HOK's General Privacy Policy
Version: 3.0 | Date: February 21, 2024
Thank you for visiting hok.com. HOK’s General Privacy Policy sets out how HOK Group, Inc., together with its subsidiaries and affiliates listed in Section 15.0 below (collectively, “HOK”, “we” or “us”), process the personal information of our website visitors, clients, subconsultants and other third parties. It is not the exclusive description of how HOK processes personal information of individuals. If you are an employee, information on how HOK handles your personal data has been notified to you and is set out in HOK's Corporate Integrity Handbook and your local Employee Handbook available on HOK’s intranet. If you are a prospective employee or job applicant, information on how HOK handles your personal data is set out in HOK’s Recruitment Privacy Statement. If you are a third-party vendor or subconsultant, information on HOK’s rights and your obligations regarding personal data provided to you by us is set out in HOK’s Third-Party Data Protection Addendum. Collectively, these policies form HOK’s Global Privacy Policy. For questions about HOK’s Global Privacy Policy, please contact us by email at privacy@hok.com or by mail at HOK Group, Inc., 10 South Broadway, Suite 200, St. Louis, MO 63102; Attention: Corporate Compliance Officer.
HOK DOES NOT SELL PERSONAL INFORMATION TO OTHERS. Residents of the European Economic Area (“EEA”), United Kingdom (“UK”) and the State of California should refer to Section 10.0, Data Rights for information regarding their rights under applicable law.
1.0 HOW INFORMATION IS COLLECTED
HOK typically collects personal information directly from the individual to whom it relates, except where that individual has consented to HOK collecting the personal information from a third-party or the law otherwise permits HOK to do so.
HOK will collect and store your personal information when you interact with hok.com. We collect information, some of which may contain personal information, by online applications as follows: (i) limited information is automatically collected about you when you visit hok.com through the use of Google Analytics or Log Data (as discussed below); or (ii) you may voluntarily provide information, including personal information, to us by: (a) emailing HOK about our services, employment or internship opportunities, marketing, media requests, and other business matters; (b) by registering online to attend an HOK-sponsored event; or (c) downloading one of our online publications.
Google Analytics is a free third-party service that uses “cookies” to measure, collect, analyze and report web data for purposes of optimizing the experience of users of hok.com. Cookies are files with small amounts of data, that are sent to your browser from our website and stored on your computer's hard drive. We will ask for your consent to use these cookies when you first visit hok.com. At any time you can opt-out and prevent your data from being used by Google Analytics with the Google Analytics Opt-Out Browser Add-on or by contacting us at privacy@hok.com.
Please see our Cookie Policy for further details.
Log Data is information your browser sends us whenever you visit hok.com. Please see Section 2.0 below for details.
HOK does not make any attempt to use Google Analytics or Log Data to find out the identities of those visiting hok.com.
Risk Intelligence Data is data obtained by HOK to assess risk that may arise from a new business relationship. When considering a new business relationship, we may request additional information about a person or entity seeking to do business with HOK such as: (i) details on the business entity (including date and place of incorporation, tax identification number, legal status, authorized representative, and other similar information); (ii) details on beneficial ownership interests (including identity of ultimate parent company and details on the identity of individual shareholders (including first name, last name, date of birth and details of their shareholding) in the ultimate parent with significant ownership interests); and (iii) details on the relationship of the person or entity seeking to do business with HOK to any official, officer, legislator, director, employee, or agent of any government of any tier or any state-owned entity. HOK will process this information through World-Check by Thomson Reuters® to obtain Risk Intelligence Data associated with new business relationships. Risk Intelligence Data may include sensitive personal information on companies and individuals such as political activities, criminal allegations or convictions, regulatory inquiries or penalties, geolocation information, financial and banking information, reputational information, government issued identification numbers, relationships to sanctioned or otherwise politically exposed persons and organizations, and other similar information. HOK uses Risk Intelligence Data to analyze potential risks associated with new business associates. We will take reasonable steps to ensure all Risk Intelligence Data that we store is current, accurate, complete, and confidential.
User-Supplied Personal Information. HOK may request your name, email address, affiliated company and other contact information when you contact individuals within HOK or request information or services from hok.com. This information may be used, stored and transferred by HOK for the purposes listed in Section 3.0 (How Personal Information is Used) below. Users outside the UK/EEA who provide HOK with this information are deemed to consent to use of their personal information for marketing purposes.
2.0 TYPES OF PERSONAL INFORMATION COLLECTED
Personal information means any information relating to a person or their household that enables that person to be identified either directly or indirectly. Personal information that we hold about you may include your contact details (e.g. name, phone number, address and email address), IP address, language and gender. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:
- Identity Data includes first name, last name, function/job title, company and gender.
- Contact Data includes business address, email address, phone number.
- Log Data includes internet protocol (IP) address, activity (for example, date and time of access), the pages of our site that you visit and the time spent on those pages, data displayed or clicked on (including UI elements or links), cookie ID, referrer URL, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access hok.com.
- Marketing and Communications Data includes your preferences for receiving marketing from us and your communication preferences.
- Risk Intelligence Data (please see Section 1.0 above).
We also collect, use and share Aggregated Data such as statistical data for various purposes. Aggregated Data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Log Data to calculate the percentage of users accessing a specific feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data and use it in accordance with this privacy policy.
If you are a client, vendor or subconsultant, personal information that we hold about you may include the same information listed above, along with your date of birth, social media/network accounts, types of services provided, and financial compensation. HOK may request that you provide additional information such as your company’s legal status, date of incorporation, place of incorporation, your company’s related entities, your company’s shareholding details, your relationship to any government official, your company’s tax identification numbers, country of origin, business and professional licenses, your company’s insurer, broker and insurance policies, and other information you consent to provide us for purposes of performing contracts or services.
3.0 HOW PERSONAL INFORMATION IS USED
We will use your personal information, and may share your personal information with other parties acting on our behalf, for one or more of the following reasons: (i) to conduct research about the use of our website; (ii) to improve services provided by HOK; (iii) to assess and respond to a complaint you might make to us; (iv) for our own administrative purposes, including training our staff, conducting internal audits, improving our services or transferring assets as part of a sale, purchase or investment in the business; (v) if you are a client, vendor or subconsultant, to perform services or carry out our contract with you; (vi) for market research purposes; (vii) to make informed decisions about business relationships and to prevent inadvertent engagement in illegal or corrupt practices; (ix) to conduct investigations of suspicious or harmful activity; (x) to comply with HOK’s regulatory and legal obligations, and if we observe potentially illegal behavior, to notify law enforcement authorities (where appropriate); (xi) to manage risks related to HOK’s contracts and services; and (xii) for marketing HOK's services or sponsored events. If we wish to use your personal information for a purpose beyond that for which it was originally provided, we will ask for your consent or seek to rely on another valid legal ground to process your personal information in accordance with the applicable law.
Change of purpose (for EEA and UK individuals)
We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
We may process your personal data without your knowledge or consent where this is required or permitted by law.
Your duty to inform us of changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.
4.0 INFORMATION FOR MARKETING PURPOSES
Where you have consented to us using your personal information for marketing purposes, we may use your information to conduct marketing and data analysis or to send you updates and news concerning HOK and its business partners. If at any time after you have consented to us using your information for marketing purposes and you wish us to stop using your information for these purposes, please contact us by email at privacy@hok.com or by mail at HOK Group, Inc., 10 South Broadway, Suite 200, St. Louis, MO 63102; Attention: Corporate Compliance Officer.
Where you opt out of receiving these marketing messages, we can still contact you to perform our contract with you or your company.
5.0 GROUNDS FOR PROCESSING
To process your data lawfully we will rely on one or more valid legal grounds. The grounds we may rely upon include:
- Your consent to a particular processing activity. For example, where you have consented to us using your information for marketing purposes;
- Our legitimate interests as a business (except where your interests or fundamental rights override these). For example, it is within our legitimate interests to use your information to prevent or detect fraud or abuses of our website;
- Our compliance with a legal obligation to which HOK is subject. For example, we have a duty to investigate and respond to complaints made against us and may need to process your personal information as part of such investigation; or
- If you are a client, vendor or subconsultant, because processing your personal information is necessary for the performance of a contract or services.
6.0 DISCLOSURE OF YOUR PERSONAL INFORMATION
There are circumstances where we may wish to disclose or are compelled to disclose your personal information to third-parties. This will only take place in accordance with the applicable law, for the purposes listed above, and pursuant to terms consistent with HOK’s Third-Party Data Privacy Addendum. These scenarios include disclosure to: (i) HOK’s subsidiaries, branches or associated offices; (ii) outsourced vendors or subconsultants to facilitate the provision of our services (including other professional service providers); (iii) third-party service providers and consultants in order to protect the security or integrity of our business, including our databases and systems and for business continuity reasons (including cloud service providers); (iv) another legal entity, on a temporary or permanent basis, for the purposes of a joint venture, collaboration, financing, sale, merger, reorganization, change of legal form, dissolution or similar event; (v) attorneys in connection with negotiation of a contract, dispute resolution, and other legal advice; (vi) tax advisors for purposes of tax filings, obtaining tax credits, negotiating tax liabilities, and other tax advice; (vii) public authorities where we are required by law to do so; and (viii) any other third-party where you have provided your consent. Further, we may disclose your information to any person as required by law and specifically to any government agency if we believe in good faith that we must do so to comply with the law or that doing so is required to prevent, detect, investigate or remedy improper conduct potentially affecting HOK.
HOK’s Third-Party Data Privacy Addendum requires our service providers to respect the security of your personal data and to treat it in accordance with the law. It only permits them to process your personal data for specified purposes and in accordance with our instructions.
7.0 INTERNATIONAL TRANSFER OF PERSONAL INFORMATION (for residents of the EEA / UK)
Whenever we transfer your personal data out of the UK or EEA, we take steps to ensure that a similar level of protection is afforded to it by implementing at least one of the following safeguards:
- We will only transfer your personal data to countries that have been deemed by the UK / EU to provide an adequate level of protection for personal data; or
- We may use specific contracts approved for use in the UK and EEA which give personal data the same protection it has in the UK or EEA.
Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK or EEA.
8.0 RETENTION OF PERSONAL INFORMATION
Your personal information will be retained for as long as it is necessary to carry out the purposes set out in HOK’s Global Privacy Policy (unless longer retention is required by the applicable law). We will not retain any of your personal information beyond this period and the retention of your personal information will be subject to periodic review. We may keep an anonymized form of your personal information, which will no longer refer to you, for statistical purposes without time limits, to the extent that we have a legitimate and lawful interest in doing so.
9.0 CONFIDENTIALITY AND SECURITY
HOK is committed to: (i) seeking to safeguard all personal information that you provide to us; (ii) seeking to ensure that it remains confidential and secure; and (iii) taking all reasonable steps to ensure that personal privacy is respected. We maintain physical, electronic and procedural safeguards to protect your personal information from misuse, unauthorized access or disclosure and loss or corruption by computer viruses and other sources of harm. We restrict access to personal information to those staff members, subsidiary companies and third parties who need to know that information for the purposes set out in HOK’s Global Privacy Policy.
10.0 DATA RIGHTS
Your rights regarding data collected and used by HOK are subject to applicable law. HOK will comply with a verified request to exercise your rights or provide you with a lawful basis for not doing so when applicable.
10.1 EEA, SWISS AND UK RESIDENTS
HOK and Other Covered Entities (defined below) comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. HOK has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. HOK has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.
For DPF purposes, HOK refers to HOK Group, Inc. and “Other Covered Entities” refers to each of the following:
Hellmuth, Obata & Kassabaum, Inc.
HOK International, Ltd.
Hellmuth, Obata & Kassabaum, P.C.
HOK Architects, Inc.
HOK International Holdings, Inc.
HOK, Inc.
HOK Overseas, LLC
In cases of onward transfers to third parties of data received pursuant to the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, HOK is potentially liable under the DPF Principles.
The Federal Trade Commission has jurisdiction over HOK’s compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).
The EU GDPR and the UK GDPR provide EEA and UK residents with certain rights discussed below. Persons exercising these rights will be required to submit a proof of identity and residency in the EEA or UK at the time the request is made. We may also contact you to ask you for further information in relation to your request to speed up our response. EEA and UK residents have the right to:
- Request a copy of your personal information. You have the right to request a copy of the personal information we hold about you by contacting us as directed above. HOK may deny a request to obtain a copy of your personal information when: (i) providing access to information would have an unreasonable impact on the privacy of others; (ii) the information is legally privileged; (iii) we are required by law or contract not to disclose the information; (iv) we are unable to verify your identity at the time the request is made; or (v) it is otherwise lawful to refuse the request.
- Correct your personal information. You may request that we rectify any inaccurate and/or complete any incomplete personal information by contacting us as directed above. If we disagree and believe the information to be accurate and complete, we will advise you and include a notation on the record that you dispute the information’s accuracy.
- Withdraw your consent to processing. You may, as permitted by law, withdraw your consent to the processing of your personal information at any time by contacting us as directed above. Such withdrawal will not affect the lawfulness of processing based on your previous consent. Please note that if you withdraw your consent, you may not be able to benefit from certain service features for which the processing of your personal information is essential.
- Object to processing. You may, as permitted by law, request that we stop processing your personal information where we are relying on a legitimate interest (or that of a third party) and you want to object to the processing as you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may have compelling legitimate grounds to process your data which override your rights and freedoms by contacting us as directed above.
- Erasure. You may request that we erase your personal information where there is no good reason for us to continue to process it by contacting us as directed above. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see above), where we have processed your information unlawfully or where we are required to erase your personal data to comply with local law. We will comply, unless there is a lawful reason for not doing so.
- Request restriction of processing your personal data. You also have the right to restrict us from processing your personal data if the data is inaccurate, the processing is unlawful (but you do not want us to erase it), we no longer need your personal data for the purposes for which we hold it (but you need it to establish, exercise or defend legal claims) or you have objected to our use of your data but we need to verify whether we have an overriding legitimate ground to use it.
- Request transfer of your personal data of your personal data to you or to a third party. This right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
Making a complaint
We suggest that you first contact us regarding any questions or complaints in relation to your rights or how we process your personal information. Questions and complaints regarding HOK’s Global Privacy Policy or its DPF compliance may be directed to us by e-mail at privacy@hok.com or by mail at HOK Group, Inc., 10 South Broadway, Suite 200, St. Louis, Missouri, USA, 63102; Attention: Corporate Compliance Officer. HOK will try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.
However, this does not limit your right to contact your local data protection authority directly. If you are based in the UK, you have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). If you are based in Switzerland, you have the right to make a complaint at any time to the Swiss Federal Data Protection and Information Commissioner (FDPIC), the Swiss regulator for data protection issues (https://www.edoeb.admin.ch/edoeb/en/home.html). If you are based in the EEA, you can complain to your local regulator or The Federal Commissioner for Data Protection and Freedom of Information, which is the regulator of our EEA Representative.
Our EEA Representative is:
EEA Representative: Rickert Rechtsanwaltsgesellschaft mbH
Email address: art-27-rep-hok@rickert.law
Postal address: Colmantstraße 15
53115 Bonn
Germany
If HOK does not timely acknowledge a complaint, or if we have not satisfactorily addressed a complaint, data subjects may: (i) submit their complaint to their local data protection authority for referral to the U.S. Department of Commerce; or (ii) seek a non-monetary remedy through binding arbitration administered by the International Centre for Dispute Resolution® - American Arbitration Association® (“ICDR-AAA”) in accordance with the DPF Principles. The services of ICDR-AAA are provided at no cost to data subjects. To learn more about the independent recourse mechanism provided by the ICDR-AAA, please visit go.adr.org/privacyshield.html.
In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, HOK commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF in the context of the employment relationship.
No fee usually required
You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.
10.2 CALIFORNIA RESIDENTS
The California Consumer Privacy Act of 2018 (“CCPA”) provides California residents (referred to as “Consumers”) with certain rights discussed below. Consumers may contact HOK regarding any of these rights by email at privacy@hok.com; by mail at HOK Group, Inc., 10 South Broadway, Suite 200, St. Louis, Missouri, USA, 63102, Attention: Corporate Compliance Officer; or by telephone at 1 (866) 838-0888. An online portal for Consumers to submit a request to exercise a right is under development. HOK will respond within a reasonable time following receipt of a verified Consumer request, in any event, within the time period specified by law.
Consumers exercising their rights will be required to complete a questionnaire and submit a proof of identity and residency in California. Verification of identity will require, at a minimum, two (2) forms of government issued identification (such as a passport and driver’s license) and (1) form of proof of residency (such as a utility bill) showing residency in California at the time the request is made. HOK may request additional information it deems necessary or desirable to verify the identity of a person making a request under the CCPA for specific personal information. All information requested during the verification process shall be used solely for verification of identity and residency.
Consumers have the right to designate an agent to act on their behalf. Consumers wishing to do this and agents acting on behalf of Consumers should contact HOK as provided above.
HOK does not sell personal information as defined under the CCPA.
Consumers have the right to:
- Request to Know. You have the right to obtain a copy of the personal information and the categories of personal information we hold about you by contacting us as directed above.
- Request to Delete. You have the right to request that we delete your personal information by contacting us as directed above.
- You have the right to receive HOK’s products and services on equal terms regardless of whether you exercise your rights under the CCPA.
11.0 LINKS
Our website may provide hyperlinks to websites owned and controlled by others. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. HOK is not responsible for the privacy practices of any website that it does not own or otherwise control.
12.0 THIRD PARTIES
Where you submit information on behalf of another person, you confirm that you have made that person aware of how we may collect, use and disclose their information, the reason you have provided it, how they can contact us, the terms of this policy and that they have consented to such collection, use and disclosure.
13.0 COMPLIANCE WITH PRIVACY LAWS
HOK complies with the data protection and privacy laws to which it is subject. You should satisfy yourself that you are familiar with those laws, including any exceptions which may apply under them. You should also be aware that privacy laws in various jurisdictions may change from time to time. Notwithstanding contrary terms in HOK’s Global Privacy Policy, HOK accepts no obligations with respect to the handling of personal information other than those mandated by law in the country which has, or counties which have jurisdiction over HOK in any given circumstances. Notwithstanding anything else in herein, if there are any terms, conditions, or policies in HOK's General Privacy Policy that conflict with local laws and regulations where you reside or from where you access our services, such local laws and regulations shall prevail.
14.0 CHANGES TO THIS POLICY
As we strive to improve our practices, we may review HOK’s General Privacy Policy from time to time. We reserve the right to change this policy at any time and to notify you of those changes by posting an updated version of this policy on our website. It is your responsibility to check our policy each time before you access our website for any changes.
15.0 SUBSIDIARIES AND AFFILIATES
- HOK, Inc. (Missouri);
- HOK Overseas, LLC;
- HOK Blue Box Ventures, LLC;
- HOK, Inc. Thailand Branch;
- HOK, LLC (Delaware);
- HOK Architects, Inc.;
- Hellmuth, Obata & Kassabaum, P.C.;
- Hellmuth, Obata & Kassabaum, Inc.
- Hellmuth, Obata & Kassabaum, Inc. (d/b/a HOK North America, Inc.);
- HOK International, Ltd (Delaware);
- HOK Design and Planning Services (India) Pvt. Ltd.;
- HOK International, Ltd. (United Kingdom);
- HOK International Holdings, Inc.;
- HOK Architects Corporation;
- HOK, Inc. (Ontario);
- HOK International (Asia/Pacific) Limited;
- HOK International (Beijing) Ltd.;
- HOK, Inc. Abu Dhabi Branch;
- HOK, Inc. Dubai Branch; and
- HOK International (Beijing) Ltd. Shanghai Branch.