Global Privacy and Cookie Notice
Last Updated: 18 September 2026
Last Reviewed: 18 September 2026
CBRE, Inc. and our subsidiaries (together "CBRE Group", "CBRE", "we", "our", "us"), respect your rights to privacy. This Global Privacy and Cookie Notice ("Notice") explains how we collect, use and share information about you, and provides details about cookies we use. It also describes your rights relating to our use of information about you.
Table of Contents
This Notice applies when you provide or we receive information about you, for example when you use CBRE Group's websites, digital services, and social media profiles ("Sites"), or when you interact with us professionally (e.g., as a client, supplier or partner) ("Professional Interactions") or in the context of applications for employment with us or participation in our recruitment and onboarding activities ("Talent Acquisition").
This Notice may be supplemented with notices issued by individual CBRE entities, ("Local Notice") and additional privacy notices may more explicitly cover certain processing operations. For example, for Talent Acquisition purposes, the CBRE Global Recruitment and Employee Onboarding Privacy Notice and any associated Local Notice applies. For customer due diligence, our Global Customer Due Diligence / KYC Notice applies. These Local Notices and/or supplemental privacy notices apply alongside this Notice and prevail to the extent of any inconsistency required by local law.
This Notice does not apply to your use of any third-party sites linked to from our Sites.
Where CBRE provides services to clients as a data processor, we will process personal information in line with our legal obligations and contractual commitments with those respective clients.
CBRE is a global real estate services and investment company. We help clients buy, sell, lease, finance, operate, and modernize property and portfolios across office, industrial, retail, residential, and specialized sectors. We provide advice, transactions, facilities and project management, valuation and appraisal, consulting, and data driven insights.
Personal information may be collected and used by the CBRE Group and/or each CBRE entity in its own capacity, when providing our global real estate and investment services and operating our business. Depending on how/why you interact with us, the data controller with responsibility for your personal information ("Responsible CBRE Entity") is generally as follows:
| Your interaction with CBRE | Responsible CBRE Entity |
| Global Site use (www.cbre.com) | CBRE, Inc. |
| Local CBRE Site usage/interactions | The CBRE entity operating the local Site. NOTE: where relevant under applicable data protection laws, the local CBRE entity and CBRE, Inc. generally act as joint controllers for processing related to the Local CBRE Site (e.g., site administration, analytics, and content management). You may exercise your rights against either entity, and you may request a copy of the essence of the joint controller agreement via [email protected]). |
| Professional Interactions | The CBRE entity you interact with (e.g., your client relationship or service contract). |
| Social Media | The CBRE entity identified as the account/operator on that social media page. |
| Talent Acquisition | The CBRE entity offering the role you apply for. Please refer to CBRE Global Recruitment and Employee Onboarding Privacy Notice and/or Local Notice for details. |
A list of CBRE Group entities and contact details is available here: Responsible CBRE Entity List. Please contact us if you need help identifying your Responsible CBRE Entity.
We may collect and use information about you when you use our Sites, or in relation to Professional Interactions and/or Talent Acquisition. You may provide this information to us directly, or we may receive it from third parties (such as your employer, operators of other websites and other business partners), or we may receive it automatically when you use our Sites (e.g. through cookies and similar technologies).
The main categories of personal information we collect and use are:
1. Contact information: such as name, address, email, phone number, employer.
2. Identity information: such as a passport, national insurance number, social security number or driving license, date of birth, signature, and information used to verify identity or address.
3. Demographic information: such as age, gender, or marital status (where relevant and permitted).
4. Employment information: such as role, employment status, information included in applications, recruitment assessments (where permitted), and onboarding/HR administration (such as right-to-work documentation and payroll/benefits details, time/attendance/workplace occupancy metrics and IT systems access information), salary information and employment history and, on a voluntary basis, equality and diversity information.
5. Financial details: such as bank account details, details of your credit history and bankruptcy status, salary, tax code, bonus payments, benefits and entitlement data.
6. Marketing and communications information: such as your marketing preferences and consents, subscriptions, and communications with us.
7. Events information: such as information about your interest in, registrations and attendance at CBRE events, dietary requirements, and feedback from you about our events.
8. Health information: such as accessibility requirements for accessing buildings and resources, accessibility to documents and other materials or, if you are a job applicant, information about your medical history and needs.
9. Website, device and technical information: when you use our Sites, such as IP address, general location derived from IP address, device identifiers, browser settings, cookies and similar technologies, and how you interact with our Sites (for example, pages visited and time spent browsing, likes and comments on our social media posts).
10. Images and video footage: such as still images and footage collected from our use of CCTV and similar technologies at our offices and/or sites, including visitor logs and onsite attendance records.
11. Criminal records and background checks information: such as the existence of or alleged criminal offences, or confirmation of clean criminal records.
12. Other personal information: any other information you provide to CBRE, or which is collected or processed by us in the course of your interactions with us, or about which we may notify you.
Where required by law, we will provide additional information (for example, in a Local Notice) about specific categories of information we collect in a particular country or context. For example, for regulatory due diligence we may process sanctions screening and PEP related information where required or permitted by law, as further detailed in our Customer Due Diligence Notice.
We collect and use this information for different purposes, for which we are required to have a legal basis according to data protection laws. Depending on where you are located and the context, the legal bases we most commonly rely on include where information is needed for:
| Performance of a Contract | For example, where we need to process information to deliver our services or manage our contractual relationship with you or take steps to enter into a contract with you. |
| Legitimate Business Interests | We rely on certain legitimate business interests, provided they do not override your interests, rights and freedoms. Our legitimate business interests include delivering and enhancing our services, maintaining the security and integrity of our systems and premises, managing client and supplier relationships, supporting corporate governance and transactions, and promoting our business to professional contacts. We carry out assessments to ensure that our reliance on legitimate interests is appropriate and that your rights are respected. |
| Legal Obligations | We are subject to certain legal obligations including those relating to identity verification, anti-money-laundering checks, accounting or regulatory reporting. |
| Your Consent | Where legally required for specific activities, such as certain types of marketing or cookies, or if we need to process sensitive information (such as health data) we may need to obtain your consent. Where we rely on your consent, you may withdraw it at any time. |
The Processing Purposes and Legal Bases Table below explains why we use personal information, what categories of information we use for each purpose, and the legal basis we rely on in relation to each purpose. Information about who we may share personal information with for these purposes is set out in the 'Who We Share Your Information With' section below.
Please note that if you don't provide information that we reasonably require for the purposes set out below, you may be unable to use our Sites, receive our services, receive marketing information, be considered for employment or engagement as a vendor/service provider and/or interact with us.
| Why (Processing Purpose) | What (Data categories)* *See Section 4 above for examples of data types |
Legal Basis |
| Online Site Access To manage and provide you access to the Sites, and manage their performance, operation and security. |
|
|
| Business Transactions and Relationship Management To transact business, respond to enquiries, manage communications and maintain professional relationships. |
|
|
| Know Your Customer (KYC); Anti-Money-Laundering (AML); Anti-bribery and Corruption (ABAC); Business Acceptance Checks To carry out due diligence, identity verification, sanctions screening, credit references, bankruptcy, data validation, background checks and other business acceptance, vetting and risk management checks associated with preventing fraud or financial crime. |
|
|
| Marketing E.g. sending communications about services, offerings, events, offers and newsletters (incl. similar offerings and, where applicable, third parties' offerings); maintaining global CBRE user profiles (e.g., company, site interactions, professional interactions, preferences, likely interests), including through the use of analytics and AI-assisted segmentation and classification tools where appropriate. |
|
|
| Social Media and Brand Reputation To manage CBRE's brand reputation through our presence on CBRE-operated and third-party social media sites. |
|
|
| Business Operations, Analytics and Improvement To operate, evaluate, and improve our business (including developing new products and services; managing our communications and Sites, generating insights and improving performance/strategy through data analysis). |
|
|
| Legal Obligations and Legal Claims To comply with legal obligations, respond to authorities' requests; maintain records; and establish/exercise/defend legal claims. |
|
|
| Recruitment and Onboarding To manage applications, conduct interviews and assessments, perform background checks (where permitted), determine qualifications, skills and experience relevant to open positions, and onboard new colleagues. |
|
|
| Crime Prevention To protect people, premises and systems and detect and investigate security incidents or misuse, and comply with related reporting and compliance obligations. |
|
|
| Mergers and Acquisitions For pre- and post-close due diligence and transactional purposes in the event of a business sale, acquisition or reorganization, including transferring client business to successors. |
|
|
1. Recipients of Personal Information
We may share personal information with the categories of recipients listed below where necessary for the purposes described in this Notice. The recipients' roles, and the reasons we share information with them, correspond to the processing purposes outlined in the Why We Might Use Your Information section.
| Category of Recipients | Details |
| Other CBRE Entities | CBRE Group is a global organization with a number of separate legal entities. We may share your personal information with other CBRE entities as necessary. This includes entities providing centralized IT, security, analytics, finance, HR, and governance functions, and regional or local CBRE entities that support service delivery or business operations. |
| Third Party Service Providers | Service providers engaged by CBRE to support our operations. Such providers typically include IT hosting and infrastructure providers, cybersecurity providers, analytics and measurement vendors, marketing and communications platforms, customer relationship management platforms, background check vendors, and professional services automation providers. |
| Consultants and Advisors | Such as legal counsel, compliance consultants, business, operations and strategy advisors, and auditors, for assistance with legal, regulatory, and business operation activities. |
| Business Partners in Case of a Merger or Sale | Business partners with whom we need to engage in connection with a merger, acquisition or other corporate transaction such as a transfer of our assets or operations. |
| Courts and Governmental Agencies | For example, it may be necessary to disclose your personal information to courts, litigants, governmental agencies, and/or regulatory authorities when required to do so by law or necessary in connection with legal proceedings or similar processes. We only disclose personal information where required by law, regulation, or court order, or where necessary to establish, exercise or defend legal claims. |
2. Transparency Statement
In accordance with Clause 15.1(a) of the EU Standard Contractual Clauses (Module Two/Three), CBRE confirms that as of the date of this Notice, it has not received any legally binding requests from public authorities (including judicial authorities) for the disclosure of personal data transferred from the European Economic Area (EEA) pursuant to these Clauses. Furthermore, we have not become aware of any direct access by public authorities to such data.
Our Sites, Professional Interactions and Talent Acquisition are not directed to children, and CBRE Group does not knowingly collect, nor does it need to use, personal information from or about minors.
CBRE may process information related to children (such as a child's name, date of birth, address, and other identifiable information) in the context of employment, for example when a CBRE colleague provides details of their child for the purposes of employee benefits pension schemes.
We use and access data in multiple jurisdictions including the United States, United Kingdom, Canada, Australia, India, Singapore, Philippines, Mexico and other locations where CBRE and our service providers operate. This includes locations where we operate central functions (such as the United States and the United Kingdom), where our systems are hosted or backed up, and where we receive IT or operational support.
We take steps to help ensure that any international transfers are carried out in accordance with applicable data protection laws and that personal information remains protected. The safeguards we use vary depending on the location and the legal requirements that apply and may include:
We implement appropriate technical and organizational security measures to safeguard your personal information from loss, unauthorized access, alteration or disclosure. Such measures include encryption; access controls; and anti-malware and intrusion detection systems. We have in place incident response procedures to detect, respond to and mitigate data incidents. We retain personal information only for as long as necessary to fulfil the purposes described in this Notice, including to comply with legal, regulatory and reporting requirements.
Depending on your location and the applicable law, you may have one or more of the following rights, which you may exercise by submitting a request through our Data Subject Rights Portal or by contacting us at [email protected].
Please note that some of these rights can only be exercised in certain circumstances or countries. If we are unable to fulfil a request from you to exercise one of your rights, we will explain the reason for refusal.
If you are not satisfied with our response, or if you prefer to do so, you have a right to lodge a complaint with your data protection authority about our use of your personal information. For example, if you are in a jurisdiction where you have a statutory right to lodge a complaint (such as the UK, European Economic Area, Brazil, Australia or Canada), you may do so at any time. A broader global directory of privacy regulators is also maintained by the International Association of Privacy Professionals (IAPP).
If you are in Brazil, you may have additional rights, including the right to request review of decisions made solely through automated processing that affect your interests. The legal bases for processing may also differ. The competent authority is the Autoridade Nacional de Proteção de Dados (ANPD).
If you are in China, you may have additional rights, including the right to deregister as a user of an application or close online accounts. Where required we may obtain separate consent for certain processing activities such as cross-border transfers or processing of sensitive personal information.
If you are in India, you may have rights and remedies under applicable Indian data protection laws, including the right to raise grievances regarding our handling of your personal information.
If you are in Vietnam, you may have additional rights (subject to applicable conditions, exemptions and legal requirements) including rights relating to accessing your personal information, the right to claim damages; the right to self-protection; and rights relating to automated processing where applicable.
If you are resident in California, USA, you may have additional rights under the California Consumer Privacy Act (CCPA). Please refer to our supplemental California Privacy Policy.
In all these above cases please refer to the applicable Local Notice for further information.
We may send you marketing communications such as newsletters, reports, event invitations, and information about CBRE services.
You can "opt out" of marketing communications at any time by using the "unsubscribe" link included in our emails or contacting us at [email protected]. Please include the email you received, and type "Remove" in the subject line.
Please note that opting out of marketing communications will not affect other messages we need to send, such as service or transactional messages.
CBRE does not carry out solely automated decision making (meaning decisions made without meaningful human involvement), including profiling, in a way that produces legal effects concerning you or similarly significantly affects you. Where relevant, information about logic-based automated screening is set out in applicable supplemental notices.
CBRE uses certain tools that may incorporate artificial intelligence ("AI") to support and enhance our business operations, services, digital experiences, analytics, security, marketing activities and recruitment processes. Our use of AI is guided by CBRE's global AI Policy and AI Governance Framework which require AI to be used in a fair, lawful, ethical and responsible manner, and in line with principles relating to transparency, fairness, human oversight, privacy, security and sustainability.
Depending on the context, AI-enabled tools may be used to:
Where CBRE uses AI-generated or AI manipulated audio, image or video content, we provide notices or labels where required by applicable law.
Where AI is used in recruitment or other processes supporting decisions, appropriately trained personnel review relevant information and retain responsibility for decisions. CBRE does not rely on AI to make employment, hiring or similarly significant decisions without meaningful human review and oversight.
Where permitted by law, and with appropriate safeguards, we may use personal information - typically in aggregated, anonymized or pseudonymized form - to help develop or improve AI-enabled tools and enhance our services. Where applicable, we will comply with emerging requirements under the EU AI Act and other regional AI laws and regulations.
CBRE uses cookies and similar technologies (for example, pixels, tags, SDKs, local/device storage, unique identifiers and related technologies) to operate our Sites, enhance functionality, improve performance and personalize your experience. These technologies involve storing information on, or accessing information from, your device, and we apply the same choices and controls to them as we do to cookies.
1. What are Cookies?
A cookie is a small text file placed on your device when you visit a website. Cookies allow websites to recognize your device, remember your preferences, help you navigate efficiently, and enable analytics and advertising activities that are relevant to you and your interests.
Cookies vary by both function and retention period: Session cookies are temporary and expire when you close your browser. Persistent cookies remain on your device for a set period or until you delete them.
We use both first-party cookies (set directly by CBRE) and third-party cookies (set by external providers who support our Site functionality, analytics, or advertising).
2. Categories of Cookies We Use
We group the cookies on our Sites into the following functional categories, which correspond to the categories displayed in our Cookie Settings tool:
Details of specific cookies used on our Sites, including their providers, purposes, and retention periods, are available through our Cookie Settings tool accessible via the "Cookie Settings" link at the bottom of our Site pages. Typically, the retention period for cookie preferences is set to 1 year.
3. Cookie Consent and Your Choices
Consent: Where required by law, we only use non-essential cookies and similar technologies with your prior consent. You may withdraw your consent or change your choices at any time via Cookie Settings.
Your choices: You can manage your cookie preferences using our Cookie Settings tool, which provides clear, granular controls over the categories of cookies described above.
If you delete or block cookies through your browser settings, this may affect the functionality of our Sites and may delete the cookies used to store your preferences—meaning you will need to reset your choices.
Your browser may also allow you to send a "Do Not Track" ("DNT") signal. Because there is currently no industry standard governing how websites should respond to DNT signals—and because DNT does not provide the level of detail needed to manage distinct cookie categories—we do not respond to DNT signals.
For more information about cookies, including how to manage them in your browser, you can visit: https://www.allaboutcookies.org.
Browser signals: We recognize and process the Global Privacy Control ("GPC") signal from supported browsers and browser extensions. Where required by applicable law, we will treat a valid GPC signal as a request to opt out of the use of certain non-essential cookies and similar tracking technologies, or other processing activities associated with that signal. Your use of a GPC signal does not affect cookies that are necessary for the operation of our Sites.
4. Performance Tracking via Similar Tracking Technologies
We may use performance tracking technologies, such as web beacons, pixels and tags, within our marketing emails or within advertisements displayed on our Site or third-party websites. These performance tracking technologies may be provided by us or by third parties and help track e.g. whether an email recipient has signed up for a free trial, or a Site user has clicked on advertisement. Further information is available via "Cookie Settings".
For requests about your Privacy Rights, please go to our Data Subject Rights Portal or email [email protected].
If you have general questions about this Notice or our privacy practices, please contact us as follows:
Where required, certain CBRE entities have appointed a Data Protection Officer ("DPO"). Our DPOs may be contacted as follows:
DPOs | EU / UK
| Germany: CBRE GmbH, CBRE PREUSS VALTEQ GmbH, CBRE Capital Advisors GmbH | [email protected] |
| Germany: CBRE Global Investors Germany GmbH | [email protected] |
| Germany: CBRE GWS Industrial Services GmbH and CBRE GWS IFM Industrie GmbH | [email protected] |
| France | [email protected] |
| Romania | [email protected] |
| UK | [email protected] |
DPOs | Outside EU / UK
| Brazil | [email protected] |
| Canada: CBRE Limited | [email protected] |
| Malaysia | [email protected] |
| Philippines | [email protected] |
| Singapore | [email protected] |
| South Korea | [email protected] |
| Thailand | [email protected] |
| Vietnam | [email protected] |
We may update this Notice from time to time, for example where necessary in response to legal, technical or business developments. If we make any material changes to this Notice, we will make changes here and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Notice changes).
This Notice is supplemented by additional privacy notices and/or addenda in certain countries or regions, where local laws require further disclosures. For example, our California Privacy Policy, Brazil-specific disclosures, China-specific disclosures, Pacific Privacy Notice.
A complete list of current Local Notices and/or supplemental notices is available here: https://www.cbre.com/about-us/policy-picker. Please click below each jurisdiction for applicable supplemental notices.
Where applicable, these Local Notices and/or Supplemental Notices apply alongside this Global Privacy and Cookie Notice and prevail to the extent of any inconsistency required by local law.