Agmt25 ESRI Master Purchase Agreement

Browse Search

E204 (Products and Services) REV: 07-22-25 MI February 14, 2025 ANNEX II TECHNICAL AND ORGANISATIONAL MEASURES INCLUDING TECHNICAL AND ORGANISATIONAL MEASURES TO ENSURE THE SECURITY OF THE DATA Esri will maintain administrative, physical, and technical safeguards for protection of the security, confidentiality and integrity of Personal Data uploaded to ArcGIS Online Services and subscription and maintenance services, as described in the Security and Privacy Documentation applicable to the specific ArcGIS Online Services and subscription and maintenance services purchased by the data exporter, as updated from time to time, and accessible via https://trust.arcgis.com/en/security/security-overview.htm or otherwise made reasonably available by Esri. A. Technical Measures for ArcGIS Online Services. Esri implemented the following technical measures for the above-referenced ArcGIS Online Services: i. The state-of-the-art encryption algorithm and its parameterization (e.g., key length; operating mode, if applicable) are used for Customer data at rest. ii. The strength of the encryption takes into account the time period during which the confidentiality of the encrypted personal data must be preserved. iii. The encryption algorithm is implemented by properly maintained software, the conformity of which to the specification of the algorithm chosen has been verified by certification. iv. The keys are reliably managed (generated, administered, stored, linked to the identity of an intended recipient, and revoked). v. ArcGIS Online allows Customer (data exporter) to pseudonymize the fields (e.g., user credentials) in such a manner that the personal data can no longer be attributed to a specific data subject, nor be used to single out the data subject in a larger group, without the use of additional information exclusively held and controlled by Customer (data exporter), of which Customer (data exporter) retains sole control of the algorithm or repository that enables reidentification using additional information. vi. ArcGIS Online supports best practices for transport encryption protocols. vii. A trustworthy public key certification authority and infrastructure are used. viii. Specific protective and state-of-the-art measures are used against active and passive attacks. ix. The existence of backdoors (in hardware or software) has been ruled out. x. ArcGIS Online can be used in combination with ArcGIS Enterprise in a configuration that allows Customer (data exporter) to store and manage Personal Data under Customer's (data exporter's) control without transferring it to a third country, whereas a data exporter processes Personal Data in such a manner that it is split into two or more parts, and the part that is being transferred to the third country can no longer be interpreted or attributed to a specific data subject without the use of additional information under Customer's (data exporter's) control. Additional information on technical measures can be found at https://trust.arcgis.com/en/documents/. B. Organizational and Contractual Measures i. Esri's efforts around privacy are described at https://www.esri.com/en-us/privacy/overview. ii. Esri commits to treating Personal Data per its Privacy Statement (available at https://www.esri.com/en- us/privacy/privacy-statements/privacy-statement) and the Esri Products & Services Privacy Statement Supplement (available at https://www.esri.com/en-us/privacy/privacy-statements/privacy-supplement). iii. Esri provides a pre-signed Data Processing Addendum that contains Standard Contractual Clauses, available at https://www.esri.com/en-us/privacy/privacy-gdpr. iv. Esri maintains and enforces an internal personal information protection policy that requires employees to protect Personal Data that they access. v. Esri maintains a corporate security policy that addresses access controls and corporate security measures. C. Adoption of Further Requirements and Right to Early Termination. If supervisory authorities adopt further requirements and measures with regard to the transfer of Personal Data to the US, Esri will amend this Addendum to fulfill the additional requirements. If Esri cannot meet the additional requirements, Customer shall have the right to terminate the Agreement for convenience (without termination fee or penalty) by giving written notice thereof to Esri. ATTY/AGR.2025.178/Environmental Systems Research Institute, Inc.(ESRI Agreement for Services) (Page 31 of 31)