Westinghouse Nuclear Privacy Statement

Westinghouse collects and processes various categories of Personal Data when you interact with our Websites. This data is collected to facilitate communication, provide services, enhance user experience, and fulfill legal and contractual obligations. Below is a detailed overview of the types of Personal Data we collect and the contexts in which they are processed:

1. General Website Interactions
   When you contact us through the Websites, subscribe to newsletters or blogs, or use the “Contact Us” feature, we may collect the following Personal Data:
   • Identification and contact details: First name, last name, telephone number, email address, postal address (including data you may provide on behalf of others, such as business principals).
   • Employment information: Job title, division, employer.
   • Demographic information: Such as country of residence or other relevant attributes.
   • Account credentials: Username and password used to create an online account.
   • Additional information: Any other data you voluntarily submit through forms or communications.
2. Training Portal Access
   For customers accessing Westinghouse training platforms, we process:
   • Identification and contact details: As listed above.
   • Demographic information: Including job title or role.
   • Usage data: Such as last log-in records and training activity.
3. Rapid EIDMS Web Page Usage
   When using the Rapid EIDMS portal, we collect:
   • Identification and contact details
   • Employment information
   • Demographic data: Including citizenship status.
   • Account credentials

   This data supports secure access and compliance with export control and regulatory requirements.

4. Careers Website, Talent Community, and Job Alerts
   To create an account, join our Talent Community, or set up job alerts, we collect:
   • Identification and contact details: First name, last name, email address, country of residence.
   • Account credentials

   If you apply for job opportunities, you may be asked to provide additional job-specific data, including:

   • Resume or CV
   • Employment history
   • Citizenship or work authorization status
   • Other relevant qualifications or documentation
5. Supplier Portal Access
   To register and access the Supplier Portal, we collect:
   • Identification and contact details
   • Employment information
   • Account credentials

   This data enables secure access and supports supplier relationship management.

6. Automated Data Collection via Website Technologies
   When you visit our Websites, we automatically collect certain data using technologies such as cookies, web server logs, and web beacons. This includes:
   • Technical data: IP address, browser type, device information, referral pages, date and time of access, pages visited.
   • Usage data: Browsing actions, location data, and interactions with third-party websites.
   • Tracking technologies: Cookies and analytics tools that help us understand user behavior and improve website functionality.

   For more information, please refer to our section on Cookies, Analytics, Tracking Tools, and Social Plug-Ins.

   Westinghouse respects and protects the privacy of all website visitors. We do not collect visitor-specific personal information unless it is voluntarily provided. Communications via email or online forms may result in the retention of your name, email address, and any other information you submit.

When you interact with our Websites, Westinghouse may collect certain information automatically through technologies such as cookies, web server logs, web beacons, and JavaScript. These tools help us understand user behavior, improve functionality, and deliver a more personalized experience.

1. Cookies
   

   Cookies are small data files sent to your browser or device by websites to uniquely identify your browser, store preferences, or enhance functionality.

   Your browser settings may allow you to manage cookie preferences, including receiving notifications when cookies are set, or disabling certain types of cookies altogether. Please note that disabling cookies may limit your ability to use certain features of our Websites or other online services.

   Westinghouse uses various types of cookies, including:

   • Technical and session cookies: Essential for website functionality and navigation. For example, session ID cookies are used to facilitate access to our Careers portal and expire once your browser is closed.
   • Performance and analytics cookies: Help us understand how users interact with our Websites and improve performance.

   In addition to cookies, our web servers may automatically log information such as:

   • Device type, operating system, browser type, language settings, domain, and time zone
   • Referring web pages and IP address
   • Pages visited and interactions with site content

   We may also use web beacons, small graphic files that link web pages to specific web servers and their cookies, to track user engagement.

2. Web Analytics Services
   

   Westinghouse uses third-party analytics providers, including Google Analytics, Lucky Orange, and YouTube, to better understand how users engage with our Websites.

   These providers may collect data such as your IP address, device information, and browsing behavior. Where applicable, we have implemented IP anonymization to limit the detail passed to Google Analytics.

   To opt out of data collection by these services, you may:

   • Use browser settings or privacy tools
   • Download and install the Google Analytics Opt-Out Browser Add-on

   For more information, please refer to the privacy policies of each provider:

   • Google Analytics: Google Privacy Policy
   • Google Tag Manager: Google Tag Manager Privacy & Data Security
   • Lucky Orange: Lucky Orange Privacy Statement
   • YouTube: YouTube Privacy Policy
3. Social Plug-Ins
   

   Our Websites may include social sharing tools that allow you to share content on platforms such as Facebook, Twitter/X, LinkedIn, and YouTube.

   These tools do not establish a connection with the social networks until you actively engage with them (e.g., by clicking a share button). If you are logged into a social network, a confirmation window may appear before content is shared.

   Third-party plug-ins (e.g., embedded videos, social media widgets) may also collect data about your interactions with our Websites. This data is governed by the privacy policies of the respective third-party providers and is not subject to the Westinghouse Privacy Statement.

   We encourage you to review the privacy notices of any third-party services you interact with.

   To view and manage cookies used on our Websites, please visit our Cookie Consent Tool via the cookie icon on westinghousenuclear.com. For more information on our cookie usage, please see our Cookie Notice.

4. Tracking Across Time and Sites
   

   Westinghouse does not track your online activities across different websites or services on an individually identifiable basis. We also do not permit third parties to use our Websites to track your behavior across other sites.

5. Do Not Track (DNT) Signals
   

   Our Websites currently do not respond to browser-based “Do Not Track” (DNT) signals or similar mechanisms. DNT is a browser setting that signals your preference to opt out of tracking across websites.

   To learn more about DNT, visit www.allaboutdnt.com.

If you receive emails about products or services, promotion, or marketing materials, you can opt-out of receiving the marketing emails by notifying us at dataprivacy@westinghouse.com. These opt-out procedures will not be available for emails that are necessary to provide notice or confirmation of a transaction or status (such as a purchase, service request or change in the visitor’s user profile).

Westinghouse processes Personal Data in accordance with applicable data protection laws, based on lawful grounds and for clearly defined purposes. The legal bases for processing include the performance of a contract, our legitimate business interests, and your explicit consent.

1. Processing Based on Contractual Obligations
   We process your Personal Data when it is necessary to fulfill our contractual commitments to you, including:

   • Order management: Enabling customers to check order status and verify product availability.
   • Supplier engagement: Facilitating and expediting the supplier qualification and onboarding process.
   • Account services: Creating, administering, and communicating with you regarding your account and related activities.

2. Processing Based on Legitimate Interests
   We may process your Personal Data where it is necessary to pursue our legitimate business interests, provided such interests are not overridden by your rights and freedoms. These purposes include:

   • Service delivery: Providing and administering our products, services, and digital platforms.
   • User experience optimization: Enhancing the functionality, performance, safety, and stability of our Websites and services.
   • Website management: Operating, maintaining, and improving our Websites and digital infrastructure.
   • Customer support: Processing, evaluating, and responding to your inquiries, requests, or feedback.
   • Security and risk management: Protecting the integrity of our systems against cyber threats, fraud, espionage, and other unlawful activities.
   • Usage analytics: Understanding how users interact with our services to improve features and support, including generating anonymized statistical insights.
   • Identity verification and fraud prevention: Ensuring secure transactions and mitigating risks associated with unauthorized access or fraudulent activity.
   • Compliance monitoring: Ensuring adherence to internal policies, procedures, and legal obligations, including conducting internal audits and investigations.
   • Corporate transactions: Disclosing Personal Data as necessary during due diligence processes related to mergers, acquisitions, divestitures, or other business operations.
   • Cookie usage: Using cookies to analyze Website usage and support optimization efforts.

   When relying on legitimate interest as a legal basis, Westinghouse conducts a balancing assessment to ensure that our interests do not infringe upon your fundamental rights and freedoms.

3. Processing Based on Consent 
   Where required by law, or where no other legal basis applies, we will process your Personal Data only with your prior, informed consent. This includes:

   • Marketing communications: Sending electronic newsletters, promotional emails, and other communications related to our products, services, and training opportunities.
   • Engagement activities: Conducting surveys, contests, sweepstakes, focus groups, and market research initiatives.
   • Training registration: Registering and managing participants in our training programs.
   • Non-essential cookies: Using cookies and third-party analytics tools that are not strictly necessary for the operation of our Websites.

   You may withdraw your consent at any time by contacting us at dataprivacy@westinghouse.com. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

Westinghouse is committed to safeguarding your Personal Data and does not sell or otherwise disclose Personal Data collected through our Websites, except as outlined in this Privacy Statement.

We do not disclose Personal Data for third-party marketing purposes. Any sharing of Personal Data is done in accordance with applicable laws and only for legitimate business, operational, or legal reasons, as described below:

1. Internal Disclosures Within Westinghouse
   As a global organization headquartered in the United States with offices and operations worldwide, Westinghouse may share Personal Data internally among affiliated entities and business units. This is done strictly on a need-to-know basis and for purposes including:
   
   • Providing and administering products and services
   • Fulfilling contractual obligations
   • Communicating relevant information about Westinghouse
   • Registering and managing accounts or applications
   • Supporting internal reporting and analytics
   • Maintaining IT systems and infrastructure
   • Ensuring compliance with internal policies and applicable laws

   All internal disclosures are subject to appropriate safeguards and access controls.

2. Disclosures to Authorized Service Providers
   We may share Personal Data with trusted third-party service providers who perform services on our behalf, such as:
   
   • Customer relationship management and support
   • IT infrastructure and software services
   • Website optimization and analytics
   • Newsletter and blog management
   • Data hosting and processing

   These service providers are contractually bound to:

   • Implement appropriate security measures
   • Process Personal Data only as instructed by Westinghouse
   • Refrain from using or disclosing Personal Data for any purpose other than providing the contracted services or complying with legal obligations
3. Disclosures to Regulators, Authorities, and Legal Advisors
   Westinghouse may disclose Personal Data to government agencies, regulatory bodies, courts, and other legal authorities when required to:
   
   • Comply with legal obligations or lawful requests
   • Prevent physical harm or financial loss
   • Investigate or respond to suspected fraud, cybercrime, or other unlawful activity
   • Establish, exercise, or defend legal claims

   We may also share Personal Data with external advisors (e.g., auditors, legal counsel) and internal compliance teams, including external investigators, as necessary to support legal or regulatory investigations.

4. Disclosures in Connection with Corporate Transactions
   In the event of a potential or actual business transaction, such as a merger, acquisition, joint venture, divestiture, reorganization, or sale of assets, Westinghouse may transfer Personal Data to relevant third parties involved in the transaction. In such cases:
   
   • We will ensure that the receiving parties commit to providing data protection standards comparable to those upheld by Westinghouse.
   • Personal Data will be disclosed only to the extent necessary to support due diligence, transaction execution, or post-transaction integration.

As a global organization, Westinghouse operates in multiple jurisdictions and may transfer Personal Data across international borders to support business operations, service delivery, and internal processes. These transfers may involve countries whose data protection laws differ from those in the country where the data was originally collected.

1. Transfers Within the Westinghouse Group
   

   Personal Data may be shared among Westinghouse entities located in various countries. These intra-group transfers are governed by binding contractual arrangements, including intra-group data transfer agreements, which require all Westinghouse entities to uphold a consistent and adequate level of data protection, regardless of location. Access to Personal Data is strictly limited to authorized personnel on a need-to-know basis and only for the purposes outlined in this Privacy Statement.

2. Transfers to Third Countries and External Recipients
   

   Where Personal Data is transferred to third parties or service providers located in countries that do not offer an adequate level of data protection (as defined by applicable laws), Westinghouse implements appropriate safeguards to ensure the protection of your data. These safeguards may include:

   • Standard Contractual Clauses (SCCs) approved by the European Commission
   • Data Processing Agreements (DPAs) with robust security and privacy obligations
   • Technical and organizational measures to protect data during transit and at rest
3. Compliance with EU/EEA Data Protection Requirements
   

   If you are located in the European Union (“EU”) or European Economic Area (“EEA”), Westinghouse ensures that any transfer of Personal Data outside the EU/EEA complies with applicable legal requirements. This includes the use of EU Standard Contractual Clauses, which provide a recognized legal mechanism for ensuring adequate protection of Personal Data transferred to countries outside the EU/EEA.

4. Transparency and Contact
   

   Westinghouse is committed to transparency regarding international data transfers. If you would like more information about the safeguards we have in place to protect your Personal Data during international transfers, please contact us at: dataprivacy@westinghouse.com

Westinghouse retains Personal Data collected through its Websites only for as long as necessary to fulfill the purposes for which it was collected, or as otherwise permitted or required by applicable laws and regulations.

We retain Personal Data based on the following criteria:

• Purpose of collection: Data is retained for the duration necessary to fulfill the specific purpose outlined in this Privacy Statement or at the point of collection (e.g., account management, service delivery, legal compliance).
• Legal basis: Where a lawful basis exists for retaining Personal Data beyond its original purpose—such as compliance with legal obligations, regulatory requirements, or the establishment, exercise, or defense of legal claims—we will retain the data accordingly.

Data Minimization and Anonymization

In certain circumstances, we may anonymize or de-identify your Personal Data so that it can no longer be associated with you. Once anonymized, the data is no longer considered Personal Data under applicable laws and may be used for legitimate business purposes, including analytics, research, and service improvement, without further notice or consent.

Westinghouse maintains de-identified data in its anonymized form and does not attempt to re-identify individuals, except for the limited purpose of verifying the effectiveness of our de-identification processes.

If you have questions about our data retention practices or wish to request deletion of your Personal Data, please contact us at dataprivacy@westinghouse.com.

Westinghouse is committed to protecting the confidentiality, integrity, and availability of Personal Data. We have implemented a comprehensive set of physical, technical, and organizational security measures designed to safeguard Personal Data against accidental loss, unauthorized access, misuse, alteration, and disclosure.

These measures include, but are not limited to:

• Data encryption (in transit and at rest)
• Pseudonymization and anonymization techniques
• Logical and physical access controls
• Firewall protection and intrusion detection systems
• System integrity testing and recovery protocols

Employee and Third-Party Accountability

Westinghouse employees receive regular training on data protection principles and are required to handle Personal Data in accordance with applicable laws and internal policies. All personnel are bound by confidentiality obligations and data secrecy requirements.

Access to Personal Data is strictly limited to individuals—whether employees, contractors, agents, or service providers, who have a legitimate business need to access such data. Third-party vendors and suppliers are contractually obligated to:

• Implement appropriate security safeguards
• Process Personal Data only under Westinghouse’s instructions
• Maintain compliance with applicable data protection laws and standards

We continuously monitor and update our security practices to address emerging threats and ensure the ongoing protection of Personal Data.

If you have questions or concerns about how your Personal Data is protected, please contact us at dataprivacy@westinghouse.com.

Subject to appliable law, you may have several rights in relation to your Personal Data. These can differ by country, but can be summarized in broad terms as follows:

• Right of access: You may have the right to confirm with us whether your Personal Data is processed, and if it is, to request access to that Personal Data, including the categories of Personal Data processed, the purpose of the processing and the recipients or categories of recipients. If you want to request more than one copy, we may charge a fee.
• Right to rectification: You may have the right to rectify inaccurate or incomplete Personal Data concerning you.
• Right to erasure (right to be forgotten): You may have the right to ask us to erase Personal Data concerning you if they are no longer necessary for the purposes for which it has been initially collected.
• Right to restriction of processing: In certain circumstances, you may have the right to request that we restrict processing of your Personal Data. However, where we have a legitimate interest to process Personal Data for the Purposes set out above, we may deny your a request.
• Right to data portability: You may have the right to receive Personal Data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you may have the right to transmit that data to another entity.
• Right to object and rights relating to automated decision-making: Under certain circumstances, you may have the right to object, on grounds relating to your situation, at any time to the processing of your Personal Data by us and we can be required to no longer process your Personal Data.
• Right to revoke your consent: If you have given us your consent to certain data processing (for example, if you have subscribed our newsletter or out job alerts) you have the right at any time to revoke the consent given, entirely or in part.
• Right to lodge a complaint with the competent data protection supervisory authority in your country of residence, country of work or country of an alleged infringement. For the full list of the supervisory authorities, please visit: https://edpb.europa.eu/about-edpb/about-edpb/members_en.

We encourage you to contact us to update or correct your Personal Data if it changes or if the Personal Data, we hold about you is inaccurate.

We will contact you if we need additional information from you to honor your requests.

Should you have any queries or intention of requesting additional information on how to exercise your rights or to effectively submit such a request, please reach out to via one of the following channels:

• Westinghouse Data Subject Rights Portal
• Phone: +1.844.238.4380
• Email: dataprivacy@westinghouse.com

If you are under the age of 18 years, please do not use or access our websites. It is not our intention to collect or use Personal Data from anyone under the age of 18 years, and we will not knowingly do so. If we are made aware that we have collected any Personal Data from minors and are asked to delete such information from our databases, we will promptly do so. In such event, please make a verifiable request if you are under 18 years of age. If you are less than 13 years of age, such verifiable request must be made by your parent or guardian.

As a convenience to our users, Westinghouse may provide links to third-party websites through our own Websites. These external sites are operated by organizations that are independent of Westinghouse, and their inclusion does not constitute an endorsement of their content, services, products, or viewpoints.

Westinghouse is not responsible for the content, accuracy, or availability of any linked websites, nor for any links contained within those sites or any changes or updates made to them.

Important Notice About External Sites

Please be aware that this Privacy Statement does not apply to any third-party websites that may be linked from our Websites. These external sites may have their own privacy policies and practices, which may differ significantly from those of Westinghouse. For example:

• They may use cookies or other tracking technologies.
• They may collect and process Personal Data in ways that Westinghouse does not.
• They may not offer the same level of data protection or user rights.

Westinghouse does not monitor, control, or review the privacy practices of these third-party websites and disclaims any responsibility for how they handle your Personal Data.

Your Responsibility

Whenever you leave the Westinghouse Websites and access a third-party site, we strongly encourage you to review the privacy policy and terms of use of that site before providing any Personal Data or engaging with its content.

If you have any questions about how your data is handled on external websites, please contact the respective site owner or administrator directly.

Notice to California Residents

This Statement is revised from time to time, as needed to reflect the latest Westinghouse organizational changes, changes in products and services, legal requirements. To the extent Westinghouse relies on your consent for the performance of any processing activities, we will make sure to request your consent if and where changes to this Statement may have an impact on the relevant processing before the changes are made.

The Data Controller responsible for the processing and processes described in this Online Privacy Statement is:

Westinghouse Electric Company LLC
Communications Department
1000 Westinghouse Drive
Cranberry Township, Pennsylvania 16066

The Data Protection Officer (“DPO”) for the Westinghouse entities in Germany, Brazil and Canada is Mr. Gary Brown, who can be reached at:

Gary Brown, Chief Privacy Officer
Legal & Compliance
Westinghouse Electric Company
1000 Westinghouse Drive
Cranberry Township, PA 16066
Phone: +44 (0)7783 658441
Email: dataprivacy@westinghouse.com

In general, to exercise any of your rights or ask questions about this Online Privacy Statement, please contact us at:

• Email address: dataprivacy@westinghouse.com
• Phone number: +1 412-374-5852
• Mailing address: Ethics and Compliance, Westinghouse, 1000 Westinghouse Drive, Cranberry Township, PA 16066, USA