Privacy Information Notice for Contractors and Service Providers

Effective date: November 2024

1- This Privacy Information Notice is addressed to:
- our contractors and service providers who are individuals; and
-  the representatives, employees, contact persons, or other persons of our contractors and service providers who are legal entities; and
- covers external workers (such as contract workers, advisors, advisory partners and directors).

2- For the purpose of this Privacy Information Notice, “ST”, “our”, “we”, or “us” refers to the STMicroelectronics legal entity processing your personal data as indicated in the underlying agreement with you or with the contractor or service provider for whom you work.

3- This Privacy Information Notice describes the context in which we process your personal data and it explains your rights and obligations. 

We obtain your personal data either directly from you or through the contractor or service provider for whom you work. However, some information processed by us may be inferred from the information you provide or arise in the context of managing your engagement.

The types of personal data that we process include:
- Basic personal and contact information (e.g., first name, last name, email address, address, phone number, nationality);
- Information about your employer (e.g., name of your employer and your title, position);
- Work related information (e.g., identification number, start date, last day, status of any required training));
- Where you have access to our computer systems, we may collect the following types of personal data, including electronic identification data where required for the purpose of delivering products or services to our company (e.g., login, passwords, badge number and photograph, IP address, online identifiers/cookies, logs, access and connection times); and
- certain compliance-related information (e.g., records of any required training).

To maintain the accuracy of your personal data we may ask you to confirm their accuracy and eventually update them.

We process your personal data to:
- grant you access to our facilities and/or certain technologies to allow you to perform services;
- monitor and manage access to our facilities to protect the safety and security of our personnel, guests, property and assets and to ensure compliance with applicable policies and laws;
- manage our technology resources (e.g., cyber-risk management, infrastructure management and business continuity);
- take pre-contractual steps;
- perform our obligations in our contract;
- comply with our legal or regulatory obligations. For example, this might include conducting due diligence; adhering and monitoring adherence, as applicable, to international marketing laws, anti-money laundering and anti-bribery and corruption laws, financial services and financial supervisory regulations and rules, tax law; monitoring sanctions lists and other country specific sources; or exercising our audit rights;
- investigate allegations of or prevent fraud or criminal activity, compliance breaches.

In the course of our activities and for the purposes listed in this Privacy Information Notice, your personal data may be processed on a need to know basis to achieve such purposes: ST’s personnel as well as technology systems providers, including cloud and database providers, and related consultants.

We implement technical and organizational measures to protect the security and confidentiality of your personal data, and our measures are aligned with international standards. 

We will retain your personal data for as long as necessary to fulfil the purpose for which it was collected, to comply with legal or regulatory requirements, or for the establishment or defense of legal claims. 

- You have the right to request information about how your personal data are processed, and to request a copy of that personal data;
- you have the right to request that any inaccuracies in your personal data are rectified;
- you have the right to request that any incomplete personal data are completed;
- you have the right to request that your personal data are erased if there is no longer a justification for them to be processed;
- you have the right in certain circumstances (for example, where accuracy is contested) to request that the processing of your personal data is restricted;
- you have the right to object to the processing of your personal data where processing is based on legitimate interests.

If you would like to exercise one of the above rights, please send your request to our generic mailbox privacy@st.com

Where possible and to facilitate the processing of your request, we would be grateful if you could please provide the following information:
- An explanation of what you are requesting;
- Your relationship with us (i.e., as board member); and
- Your full name and (e-mail) address.

We may update this privacy information notice from time to time in response to any legal, technical, or business change/developments, and when we make material updates, we will take appropriate steps to bring these to your attention. You can see when the privacy information notice was last updated by checking the “last updated” date displayed on the first page. 

If you have any questions or concerns regarding this privacy information notice, please address them to our Head of Global Privacy, contact us at privacy@st.com “Privacy Information Notice for Contractors and Services Providers” in the subject line.