Applicant Privacy

Esri is a U.S. based company which processes applicants' personal information in the U.S. to the extent required or permitted by applicable law.

Esri recognizes and respects the privacy of applicants with regard to personal information it obtains through the hiring process.

As evidence of our commitment in this regard, this policy provides information regarding the processing of personal information about candidates and describes our general practices regarding your privacy as an Esri job applicant.

Esri participates in and has certified its compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and, as applicable the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries, the United Kingdom and Switzerland. Esri is subject to the investigatory and enforcement powers of the Federal Trade Commission. Esri has certified that it adheres to the DPF Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. To learn more about the DPF program, please visit https://www.dataprivacyframework.gov/s/, and to view Esri's certification, please visit https://www.dataprivacyframework.gov/s/participant-search.

Esri is responsible for the processing of personal data it receives, under the Data Privacy Framework, and subsequent transfers to a third party acting as an agent on its behalf. Esri complies with the DPF Principles for all onward transfers of personal data from the EU, the United Kingdom and Switzerland, including the onward transfer liability provisions.

• Name, identity and contact details such as your name, address, email address, telephone, other contact information and personal preferences.
• Equal opportunities monitoring information, on a voluntary basis, such as disability status, veteran status, gender, and ethnicity.
• Employment details such as details of your employment background, including position, work experience, and employment references.
• Background information such as your educational background including degrees, certificates, credit history, and/or criminal background screenings (where relevant to your application and permitted under applicable law).
• IT Information such as certain technical information from you about your visit to our website using "cookies" and other similar technologies.
• Any other information in your application that you voluntarily share with us such as personal preferences, hobbies, social preferences, etc.

Categories of Sensitive Personal Information:

• Social security, driver's license, state identification card, and passport numbers.
• Racial or ethnic origin.

Esri does not require or request personal information concerning religious or philosophical beliefs, union membership, sex life or sexual orientation. If such information is volunteered by a job applicant, Esri will not use it for any purpose.

Esri may collect personal information in a variety of ways, including data that might be contained in application forms, CVs or resumes, obtained from your passport or other identity documents, or collected through interviews or other forms of assessment. We may also collect personal data about you from third parties, such as references supplied by previous employers. We will seek information from third parties only once a job offer has been made and will inform you that we are doing so.

Esri will collect any sensitive personal information from you based on your affirmative express consent if such information is to be disclosed to a third party or used for purposes other than those for which it was originally collected or subsequently authorized by you.

Esri will only collect and use candidate personal information fairly and lawfully. Esri will not share candidate personal information for direct marketing purposes outside of Esri.

The Company will take reasonable steps to ensure that it does not collect or use irrelevant, excessive, or inadequate candidate personal information.

Esri will only collect and use candidate personal information:

• As necessary for recruitment, selection, evaluation, and appointment of job candidates for the job you have applied for and for subsequent job opportunities.
• Application analysis such as verification of your employment reference(s) that you have provided, background checks, and related assessments.
• Compliance with corporate governance and legal requirements; and
• Communication with you and informing you of the status of your application and future opportunities.

Esri will only use personal information for the purposes for which it was collected and for purposes compatible with the original purpose. If Esri needs to use your personal information for an unrelated purpose, Esri will notify you.

Your information may be shared internally for the purposes of the recruitment process. This includes members of the HR and recruitment team, interviewers involved in the recruitment process, managers in the business area with a vacancy and IT staff, if access to the data is necessary for the performance of their roles.

Your personal information may be disclosed by Esri to its subsidiaries, affiliates, and service providers that support the purposes described in this notice. We will not share your data with any other third parties unless your application for employment is successful and we offer you employment. In which case, your personal data, such as name and email address, will be sent to our background check provider to initiate the background screening process to the extent permitted or required by applicable laws.

In the context of an onward transfer, Esri will remain responsible for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on our behalf. Esri shall remain liable under the DPF Principles if our third-party agent processes such personal information in a manner inconsistent with the DPF Principles, unless Esri can prove that it is not responsible for the event giving rise to the damage.

Esri will use commercially reasonable efforts to ensure that it has in place appropriate technical and organizational security measures to protect candidates' personal information against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure or access and all other unlawful forms of processing.

In particular, where Esri contracts with third party service providers to collect and/or process employee candidate information on its behalf, it will ensure that the service providers are bound by written agreements requiring them to process the information only on the instructions of Esri and to have appropriate technical and organizational security measures in place to protect the information.

Unless you delete your personal information, we will retain it for a minimum of 36 months from your last update, unless otherwise required by law. If you are hired by Esri, we will retain the personal information you have submitted as part of your employment record for the term of your relationship with Esri and for any post-termination period permitted or required by law.

Subject to certain exceptions under applicable law, you have the rights to:

• Know what specific pieces of personal information Esri has collected and retained about you.
• Correct errors in personal information.
• Receive a copy of your personal information in a structured, commonly used and machine-readable format and transmit personal information to another party.
• Delete your personal information.
• Restrict or object to the processing of your personal information or withdraw your consent, and
• Opt out of Esri disclosing your personal information to a third party or using it for a purpose materially different from the purpose for which it was originally collected or authorized by you.

The privacy law prohibits discriminating against you for exercising your rights under the law. You can exercise your rights by contacting privacy@esri.com.

You also have a right to opt out of any selling of your personal information. Esri does not sell applicants' personal information, so we do not offer a choice to opt out.

Esri shares personal information related to Esri website visitors with third parties for the purpose of cross-context behavioral advertising. You can opt out from such sharing in the consent preference center by clicking on Manage Cookies at the bottom of the page.

Esri's Chief Privacy Officer and Chief Human Resources Officer are responsible for administering and overseeing implementation of this notice and, as applicable, developing related processes, policies, training, notices, and guidelines. If you have any questions or are concerned that any provision of this notice has been violated, please contact the Chief Privacy Officer at privacy@esri.com. Esri will respond within 45 days.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

If neither Esri nor our dispute resolution provider resolves your complaint satisfactorily, you may explore invoking binding arbitration through the Data Privacy Framework Panel, which is more fully described in Annex I of the Data Privacy Framework Principles.

DPO and EU Representative

Esri has appointed a Data Protection Officer (DPO) and an EU Representative. They can be reached as indicated below.

Esri's Data Protection Officer: Ksenia Turk
Address: 380 New York St., Redlands, CA 92373
Telephone: +1 909 793 2853
Email: privacy@esri.com

Esri's EU Representative: nFrames GmbH, Esri R&D Center Stuttgart
Address: Kornbergstraße 36, 70176 Stuttgart, Germany
Telephone: +49 711 997 887 28
Email: dataprivacyeurope@esri.com