Esri Privacy Statement (Trust Center Privacy Intro)

ARCHIVED 2021-06-07, DATE APPROXIMATE · VERSION 20210607_rev01 · COMPARED WITH 20210201_rev01

Full text changes — 20210201_rev01 to 20210607_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

+Esri values the privacy of our customers, distributors, and business partners, as it is a principal component of establishing trust. Esri has created a general company Privacy Statement and a supplementary Products & Services Privacy Statement to ensure our customers receive the level of privacy they deserve and expect. The privacy statements describe how Esri collects data and uses information you provide to us, and are independently validated.
+Esri values the privacy of our customers, distributors, and business partners, as it is a principal component of establishing trust. Esri has created a general company Privacy Statement and a separate supplement to ensure our customers receive the level of privacy they deserve and expect. The privacy statements describe how Esri collects data and uses information you provide to us and are independently validated.
+Esri works diligently to ensure we provide a trustworthy environment for our customers; therefore, we are continuously making new privacy and security advancements to ensure we meet evolving requirements around the world. The most recent examples of this are the expansion of the supplemental ArcGIS Online privacy statements to cover a broader base across Esri Products & Services while also updating privacy statements to be in line with Privacy Shield.
+## Recent Privacy Advancements
+Esri is committed to compliance with the European privacy law, the General Data Protection Regulation (GDPR) which went into enforcement May 2018. The GDPR imposes new rules on companies, government agencies, non-profits, and other organizations outside the European Union that process personal data related to the offering of goods and services to people in the European Union (EU), or that monitor the behavior of EU citizens within the European Union.
+Esri works diligently to ensure we provide a trustworthy environment for our customers; therefore, we are continuously making new privacy advancements to ensure we meet evolving requirements around the world including:
+Esri is also committed to compliance with the California Consumer Privacy Act (CCPA), which went into effect January 1, 2020. To help our customer use our products in a manner that supports them meeting their GDPR and CCPA obligations, Esri has released the [ArcGIS Location Tracking Privacy Best Practices](https://downloads.esri.com/resources/enterprisegis/Esri%20Whitepaper%20-%20ArcGIS%20Location%20Tracking%20Privacy%20Best%20Practices.pdf) whitepaper.
+- [Data Processing Addendum (DPA)](https://www.esri.com/content/dam/esrisites/en-us/media/legal/gdpr-data-processing-addendums/data-process-addend.pdf) updated to include Supplementary Measures
+- [HIPAA Aligned Geocoding Services](https://trust.arcgis.com/en/privacy/hipaa.htm)
+- Expansion of Trust Center Privacy-Separate pages for [GDPR](https://trust.arcgis.com/en/privacy/gdpr.htm), [CCPA](https://trust.arcgis.com/en/privacy/ccpa.htm), and [HIPAA](https://trust.arcgis.com/en/privacy/hipaa.htm)
+We have posted to the Trust Center an [Esri signed Data Processing Addendum (DPA)](https://www.esri.com/~/media/files/pdfs/legal/pdfs/data-process-addend.pdf) that our customers can sign which includes the Standard Contractual Clauses (SCC's) for assurance purposes.
+Esri has decided to withdraw from the Privacy Shield Framework following the decision by the Court of Justice of the European Union invalidating it. To continue compliance with European and Swiss Privacy regulations, Esri will rely on Standard Contractual Clauses and supplementary measures as part of its Data Processing Addendum to protect transferred Personal Data from the European Economic Area, the United Kingdom and Switzerland to the United States. Esri continues engaging trusted third parties to validate our adherence to privacy principles.
 ## Esri Privacy Statement
+Esri complies with the EU-U.S. and the Swiss-U.S. Privacy Shield Frameworks as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom and Switzerland to the United States. Esri has certified to the Department of Commerce that it adheres to the Privacy Shield Principles. If there is any conflict between the terms in our statements here or privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern.
+Esri provides a baseline of privacy assurance within the general Esri Privacy Statement. Esri's marketing sites and other public websites are governed by the general Esri Privacy Statement. The Privacy Statement answers the following questions:
+Esri's participation in the Privacy Shield applies to all personal data that is subject to the Esri Privacy Statement and is received from the European Union, the United Kingsom and Switzerland. Esri will comply with the Privacy Shield Principles in respect of such personal data.
+- [What personal information does Esri collect and receive?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+- [Why is Esri collecting my personal information?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+- [With whom does Esri share my pesonal information?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+- [Is my personal information secured?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+- [What are my privacy choices?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+- [Can I access and update my personal information?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+- [Will Esri modify its Privacy Statement?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+- [How can I contact Esri regarding the Privacy Statement?](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
+To learn more about the Privacy Shield program, and to view our certification, please visit [www.privacyshield.gov](https://www.privacyshield.gov/participant). The [Esri Privacy Statement](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement) is also viewable on the Esri website.
+To learn more about our company's general privacy assurance please review the [Esri Privacy Statement](https://www.esri.com/en-us/privacy/privacy-statements/privacy-statement)
 ## Esri Products & Services Privacy Statement Supplement
+The Products & Services Privacy Statement Supplement applies to the Esri Products, Services and related offerings that display or link to the "Products & Services" notice. Esri established the Products & Services Privacy Statement Supplement in order to clarify that the use of information to which it may be provided access in order to deliver Product & Services, is more limited than the use of information covered by the general Esri Privacy Statement.
+Esri's supplement clarifies that the use of information to which it may be provided access in order to deliver product and services, is _more limited_ than the use of information covered by the general Esri Privacy Statement.
+Key offerings that fall within the scope of Products & Services include ArcGIS Online, Esri Managed Cloud Services, Customer Support, and Professional Service engagements. Customers who utilize organization (cost based) accounts, of Products & Services such as ArcGIS Online, expect a higher level of privacy assurance which is reflected in the Products & Services Privacy Statement Supplement, whereas consumers of public accounts are provided the privacy assurance level of the Esri Privacy Statement. Esri's marketing sites and other public websites are governed by the general Esri Privacy Statement.
+Key offerings that fall within the scope of products and services include ArcGIS Online, Esri Managed Cloud Services, Customer Support, and Professional Service engagements. Customers who utilize organization (cost based) accounts, of products and services such as ArcGIS Online, expect a higher level of privacy assurance which is reflected in the Products & Services Privacy Statement Supplement, whereas consumers of public accounts are provided the privacy assurance level of the Esri Privacy Statement.
 The [Products & Services Privacy Statement Supplement](https://www.esri.com/en-us/privacy/privacy-statements/privacy-supplement) provides clarity concerning:
+- The importance of the privacy of our Customer Data to be treated as confidential
+- The collection and handling of Support Data when engaging with Esri for support
+- Not storing payment instrument number information within Esri systems from credit cards
+- The requirement of cookies for many products when non-anonymous access is required
+- Customer Data is owned by the customer and is treated as confidential
+- Collection and handling of Support Data when engaging with Esri support
+- Not storing credit card payment instrument number information within Esri systems
+- Non-anonymous products frequently require necessary cookies
 - Ability to configure on-premises products to not collect or transmit data to Esri
 - Constraints in place for limiting disclosure of data
+- In the event of a conflict between the general Esri Privacy Statement and the more restrictive terms of the Products & Services Privacy Statement Supplement, with regard to data provided to Esri in connection with use of the "Products & Services" the Products & Services Privacy Statement Supplement will control
+- Data provided to Esri in connection with products & services are controlled by the more restrictive terms of the Products & Services Privacy Statement Supplement
 ## ArcGIS Online Privacy Assurance
 ArcGIS Online privacy assurance is boosted by the Products & Services Privacy Statement Supplement as well as the following additional items:
 - Our cloud infrastructure providers are ISO 27018 (Cloud Privacy) compliant and Esri has executed EU Model Clause addendums with them