Agmt25 ESRI Master Purchase Agreement

Browse Search

E204 (Products and Services) REV: 07-22-25 MI February 14, 2025 SECTION II PRIVACY, CONFIDENTIALITY, AND INFORMATION SECURITY A. Authority to Process Personal Data i. Customer and Esri agree that Customer is the Controller and Esri is the Processor or Service Provider of Personal Data, except when Customer is a Processor of Personal Data, then Esri is a subprocessor. ii These Addendum terms do not apply where Esri is a Controller of Personal Data (e.g., Personal Data received and Processed by Esri as needed for account setup, authorization, and sign-on in the My Esri self- service portal). Esri's Privacy Statement (available at https://www.esri.com/en-us/privacy/privacy- statements/privacy-statement), together with any related privacy notices or statements, and the Data Transfer Agreement apply where Esri is a Controller iii. Esri will Process Personal Data only with Customer's written instructions (a) on behalf of and for the benefit of Customer; (b) for the purposes of Processing Personal Data in connection with the Agreement; and (c) to carry out its obligations pursuant to this Addendum, the Agreement, and applicable Privacy Laws and other law. iv. Customer will have the exclusive authority to determine the purposes for and means of Processing Personal Data. Esri will not (a) retain, use, or disclose Personal Data outside of the direct business relationship between the parties or for any purpose other than performing under the Agreement, except as otherwise permitted by this Addendum or the Privacy Laws; or (b) combine Customer's Personal Data with any other personal information received or collected from or on behalf of another person, provided that Esri may combine personal information for a business purpose (as defined under CCPA/CPRA). v. The subject matter and details of the processing are described in Annex I of Attachment 1, and this Addendum (including the Attachment and Annexes) and the Agreement are Customer's complete instructions to Esri for the Processing of Personal Data. Any alternative or additional instructions may only be by written amendment to this Addendum. vi. To the extent Customer discloses or otherwise makes available deidentified data (as defined in CCPA/CPRA or other Privacy Laws) to Esri or Esri creates deidentified data from Personal Data, Esri shall (a) implement reasonable measures to ensure that such deidentified data is not used to infer information about or otherwise be linked to a particular natural person or household; (b) publicly commit to maintain and use such deidentified data in a deidentified form and not attempt to reidentify the deidentified data; and (c) before sharing deidentified data with any affiliate or third party, including subprocessors, contractors, or any other persons ("Recipients"), contractually obligate any such Recipients to comply with all requirements of this section. Notwithstanding the prior sentence, Esri may attempt to reidentify the data solely for the purpose of determining whether its deidentification processes are compliant with Privacy Laws. B. Disclosure of and Access to Personal Data i. Esri will hold in confidence all Personal Data. Esri will not Sell or Share (as defined in the CCPA/CPRA) Personal Data. ii. Esri will (a) provide at least the same level of privacy protection for Personal Data received from Customer, as is required by the GDPR, CCPA, and other applicable Privacy Laws, and the Data Privacy Framework principles that may be found on the Data Privacy Framework website; (b) promptly notify Customer if at any time Esri determines that it can no longer meet its obligation to provide the same level of protection as is required by the Privacy Laws and the Data Privacy Framework and (c) take reasonable and appropriate steps to remediate the processing of such Personal Data. If, at any time, Customer notifies Esri that Customer has reasonably determined that Esri is not Processing the Personal Data in compliance with the Privacy Laws, Customer may take reasonable and appropriate steps to stop and remediate any unauthorized Processing of such Personal Data. ATTY/AGR.2025.178/Environmental Systems Research Institute, Inc.(ESRI Agreement for Services) (Page 24 of 31)