Agmt25 ESRI Master Purchase Agreement

Browse Search

E204 (Products and Services) REV: 07-22-25 MI February 14, 2025 ATTACHMENT D DATA PROCESSING ADDENDUM Data Processing Addendum This Data Processing Addendum ("Addendum") is effective on the first date that Customer provides to Esri Personal Data (as defined below) subject to the applicable Privacy Law (as defined below) and forms part of the Master Agreement or other written or electronic agreement ("Agreement") by and between the organization signing or accepting below ("Customer") and Environmental Systems Research Institute, Inc. ("Esri"), and sets forth the terms and conditions relating to the privacy, confidentiality, and security of Personal Data associated with Online Services and subscription and maintenance services to be rendered by Esri to Customer pursuant to the Agreement. All terms defined or used in the Agreement shall have the same meaning in this Addendum unless otherwise specified. Terms used in this Addendum that are not defined herein or in the Agreement shall have the meaning set forth in the applicable Privacy Law. Whereas Customer may provide Esri, a company located in the United States, with access to Personal Data to act as a Processor or Service Provider in connection with Online Services and subscription and maintenance services performed by Esri for or on behalf of Customer pursuant to the Agreement; and Whereas Customer requires that Esri preserve and maintain the privacy and security of such Personal Data as a Processor according to the terms of this Addendum; Now therefore, in consideration of the mutual covenants and agreements in this Addendum and the Agreement and for other good and valuable consideration, the sufficiency of which is hereby acknowledged, Customer and Esri agree as follows: SECTION I DEFINITIONS A."Privacy Laws" means the European Union (EU) General Data Protection Regulation (GDPR) 2016/679 of the European Parliament and of the Council of 27 April 2016, the California Consumer Privacy Act of 2018 (CCPA) (as amended by the California Privacy Rights Act [CPRA]), or other privacy laws applicable to Esri. B. The terms "personal data," "data subject," "processing," "controller," "processor," and "supervisory authority" as used in this Addendum have the meanings given in the GDPR. C."Personal Data" means personal data, personal information, or personally identifiable information as defined in applicable Privacy Laws about individuals located in the European Union; Switzerland; the United Kingdom; California, USA; or other locations covered by Privacy Laws and may include, but not be limited to, the following: (i) categories of data subjects: prospects, customers, business partners, and vendors; and (ii) types of personal data: name, title, position, email address, and location. D."Data Incident" means a breach of Esri's security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data on systems managed or otherwise controlled by Esri. Data Incidents will not include unsuccessful attempts or activities that do not compromise the security of Personal Data, including unsuccessful login attempts, pings, port scans, denial-of-service attacks, and other network attacks on firewalls or networked systems. E."Data Privacy Framework" means the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). ATTY/AGR.2025.178/Environmental Systems Research Institute, Inc.(ESRI Agreement for Services) (Page 23 of 31)