Esri Privacy Statement (Trust Center Privacy Intro)

20250703_rev01 · COMPARED WITH 20250603_rev01 · ARCHIVE SNAPSHOT, DATE APPROXIMATE

Full text changes — 20250603_rev01 to 20250703_rev01

11Esri values the privacy of our customers, distributors, and business partners, as it is a principal component of establishing trust. Esri has created a general company Privacy Statement and a separate supplement to ensure our customers receive the level of privacy they deserve and expect. The privacy statements describe how Esri collects data and uses information you provide to us and are independently validated.
22
33## Recent privacy advancements
44
55Esri works diligently to ensure we provide a trustworthy environment for our customers; therefore, we are continuously making new privacy advancements to ensure we meet evolving requirements around the world including:
66
7- [Data Processing Addendum (DPA)](https://www.esri.com/content/dam/esrisites/en-us/media/legal/gdpr-data-processing-addendums/data-process-addend.pdf) updated to include Supplementary Measures
8- [ArcGIS Online HIPAA Eligible Services](https://trust.arcgis.com/en/compliance/hipaa.htm)
9- Expansion of Trust Center Privacy-Separate pages for [GDPR](https://trust.arcgis.com/en/compliance/gdpr.htm), [CCPA](https://trust.arcgis.com/en/compliance/ccpa.htm), and [HIPAA](https://trust.arcgis.com/en/compliance/hipaa.htm)
7- [Data Processing Addendum (DPA)](https://www.esri.com/content/dam/esrisites/en-us/media/legal/gdpr-data-processing-addendums/data-process-addend.pdf) updated to include Supplementary Measures.
8- [ArcGIS Online HIPAA Eligible Services](https://trust.arcgis.com/en/compliance/hipaa.htm).
9- Expansion of Trust Center Privacy-Separate pages for [GDPR](https://trust.arcgis.com/en/compliance/gdpr.htm), [CCPA](https://trust.arcgis.com/en/compliance/ccpa.htm), and [HIPAA](https://trust.arcgis.com/en/compliance/hipaa.htm).
1010
1111Esri is committed to protecting the privacy of its customers around the world. Esri ensures compliance with European and Swiss privacy regulations by relying on Standard Contractual Clauses (SCCs) and supplementary measures as part of its Data Processing Addendum to protect the transfer of personal data from the European Economic Area (EEA), the United Kingdom, and Switzerland to the United States. Additionally, Esri has obtained certification under the EU-US Data Privacy Framework (DPF) to facilitate and ensure the protection of data transfers between the EU and the US. Esri engages trusted third parties to validate adherence to privacy principles and maintains data protection standards.
1212
1313## Esri privacy statement
1414
1515Esri provides a baseline of privacy assurance within the general Esri Privacy Statement. Esri's marketing sites and other public websites are governed by the general Esri Privacy Statement. The Privacy Statement answers the following questions:
3030Esri's supplement clarifies that the use of information to which it may be provided access in order to deliver product and services, is _more limited_ than the use of information covered by the general Esri Privacy Statement.
3131
3232Key offerings that fall within the scope of products and services include ArcGIS Online, Esri Managed Cloud Services, Customer Support, and Professional Service engagements. Customers who utilize organization (cost based) accounts, of products and services such as ArcGIS Online, expect a higher level of privacy assurance which is reflected in the Products & Services Privacy Statement Supplement, whereas consumers of public accounts are provided the privacy assurance level of the Esri Privacy Statement.
3333
3434The [Products & Services Privacy Statement Supplement](https://www.esri.com/en-us/privacy/privacy-statements/privacy-supplement) provides clarity concerning:
3535
36- Customer Data is owned by the customer and is treated as confidential
37- Collection and handling of Support Data when engaging with Esri support
38- Not storing credit card payment instrument number information within Esri systems
39- Non-anonymous products frequently require necessary cookies
40- Ability to configure on-premises products to not collect or transmit data to Esri
41- Constraints in place for limiting disclosure of data
42- Data provided to Esri in connection with products & services are controlled by the more restrictive terms of the Products & Services Privacy Statement Supplement
36- Customer Data is owned by the customer and is treated as confidential.
37- Collection and handling of Support Data when engaging with Esri support.
38- Not storing credit card payment instrument number information within Esri systems.
39- Non-anonymous products frequently require necessary cookies.
40- Ability to configure on-premises products to not collect or transmit data to Esri.
41- Constraints in place for limiting disclosure of data.
42- Data provided to Esri in connection with products & services are controlled by the more restrictive terms of the Products & Services Privacy Statement Supplement.
4343
4444## ArcGIS Online privacy assurance
4545
4646ArcGIS Online privacy assurance is boosted by the Products & Services Privacy Statement Supplement as well as the following additional items:
4747
48- Our cloud infrastructure providers are ISO 27018 (Cloud Privacy) compliant and Esri has executed EU Model Clause addendums with them
49- Security and privacy assurance of FedRAMP third-party validation and mapping to ISO27k
50- Customers maintain full ownership of their customer content
51- Customer may choose not to store personal information in ArcGIS Online
52- Customers can choose to limit storage of personal information to their own infrastructure with a hybrid deployment model
53- Esri collects minimal personal information in order for customers to use ArcGIS Online
48- Our cloud infrastructure providers are ISO 27018 (Cloud Privacy) compliant and Esri has executed EU Model Clause addendums with them.
49- Security and privacy assurance of FedRAMP third-party validation and mapping to ISO27k.
50- Customers maintain full ownership of their customer content.
51- Customer may choose not to store personal information in ArcGIS Online.
52- Customers can choose to limit storage of personal information to their own infrastructure with a hybrid deployment model.
53- Esri collects minimal personal information in order for customers to use ArcGIS Online.
5454
5555ArcGIS Online utilizes the cloud infrastructure of Microsoft Azure and Amazon Web Services (AWS); therefore, customer data may flow through these systems or be stored within them. Applicable privacy policies are provided below for your ease of reference:
5656
57- [Esri Products & Services Privacy Supplement](https://www.esri.com/en-us/privacy/privacy-statements/privacy-supplement)
58- [MS Azure privacy statement](https://azure.microsoft.com/en-us/support/legal/privacy-statement/)
59- [AWS privacy policy](https://aws.amazon.com/privacy/)
57- [Esri Products & Services Privacy Supplement](https://www.esri.com/en-us/privacy/privacy-statements/privacy-supplement).
58- [MS Azure privacy statement](https://azure.microsoft.com/en-us/support/legal/privacy-statement/).
59- [AWS privacy policy](https://aws.amazon.com/privacy/).
6060
6161- * *
6262
6363[Feedback on this topic?](https://trust.arcgis.com/feedback/)