we may collect and the business or commercial purposes for the use of such Personal Information, please refer to the following information in the Hana Privacy Notice.

• What Personal Data is Collected and How it is Collected • Why Personal Data is Collected and How it is Used

b. Your Right to Know About Personal Information Collected in the last 12 months

In the last 12 months, CBRE has collected the categories of Personal Information described in the table below. The categories included in the table have been defined in a way that we believe will be meaningful to you: • In the second column, we have provided reference to the corresponding category or categories of Personal Information specified in the CCPA. A description of such categories follows directly after this table. • In the third column, we set out the business or commercial purpose for use of such information. • In the fourth column, we set out the categories of sources from which such information was collected. • In the fifth column, we set out the categories of third parties with whom Personal Information is shared.

Categories of PI collected CCPA Category (See Below) Business or Commercial Purpose(s) Categories of Sources Categories of Third Parties with whom PI is Shared*
Contact Information (such as full name and contact details, including address, phone number, email address Country of residence), Professional Information (such as employer and/or job title) and Any other information you may provide with your request A, B To address request for additional information about CBRE Hana and our Services Individual Third party service providers
Information about your use of our websites (such as the date and time that you visit, your general geographic location (based on IP address), how you reached our site (including search terms used), and which pages you visit - • To market and advertise our services to you • Gather information about our website for analytics purposes Individual Third-party vendors

__The 11 enumerated categories under the definition of “Personal Information” in the CCPA, some of which are referenced in the second column of the table above, are:

(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

(B) Any categories of personal information described in subdivision (e) of Section 1798.80 of the California Civil Code.

(C) Characteristics of protected classifications under California or federal law, including age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

(D) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

(E) Biometric information (defined in the CCPA as an individual’s physiological, biological or behavioral characteristics, including an individual’s deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information).

(F) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.

(G) Geolocation data.

(H) Audio, electronic, visual, thermal, olfactory, or similar information.

(I) Professional or employment-related information.

(J) Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, 34 C.F.R. Part 99).

(K) Inferences drawn from any other type(s) of Personal Information as defined by the CCPA to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, preferences, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.__

3. DISCLOSURE OF YOUR PERSONAL INFORMATION

a. General Information

For general information on the categories of third parties with whom we share your Personal Information, please refer to the following information in the Hana Privacy Policy:

• Personal Data We Share

b. Your Right to Know About Personal Information Shared in the last 12 months In the last twelve (12) months, in the course of operating our business, CBRE has disclosed all of the categories of Personal Information identified in column 1 of the table above to the following categories of third parties for a business purpose.

• Our related entities and affiliates. • Service providers, such as:

  • our professional advisors, such as lawyers, auditors and accountants
  • our vendors who provide data processing, IT, software, information security and related services
  • any competent law enforcement body, regulatory or government agency, court or other third party where we believe disclosure is necessary to comply with applicable law or regulation, exercise, establish or defend our legal rights or the rights of our Property Manager or for the administration of justice, or to protect the vital interests of you or any other person, and
  • any person for whom you consent to our making disclosure.

• Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you, including in government filings.

4. SALE OF YOUR PERSONAL INFORMATION

a. Your Right to Know About the Sale of Your Personal Information California law requires that we provide you with information about certain disclosures of Personal Information to third parties, where the disclosure involves monetary or other consideration. California treats these disclosures as “sales” of information, even if no money changes hands. In the twelve (12) months preceding January 1, 2020, we “sold” certain categories of Personal Information to third parties for a business or commercial purpose, as described in the chart below. As of January 1, 2020, we do not engage in the sale of Personal Information.

b. Categories of Personal Information Sold

Categories of PI collected CCPA Category (See Above) Categories of Third Parties to whom such PI categories are sold
Contact information & Your Professional Information A, B • Sponsors & Business Partners
Event Attendance Information A, B, D • Sponsors & Business Partners
Cookie data A, F, K • Advertising Networks

5. RIGHT TO KNOW, ACCESS, AND TO DELETE YOUR PERSONAL INFORMATION As a consumer residing in the state of the State of California, you have the right to request that: (i) CBRE discloses the categories of Personal Information that we collected, the categories of the sources of such Personal Information, the business or commercial purposes for collecting such Personal Information, the categories of third parties to whom we disclosed such Personal Information, and/or, if we sold or disclosed your Personal Information, the categories of Personal Information that each category of recipient purchased or obtained, and/or (i) that we provide you with copies of such Personal Information. You may make two such (2) requests in any 12-month period.

Subject to certain exceptions, you may also request that we delete any Personal Information about you that we may hold. We may have grounds to deny your deletion request as provided for in the CCPA.

Upon receipt of your request to know, for access, or for deletion, we will need to reasonably verify that you are the person about whom we collected Personal Information. We may do so by asking for additional information (“Verifiable Information”) to compare against the information we hold about you, or if you have an account with us, by asking you to log in to that account. We will only use Verifiable Information to verify your identity or authority to make the request. We may also ask you to provide additional detail or clarify your request to allow us to properly understand, evaluate and respond to it.

Types of Verifiable Information we may ask for depend on the context of your relationship with CBRE, but may include:

• Name of a CBRE employee with whom you interacted, • Date or other details of a transaction you had with CBRE, • Email address, phone number, or other contact information we may have on file for you.

6__. HOW TO EXERCISE YOUR RIGHTS__ You may exercise your rights to know, access, delete or opt out by completing the form in our Data Subject Rights Portal or by calling us at +1 (866) 428 4722. We will ask for your name, email address, and your relationship to us in order to begin processing your request.

You may authorize someone to submit a rights request on your behalf. You may do this by providing that person with power of attorney pursuant to the California Probate Code. Alternatively, you may provide that person with signed, written permission to submit requests on your behalf, but we will still require you to verify your identity with us directly by one of the methods listed above. In either case, we will also require that person to verify their personal identity via one of the above methods, or, in the case of a business entity, by response to communications directed at a well-known internet domain associated with that business or to contacts provided in that entity’s official filings with the California Secretary of State.

7. NON-DISCRIMINATION FOR EXERCISING RIGHTS We are prohibited from discriminating against you because you exercised any of your rights to know, access, delete or opt-out of the sale of your Personal Information.

8. DISCLOSURES FOR THIRD PARTIES’ DIRECT MARKETING Under California’s Shine the Light Act, users of our Website who are California residents may request certain information regarding our disclosure of their Personal Information to third parties (if any), if such information is used for such third parties’ direct marketing purposes. (See Section 4 above). To make such a request, please send an email dsr@cbre.com or write us at: CBRE, Inc., 321 North Clark Street, Suite 3400, Chicago, Illinois 60654, Attention: Global Director, Data Privacy.