Westinghouse Nuclear Privacy Statement

Westinghouse collects and processes various categories of Personal Data when you interact with our Websites. This data is collected to facilitate communication, provide services, enhance user experience, and fulfill legal and contractual obligations. Below is a detailed overview of the types of Personal Data we collect and the contexts in which they are processed:

1. General Website Interactions
   When you contact us through the Websites, subscribe to newsletters or blogs, or use the “Contact Us” feature, we may collect the following Personal Data:
   • Identification and contact details: First name, last name, telephone number, email address, postal address (including data you may provide on behalf of others, such as business principals).
   • Employment information: Job title, division, employer.
   • Demographic information: Such as country of residence or other relevant attributes.
   • Account credentials: Username and password used to create an online account.
   • Additional information: Any other data you voluntarily submit through forms or communications.
2. Training Portal Access
   For customers accessing Westinghouse training platforms, we process:
   • Identification and contact details: As listed above.
   • Demographic information: Including job title or role.
   • Usage data: Such as last log-in records and training activity.
3. Rapid EIDMS Web Page Usage
   When using the Rapid EIDMS portal, we collect:
   • Identification and contact details
   • Employment information
   • Demographic data: Including citizenship status.
   • Account credentials

   This data supports secure access and compliance with export control and regulatory requirements.

4. Careers Website, Talent Community, and Job Alerts
   To create an account, join our Talent Community, or set up job alerts, we collect:
   • Identification and contact details: First name, last name, email address, country of residence.
   • Account credentials

   If you apply for job opportunities, you may be asked to provide additional job-specific data, including:

   • Resume or CV
   • Employment history
   • Citizenship or work authorization status
   • Other relevant qualifications or documentation
5. Supplier Portal Access
   To register and access the Supplier Portal, we collect:
   • Identification and contact details
   • Employment information
   • Account credentials

   This data enables secure access and supports supplier relationship management.

6. Automated Data Collection via Website Technologies
   When you visit our Websites, we automatically collect certain data using technologies such as cookies, web server logs, and web beacons. This includes:
   • Technical data: IP address, browser type, device information, referral pages, date and time of access, pages visited.
   • Usage data: Browsing actions, location data, and interactions with third-party websites.
   • Tracking technologies: Cookies and analytics tools that help us understand user behavior and improve website functionality.

   For more information, please refer to our section on Cookies, Analytics, Tracking Tools, and Social Plug-Ins.

   Westinghouse respects and protects the privacy of all website visitors. We do not collect visitor-specific Personal Data unless it is voluntarily provided. Communications via email or online forms may result in the retention of your name, email address, and any other information you submit.

When you interact with our Websites, Westinghouse may collect certain information automatically through technologies such as cookies, web server logs, web beacons, and JavaScript. These tools help us understand user behavior, improve functionality, and deliver a more personalized experience. Please see our Website’s Cookie Notice for more information about how we use Cookies and Similar Technologies, and ways to control these technologies.

In some jurisdictions, our use of third‑party cookies for marketing and online advertising may be considered a “sale” or “sharing” of Personal Data. You can opt out of the sale or sharing of your data by selecting the “Do Not Sell or Share My Personal Information” link on our websites.

You also have control over how these technologies operate on your device. Where required by law, our Websites honor valid opt-out preference signals, such as Global Privacy Control (GPC), that communicate your choice to opt out of the sale or sharing of Personal Data. You can also manage your preferences through the Site’s Cookie Settings. For additional details on managing cookies and other tracking technologies, please refer to our Website’s Cookie Notice.

We do not knowingly sell or share the Personal Data of individuals under 16 years of age.

If you receive emails about products or services, promotions, or marketing materials, you can opt out of receiving marketing emails by following the instructions in those emails or by notifying us at dataprivacy@westinghouse.com. These opt-out procedures will not apply to non-promotional emails that are necessary to provide notice or confirmation of a transaction or status, such as a purchase, service request, change in the visitor’s user profile, account update, security notice, or other important service communication.

We generally do not seek to collect sensitive Personal Data through our public Websites unless it is necessary for a specific purpose, such as recruiting, export control review, account security, legal compliance, or another purpose disclosed at the point of collection. Sensitive Personal Data may include information such as government identification numbers, citizenship or immigration status, or other information considered sensitive under applicable law. Where required, we will provide additional notice and obtain consent before collecting or using sensitive Personal Data.

Westinghouse processes Personal Data in accordance with applicable data protection laws, based on lawful grounds and for clearly defined purposes. The legal bases for processing include the performance of a contract, our legitimate business interests, and your explicit consent.

1. Processing Based on Contractual Obligations
   We process your Personal Data when it is necessary to fulfill our contractual commitments to you, including:

   • Order management: Enabling customers to check order status and verify product availability.
   • Supplier engagement: Facilitating and expediting the supplier qualification and onboarding process.
   • Account services: Creating, administering, and communicating with you regarding your account and related activities.

2. Processing Based on Legitimate Interests
   We may process your Personal Data where it is necessary to pursue our legitimate business interests, provided such interests are not overridden by your rights and freedoms. These purposes include:

   • Service delivery: Providing and administering our products, services, and digital platforms.
   • User experience optimization: Enhancing the functionality, performance, safety, and stability of our Websites and services.
   • Website management: Operating, maintaining, and improving our Websites and digital infrastructure.
   • Customer support: Processing, evaluating, and responding to your inquiries, requests, or feedback.
   • Security and risk management: Protecting the integrity of our systems against cyber threats, fraud, espionage, and other unlawful activities.
   • Usage analytics: Understanding how users interact with our services to improve features and support, including generating anonymized statistical insights.
   • Identity verification and fraud prevention: Ensuring secure transactions and mitigating risks associated with unauthorized access or fraudulent activity.
   • Compliance monitoring: Ensuring adherence to internal policies, procedures, and legal obligations, including conducting internal audits and investigations.
   • Corporate transactions: Disclosing Personal Data as necessary during due diligence processes related to mergers, acquisitions, divestitures, or other business operations.
   • Cookie usage: Using cookies to analyze Website usage and support optimization efforts.

   When relying on legitimate interest as a legal basis, Westinghouse conducts a balancing assessment to ensure that our interests do not infringe upon your fundamental rights and freedoms.

3. Processing Based on Consent 
   Where required by law, or where no other legal basis applies, we will process your Personal Data only with your prior, informed consent. This includes:

   • Marketing communications: Sending electronic newsletters, promotional emails, and other communications related to our products, services, and training opportunities.
   • Engagement activities: Conducting surveys, contests, sweepstakes, focus groups, and market research initiatives.
   • Training registration: Registering and managing participants in our training programs.
   • Non-essential cookies: Using cookies and third-party analytics tools that are not strictly necessary for the operation of our Websites.

   You may withdraw your consent at any time by contacting us at dataprivacy@westinghouse.com. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

We do not use Personal Data collected through our Websites to make decisions based solely on automated processing that produce legal or similarly significant effects, unless we provide a separate notice as required by applicable law. If automated tools are used to support fraud prevention, website analytics, or similar business purposes, we use them subject to appropriate safeguards and human review where required.

Westinghouse is committed to safeguarding your Personal Data and does not sell, share, or otherwise disclose Personal Data collected through our Websites, except as outlined in this Privacy Statement.

We do not disclose Personal Data for third-party marketing purposes. Any sharing of Personal Data is done in accordance with applicable laws and only for legitimate business, operational, or legal reasons, as described below:

1. Internal Disclosures Within Westinghouse
   As a global organization headquartered in the United States with offices and operations worldwide, Westinghouse may share Personal Data internally among affiliated entities and business units. This is done strictly on a need-to-know basis and for purposes including:
   
   • Providing and administering products and services
   • Fulfilling contractual obligations
   • Communicating relevant information about Westinghouse
   • Registering and managing accounts or applications
   • Supporting internal reporting and analytics
   • Maintaining IT systems and infrastructure
   • Ensuring compliance with internal policies and applicable laws

   All internal disclosures are subject to appropriate safeguards and access controls.

2. Disclosures to Authorized Service Providers
   We may share Personal Data with trusted third-party service providers who perform services on our behalf, such as:
   
   • Customer relationship management and support
   • IT infrastructure and software services
   • Website optimization and analytics
   • Newsletter and blog management
   • Data hosting and processing

   These service providers are contractually bound to:

   • Implement appropriate security measures
   • Process Personal Data only as instructed by Westinghouse
   • Refrain from using or disclosing Personal Data for any purpose other than providing the contracted services or complying with legal obligations
3. Disclosures to Regulators, Authorities, and Legal Advisors
   Westinghouse may disclose Personal Data to government agencies, regulatory bodies, courts, and other legal authorities when required to:
   
   • Comply with legal obligations or lawful requests
   • Prevent physical harm or financial loss
   • Investigate or respond to suspected fraud, cybercrime, or other unlawful activity
   • Establish, exercise, or defend legal claims

   We may also share Personal Data with external advisors (e.g., auditors, legal counsel) and internal compliance teams, including external investigators, as necessary to support legal or regulatory investigations.

4. Disclosures in Connection with Corporate Transactions
   In the event of a potential or actual business transaction, such as a merger, acquisition, joint venture, divestiture, reorganization, or sale of assets, Westinghouse may transfer Personal Data to relevant third parties involved in the transaction. In such cases:
   
   • We will ensure that the receiving parties commit to providing data protection standards comparable to those upheld by Westinghouse.
   • Personal Data will be disclosed only to the extent necessary to support due diligence, transaction execution, or post-transaction integration.

As a global organization, Westinghouse operates in multiple jurisdictions and may transfer Personal Data across international borders to support business operations, service delivery, and internal processes. These transfers may involve countries whose data protection laws differ from those in the country where the data was originally collected.

1. Transfers Within the Westinghouse Group
   

   Personal Data may be shared among Westinghouse entities located in various countries. These intra-group transfers are governed by binding contractual arrangements, including intra-group data transfer agreements, which require all Westinghouse entities to uphold a consistent and adequate level of data protection, regardless of location. Access to Personal Data is strictly limited to authorized personnel on a need-to-know basis and only for the purposes outlined in this Privacy Statement.

2. Transfers to Third Countries and External Recipients
   

   Where Personal Data is transferred to third parties or service providers located in countries that do not offer an adequate level of data protection (as defined by applicable laws), Westinghouse implements appropriate safeguards to ensure the protection of your data. These safeguards may include:

   • Standard Contractual Clauses (SCCs) approved by the European Commission
   • Data Processing Agreements (DPAs) with robust security and privacy obligations
   • Technical and organizational measures to protect data during transit and at rest
3. Compliance with EU/EEA Data Protection Requirements
   

   If you are located in the European Union (“EU”) or European Economic Area (“EEA”), Westinghouse ensures that any transfer of Personal Data outside the EU/EEA complies with applicable legal requirements. This includes the use of EU Standard Contractual Clauses, which provide a recognized legal mechanism for ensuring adequate protection of Personal Data transferred to countries outside the EU/EEA.

   Where required, Westinghouse may also rely on UK-approved transfer mechanisms, transfer impact assessments, supplementary safeguards, or other lawful transfer mechanisms recognized under applicable data protection laws.

4. Transparency and Contact
   

   Westinghouse is committed to transparency regarding international data transfers. If you would like more information about the safeguards we have in place to protect your Personal Data during international transfers, please contact us at: dataprivacy@westinghouse.com

Westinghouse retains Personal Data collected through its Websites only for as long as necessary to fulfill the purposes for which it was collected, or as otherwise permitted or required by applicable laws and regulations.

We retain Personal Data based on the following criteria:

• Purpose of collection: Data is retained for the duration necessary to fulfill the specific purpose outlined in this Privacy Statement or at the point of collection (e.g., account management, service delivery, legal compliance).
• Legal basis: Where a lawful basis exists for retaining Personal Data beyond its original purpose—such as compliance with legal obligations, regulatory requirements, or the establishment, exercise, or defense of legal claims—we will retain the data accordingly.

Because retention periods vary based on the type of Personal Data, the purpose for which it was collected, applicable legal or regulatory obligations, contractual requirements, and whether the information is needed to establish, exercise, or defend legal claims, we use documented retention criteria to determine how long information is kept. When Personal Data is no longer needed, we delete, anonymize, or de-identify it in accordance with our retention practices and applicable law.

If you have questions about our data retention practices or wish to request deletion of your Personal Data, please contact us at dataprivacy@westinghouse.com.

In certain circumstances, we may anonymize or de-identify your Personal Data so that it can no longer be associated with you. Once anonymized, the data is no longer considered Personal Data under applicable laws and may be used for legitimate business purposes, including analytics, research, and service improvement, without further notice or consent.

Westinghouse maintains de-identified data in its anonymized form and does not attempt to re-identify individuals, except for the limited purpose of verifying the effectiveness of our de-identification processes.

Westinghouse is committed to protecting the confidentiality, integrity, and availability of Personal Data. We have implemented a comprehensive set of physical, technical, and organizational security measures designed to safeguard Personal Data against accidental loss, unauthorized access, misuse, alteration, and disclosure.

These measures include, but are not limited to:

• Data encryption (in transit and at rest)
• Pseudonymization and anonymization techniques
• Logical and physical access controls
• Firewall protection and intrusion detection systems
• System integrity testing and recovery protocols

Westinghouse employees receive regular training on data protection principles and are required to handle Personal Data in accordance with applicable laws and internal policies. All personnel are bound by confidentiality obligations and data secrecy requirements.

Access to Personal Data is strictly limited to individuals—whether employees, contractors, agents, or service providers, who have a legitimate business need to access such data. Third-party vendors and suppliers are contractually obligated to:

• Implement appropriate security safeguards
• Process Personal Data only under Westinghouse’s instructions
• Maintain compliance with applicable data protection laws and standards

We continuously monitor and update our security practices to address emerging threats and ensure the ongoing protection of Personal Data.

If you have questions or concerns about how your Personal Data is protected, please contact us at dataprivacy@westinghouse.com.

Subject to applicable law, you may have several rights in relation to your Personal Data. These can differ by country, but can be summarized in broad terms as follows:

• Right of access: You may have the right to confirm with us whether your Personal Data is processed, and if it is, to request access to that Personal Data, including the categories of Personal Data processed, the purpose of the processing and the recipients or categories of recipients. If you want to request more than one copy, we may charge a fee.
• Right to rectification: You may have the right to rectify inaccurate or incomplete Personal Data concerning you.
• Right to erasure (right to be forgotten): You may have the right to ask us to erase Personal Data concerning you if they are no longer necessary for the purposes for which it has been initially collected.
• Right to restriction of processing: In certain circumstances, you may have the right to request that we restrict processing of your Personal Data. However, where we have a lawful basis to continue processing Personal Data for the purposes set out above, we may deny your request as permitted by applicable law.
• Right to data portability: You may have the right to receive Personal Data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit that data to another entity.
• Right to object and rights relating to automated decision-making: Under certain circumstances, you may have the right to object, on grounds relating to your situation, at any time to the processing of your Personal Data by us and we can be required to no longer process your Personal Data.
• Right to revoke your consent: If you have given us your consent to certain data processing, for example if you have subscribed to our newsletter or our job alerts, you have the right to revoke the consent given, entirely or in part, at any time.
• Right to lodge a complaint with the competent data protection supervisory authority in your country of residence, country of work or country of an alleged infringement. For the full list of the supervisory authorities, please visit: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We encourage you to contact us to update or correct your Personal Data if it changes or if the Personal Data, we hold about you is inaccurate.

We will contact you if we need additional information from you to honor your requests.

If you have questions or would like additional information about how to exercise your rights or submit a request, please reach out through one of the following channels:

• Westinghouse Data Subject Rights Portal
• Phone: +1.844.238.4380
• Email: dataprivacy@westinghouse.com

If you are under the age of 18 years, please do not use or access our websites. It is not our intention to collect or use Personal Data from anyone under the age of 18 years, and we will not knowingly do so. If we are made aware that we have collected any Personal Data from minors and are asked to delete such information from our databases, we will promptly do so. In such event, please make a verifiable request if you are under 18 years of age. If you are less than 13 years of age, such verifiable request must be made by your parent or guardian.

As a convenience to our users, Westinghouse may provide links to third-party websites through our own Websites. These external sites are operated by organizations that are independent of Westinghouse, and their inclusion does not constitute an endorsement of their content, services, products, or viewpoints. Westinghouse is not responsible for the content, accuracy, availability, or privacy practices of any third-party websites, including any changes or updates made to them.

This Privacy Statement does not apply to third-party websites. Such sites may have their own privacy policies and practices, which may differ significantly from those of Westinghouse, including the use of cookies or other tracking technologies and the collection or processing of Personal Data in ways beyond our control. Westinghouse does not monitor or control these practices and disclaims any responsibility for how third parties handle your Personal Data.

When you leave the Westinghouse Websites, we encourage you to review the privacy policy and terms of use of any third‑party site before providing Personal Data or engaging with its content. Questions regarding data practices on external websites should be directed to the respective site owner or administrator.

This section provides California residents with additional details about how we collect, use, and disclose their personal information. It supplements the information outlined in our Privacy Statement above. Certain terms used in this section have the meanings defined under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations.

The chart below provides additional California-specific disclosures for the categories of Personal Data we may collect through our Websites.

• To understand the information that we have collected in the past year, please see Personal Data We Process.
• To understand how we use your information, please see How We Use Personal Data.
• To understand with whom we share your information, please see How We Disclose Personal Data and Sale or Sharing of Personal Data and Targeted Advertising.
• To understand how long we keep your information, please see Retention of Personal Data.

We may “share” Personal Data for cross-context behavioral advertising through third-party cookies or similar technologies where applicable law defines that activity as sharing. We do not knowingly sell or share Personal Data of individuals under 16. We do not use or disclose sensitive Personal Data for purposes that would require a right to limit unless we provide the required notice and choice mechanism.

If you are a California resident, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), regarding your personal information.

Subject to certain exceptions, you have the right to:

• Know what personal information we collect, use, disclose, and retain
• Request access to the personal information we hold about you
• Request deletion of your personal information
• Request correction of inaccurate personal information
• Limit the use and disclosure of sensitive personal information (where applicable)
• Opt-out of the sale or sharing of personal information to third-parties (see Sale or Sharing of Personal Data and Targeted Advertising section)
• Opt-out of profiling and certain processing that has legal or similarly significant effects
• Not be discriminated against for exercising your privacy rights

To exercise any of these rights or if you have any questions, please contact us at one of the following channels:

• Westinghouse Data Subject Rights Portal
• Phone: +1.844.238.4380
• Email: dataprivacy@westinghouse.com

Westinghouse will respond to such requests in accordance with applicable law.

This Statement is revised from time to time, as needed to reflect the latest Westinghouse organizational changes, changes in products and services, legal requirements. To the extent Westinghouse relies on your consent for the performance of any processing activities, we will make sure to request your consent if and where changes to this Statement may have an impact on the relevant processing before the changes are made.

The Data Controller responsible for the processing and processes described in this Online Privacy Statement is:

Westinghouse Electric Company LLC
Communications Department
1000 Westinghouse Drive
Cranberry Township, Pennsylvania 16066

The Data Protection Officer (“DPO”) for the Westinghouse entities in Germany, Brazil and Canada can be reached at:

Chief Privacy Officer and Director of AI Governance
Legal & Compliance
Westinghouse Electric Company
1000 Westinghouse Drive
Cranberry Township, PA 16066
Phone: +44 (0)7783 658441
Email: dataprivacy@westinghouse.com

In general, if you have any questions about this Privacy Statement, please contact us at:

• Email address: dataprivacy@westinghouse.com
• Mailing address: Ethics and Compliance, Westinghouse, 1000 Westinghouse Drive, Cranberry Township, PA 16066, USA