Westinghouse Nuclear Privacy Statement

We collect and process different Personal Data when you visit our Websites, as follows:

1. When you contact us through the Websites, or register to our newsletter or blogs, you are required to provide some Personal Data, including:
   • identification and contact information (such as first name, last name, telephone number, email address and postal address) for your or for others (e.g., principals in your business);
   • employment information (such as title, division, and employer);
   • some demographic information;
   • information used to create your online account (such as username, password);
   • other information you may submit to us through the “contact us” feature.
2. The following Personal Data will be processed for those customers accessing our trainings:
   • identification and contact information (such as first name, last name, telephone number, email address and postal address) for your or for others (e.g., principals in your business);
   • some demographic information (such as job title);
   • last log-in records.
3. The following Personal Data will be processed when customers use the rapid EIDMS web page:
   • identification and contact information (such as first name, last name, telephone number, email address and postal address) for your or for others (e.g., principals in your business);
   • employment information (such as title, division, and employer);
   • some demographic information (such as citizenship);
   • information used to create your online account (such as username, password).
4. The following Personal Data will be requested to create an account on our Careers website, to Join Talent Community or to create a Job Alerts:
   • identification and contact information (such as first name, last name, email address, country of residence);
   • information needed to create your online account (such as username, password).

   If you wish to apply for job opportunities, you will be required submit further job specific information such as your resume or CV, employment history, citizenship information, etc.

5. The following Personal Data will be requested to create and account and access the Supplier portal:
   • identification and contact information (such as first name, last name, telephone number, email address);
   • employment information (such as title, division, and employer);
   • information used to create your online account (such as username, password).
6. In general, when you visit our Websites, we automatically collect some information from you (for example, your IP address, referral pages, data and time of site access, and site visited) by automated means, using technologies such as cookies, web server log, and web beacons. In addition, the browser transmits further data about your online activities and stores it through our web server. These include information about your devices, browsing actions, location, and use of third-party websites, that we obtain through the use of cookies. See the section of Cookies, Analytics, Tracking Tools, Social Plug-Ins, Westinghouse respects and protects the privacy of visitors to the Westinghouse website. Visitor-specific information of a personal nature is not normally collected. However, the website provides contact information and email addresses throughout the site to permit visitor communication. When a visitor communicates with the Westinghouse website via email, a record of the visitor’s email address and name (if provided) will be maintained). Information provided by visitors when completing any online forms will also be maintained.

When you use our Websites we may collect certain information by automated means, using technologies such as cookies, web server logs, web beacons and JavaScript.

1. Cookies

   Cookies are files that websites send to your computer or other Internet-connected device to uniquely identify your browser or to store information or settings on your device.

   Your browser may tell you how to be notified when you receive certain types of cookies and how to restrict or disable certain cookies.

   Please note, however, that without cookies you may not be able to use all of the features of our Websites or other websites and online services. We rely on certain technical cookies to enhance functionality and user experience of our Websites.

   We use session ID cookies for access to our Careers portal. These session Cookies are used to make it easier to navigate our Career portal. A session ID Cookie expires when your browser is closed. If you reject Cookies, you may still use portions of our site, but your ability to use some areas of our site, products or services, may be limited.

   In conjunction with gathering information through cookies, our web servers may log information such as your device type, operating system type, browser type, domain, and other system settings, as well as the language your system uses and the country and time zone where your device is located. We also may record information such as the address of the web page that referred you to Websites and the IP address of the device you use to connect to our Websites. We also may log information about your interaction with the Websites, such as which pages you visit. We may place tags on our web pages called "web beacons," which are small files that link web pages to particular web servers and their cookies.

   We may use third-party web analytics services on our Websites, such as those of Google Analytics, Lucky Orange and YouTube.

   These service providers help us analyze how users use the Websites.

   The information collected for this purpose (including your IP address and other information collected by automated means) will be disclosed to or collected directly by these service providers. We have opted to use IP anonymization in transferring data to Google, which limits the amount of detail passed through Google Analytics.

   To learn more about how to opt out of these third-party web analytic service providers' activities, click the relevant link below:

   Google Analytics (https://tools.google.com/dlpage/gaoptout)

   Google Tag Manager (https://www.google.com/analytics/tag-manager/use-policy/?)

   You also have the option to prevent the collection of your use of the website for Google Analytics. Please download and install the Google plug-in provided by Google.

2. Social-Plug-ins

   The content on our Websites can be disclosed on social networks like Facebook, Twitter & Co., LinkedIn and YouTube.

   The Websites uses a sharing tool. This tool does not establish direct contact between the networks and users until the user actively clicks on one of these buttons. If the user is logged in to one of these social networks, when using the social buttons available on the Websites, a window appears in which the user can confirm the text before submitting.

   The providers of other third-party plug-ins on our Websites, such as embedded videos and social sharing tools, may use automated means to collect information regarding your use of the Websites and your interactions with the plug-ins. This information is subject to the privacy policies or notices of the third-party plug-in providers and is not subject to Westinghouse Statement.

   We encourage you to review the Statements posted on those third-party websites (and all websites) you visit.

3. AddThis

   We use functions of the content sharing service AddThis.com on our websites. AddThis provides the capability to enable users of their websites to share webpages, blogs, news, photos, videos, and other content with social networks and other destinations via a website plug-in. Nothing is shared without your interaction with the interface found on select pages on westinghousenuclear.com.

   You can permanently object to the AddThis cookie by downloading and installing the opt-out cookie available at the following link, where you can also find further information on the collection and use of data by AddThis: https://www.addthis.com/privacy/terms-of-service/

   To view the list of Westinghouse and third-party cookies used on the Websites and to make choices about those cookies, please visit ourCookie Consent Tool.

If you receive emails about products or services, promotion, or marketing materials, you can opt-out of receiving the marketing emails by notifying us at dataprivacy@westinghouse.com. These opt-out procedures will not be available for emails that are necessary to provide notice or confirmation of a transaction or status (such as a purchase, service request or change in the visitor’s user profile).

We use the Personal Data we obtain on the following legal basis, and for the purposes identified below.

1. We will process your Personal Data to fulfill our contractual obligations towards you, for the following purposes:

   • To enable customers to check their order status, to verify products availability;
   • To facilitate and expedite the suppliers qualification process;
   • To create, administer and communicate with you about your account;

2. We will process your Personal Data on the basis of our legitimate business interest for the following purposes:

   • to provide and administer our products and services;
   • to improve and optimize the functionality, safety and stability of your user experience and of our products and services;
   • to manage our Websites;
   • to process, evaluate and respond to your requests and inquiries;
   • to protect the security and/or integrity of our Websites and IT infrastructure against cybercrimes, espionage, fraud and other unlawful activity;
   • to understand how you use our services and to enable us to improve and further develop the features, performance and support available on our Websites, which may entail the provision of anonymous statistical information about our visitors;
   • to verify your identity and protect against and prevent fraud and other unlawful activity, unauthorized transactions, claims and other liabilities, and manage risk exposure and quality;
   • to monitor and ensure compliance with applicable policies and procedures (including this Online Privacy Statement and any other privacy-related policy) and legal requirements, including conducting internal investigations; and
   • for any disclosures to third parties required as part of due diligence processes in the context of corporate /business operations in which we may participate.
   • Cookies are used to analyze the Websites usage and thus for the improvement or optimization of the Websites.

   When we rely on the legitimate interests basis for processing your Personal Data, we will first carry out a balancing exercise between the reason for the processing of your Personal Data on the one hand, with your rights and freedoms on the other, to ensure our use of the legitimate interests basis is appropriate.

3. We will process your Personal Data for the following purposes, provided that you have granted your prior consent:

   • to contact you with electronic newsletters and/or promotional e-mails o similar communications relating to products and services (including training opportunities);
   • to manage job application;
   • to send job alerts, notifications and/or information about career opportunities or talent community updates;
   • to conduct and facilitate surveys, sweepstakes, contests, focus groups and market research initiatives;
   • to register and administer participants in our training courses;
   • to use the cookies that are not necessary for the functioning of the Websites and the third party analytics cookies;

   If we ask for your consent to process your Personal Data, such consent is optional and withdrawn at any time by contacting us.

Westinghouse does not sell or otherwise disclose Personal Data collected through the Websites, except as described in this Statement.

Westinghouse does not disclose Personal Data collected through the Websites for marketing purposes. Westinghouse discloses your Personal Data in the manner and for the purposes described below:

• Disclosing within Westinghouse. As Westinghouse is a global group headquartered in the US, with offices located across the globe, Personal Data collected through the Websites may be disclosed among the Westinghouse entities for the purposes described above in this Statement (e.g., to provide and administer products and services; to fulfil contractual obligations; to communicate information about Westinghouse; to register and administer the accounts created or the applications submitted; as part of regular reporting activities; to maintain IT systems; to monitor and assure compliance with applicable policies and procedures, and applicable laws). Personal Data will be always accessed and used on a ‘need-to-know’ basis.
• Disclosing to Service Providers. Personal Data may be disclosed to service providers Westinghouse has retained to perform services on its behalf (such as companies providing customer management and support, optimizing services, managing newsletters and blogs; IT-Infrastructure service providers; software services providers or companies providing data analytics). These service providers are contractually required to safeguard the information provided to them by adopting adequate security measures, they are required to follow the instructions Westinghouse provides to them and are restricted from using or disclosing such information except as necessary to perform services on our behalf or to comply with legal requirements.
• Regulators, authorities, and other third-parties. Personal Data may be transferred to regulators, courts, and other authorities (e.g. tax and law enforcement authorities), independent external advisors (e.g. auditors, external legal counsel, or other professional consultants), internal compliance and investigation teams (including external advisers appointed to conduct internal investigations) as necessary to comply with a legitimate legal request, to prevent physical harm or financial loss, to establish, exercise or defend our legal rights or in connection with an investigation of suspected or actual fraud or illegal activity.
• Asset Purchasers. We reserve the right to transfer to relevant third-parties any Personal Data we have about you in the event of a potential or actual sale or transfer of all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution or liquidation) or other business combination. In such case, we will require the relevant third-parties to provide comparable levels of protection as the Westinghouse Group provides with respect to the Personal Data we share.

Given Westinghouse’s global business and operations, some of the recipients we may disclose Personal Data to may be in countries which may have different data protection laws than the country in which the Personal Data was provided.

Transfers to Westinghouse entities will be regulated by adequate intra-group agreements, which contractually obliges each Westinghouse entity to ensure that Personal Data receives an adequate and consistent level of protection wherever it is transferred within Westinghouse.

If recipients are in other countries without adequate protections for Personal Data, Westinghouse will take all necessary measures to ensure that transfers are adequately protected as required by applicable data protection laws.

If you are in the European Union (“EU”) and/or the European Economic Area ("EEA"), we will comply with applicable legal requirements providing adequate protection for the transfer of Personal Data to recipients in countries outside of the EEA, such as the EU Standard Contractual Clauses, which the European Commission has assessed as providing an adequate level of protection for Personal Data.

For more information about the appropriate safeguards in place, feel free to contact us at dataprivacy@westinghouse.com.

To the extent permitted by applicable laws, we retain Personal Data we obtain about you though the Websites as long as (1) it is needed for the purposes for which we obtained it, in accordance with the provisions of this Statement or (2) we have another lawful basis, stated in this Statement or at the point of collection, for retaining that Personal Data beyond the period for which it is necessary to serve the original purpose.

Under some circumstances we may anonymize your Personal Data so that it can no longer be associated with you. We reserve the right to use such anonymous and de-identified data for any legitimate business purpose without further notice to you or your consent. We maintain de-identified data in deidentified form and do not attempt to reidentify it, except that we may attempt to reidentify the information just to determine whether our deidentification processes function correctly.

We have implemented appropriate physical, technical, and organizational security measures to protect your Personal Data against accidental loss and unauthorized access, use, alteration, or disclosure, these include data encryption, pseudo and anonymization, logical and physical access restriction and control, firewalls and recovery systems, integrity testing.

Westinghouse employees are regularly trained as to the handling of Personal Data and are obliged to comply with data secrecy in accordance with the legal requirements. We also limit access to Personal Data to those employees, agents, contractors, and other third-parties that have a legitimate business need for such access, and we contractually require that our third-parties and suppliers adopt the necessary security measures to assure an adequate level of protection of Personal Data.

Subject to appliable law, you may have several rights in relation to your Personal Data. These can differ by country, but can be summarized in broad terms as follows:

• Right of access: You may have the right to confirm with us whether your Personal Data is processed, and if it is, to request access to that Personal Data, including the categories of Personal Data processed, the purpose of the processing and the recipients or categories of recipients. If you want to request more than one copy, we may charge a fee.
• Right to rectification: You may have the right to rectify inaccurate or incomplete Personal Data concerning you.
• Right to erasure (right to be forgotten): You may have the right to ask us to erase Personal Data concerning you if they are no longer necessary for the purposes for which it has been initially collected.
• Right to restriction of processing: In certain circumstances, you may have the right to request that we restrict processing of your Personal Data. However, where we have a legitimate interest to process Personal Data for the Purposes set out above, we may deny your a request.
• Right to data portability: You may have the right to receive Personal Data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit that data to another entity.
• Right to object and rights relating to automated decision-making: Under certain circumstances, you may have the right to object, on grounds relating to your situation, at any time to the processing of your Personal Data by us and we can be required to no longer process your Personal Data.
• Right to revoke your consent: If you have given us your consent to certain data processing (for example, if you have subscribed our newsletter or out job alerts) you have the right at any time to revoke the consent given, entirely or in part.
• Right to lodge a complaint with the competent data protection supervisory authority in your country of residence, country of work or country of an alleged infringement. For the full list of the supervisory authorities, please visit: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We encourage you to contact us to update or correct your Personal Data if it changes or if the Personal Data, we hold about you is inaccurate.

We will contact you if we need additional information from you to honor your requests.

Should you have any queries or intention of requesting additional information on how to exercise your rights or to effectively submit such a request, feel free to contact us a dataprivacy@westinghouse.com.

If you are under the age of 18 years, please do not use or access our websites. It is not our intention to collect or use Personal Data from anyone under the age of 18 years, and we will not knowingly do so. If we are made aware that we have collected any Personal Data from minors and are asked to delete such information from our databases, we will promptly do so. In such event, please make a verifiable request if you are under 18 years of age. If you are less than 13 years of age, such verifiable request must be made by your parent or guardian.

As a service to you, Westinghouse provides links to other organizations’ websites through our own websites. These external websites contain information posted by organizations independent of Westinghouse. The presence of these links to external websites should not be construed as an endorsement by Westinghouse of the content, products, services, or viewpoints expressed in the external websites and any linked material. Westinghouse is not responsible for the content of any linked website, any link contained in a linked website, or any changes or updates to the linked websites.

It is important to note that this Statement does not apply to any of these linked websites, and these external websites may not follow the same privacy policies as this Statement. These external websites may use cookies, collect data, and use the data in ways that Westinghouse would not. Westinghouse does not review, control or monitor the privacy practices of these linked websites, and is not responsible for the privacy practices or any information or materials on these websites. Therefore, whenever you visit a linked website, we recommend that you review the website’s own privacy policies.

Notice to California Residents

This Statement is revised from time to time, as needed to reflect the latest Westinghouse organizational changes, changes in products and services, legal requirements. To the extent Westinghouse relies on your consent for the performance of any processing activities, we will make sure to request your consent if and where changes to this Statement may have an impact on the relevant processing before the changes are made.

The Data Controller responsible for the processing and processes described in this Online Privacy Statement is:

Westinghouse Electric Company LLC
Communications Department
1000 Westinghouse Drive
Cranberry Township, Pennsylvania 16066

The Data Protection Officer (“DPO”) for the Westinghouse entities in Germany is Mr. Gary Brown, who can be reached at:

Gary Brown, Chief Privacy Officer
Legal & Compliance
Westinghouse Electric Company
1000 Westinghouse Drive
Cranberry Township, PA 16066
Email: dataprivacy@westinghouse.com

In general, to exercise any of your rights or ask questions about this Online Privacy Statement, please contact us at:

• Email address: dataprivacy@westinghouse.com
• Phone number: +1 412-374-5852
• Mailing address: Ethics and Compliance, Westinghouse, 1000 Westinghouse Drive, Cranberry Township, PA 16066, USA