App Usage Policy and Disclosures

Effective Date: June 26, 2020

Huntington Ingalls Industries and its Divisions – Newport News Shipbuilding, Ingalls Shipbuilding, and Technical Solutions (collectively, “HII”) – appreciate the trust and respect the privacy of everyone who uses our Websites, Social Media Accounts, and Mobile Apps (IngallsConnect App) (collectively, our “Online Activities.”).

This Privacy Statement explains how HII uses, stores, discloses, and protects the Personal Information that we collect when you interact with us through our Online Activities, as well as your rights and choices regarding the information that we collect from you.

HII is a U.S.-based company with international activities and domestic and international business clients. As a result, information that we collect from our Online Activities, including Personal Information, may be transferred to our U.S. offices to permit us to comply with our legal and contractual obligations, to provide information and services to prospective and current clients (“Services”), and to perform related business activities. In addition, we may work with third- party service providers in the U.S. and in other countries to support our business activities. Thus, Personal Information may be transferred to, stored on servers in, and accessed from the U.S. and from countries other than the country in which it was initially collected. Those countries may have different legal protections from the country in which the information was collected. In all such instances, we use, transfer, and disclose Personal Information solely for the purposes described in this Privacy Statement.

HII complies with applicable U.S. federal and state laws regarding privacy and data security, and with the obligations imposed on us when we act as a government contractor. HII also complies with applicable international law regarding the protection of Personal Information (“International Privacy Law”). For additional information, including with regard to Personal Information collected from EU-based individuals, see “Our Compliance with International Privacy Laws,” below.

Information Collection Not Covered by this Privacy Statement

This Privacy Statement does not apply to Personal Information that HII collects and uses for employment-related purposes, whether through our Websites or Mobile Apps or through a website operated on our behalf by a third-party service provider. HII has separate, internal privacy practices and notices with regard to personal information that is collected and used in the employment context.

What HII Means by “Personal Information”

For purposes of this Privacy Statement, “Personal Information” means any information from or about a person that either identifies that person directly or that makes that person identifiable when it is combined with other information from or about that person from any source. This definition includes personal information that would be either “personal data” or “special categories of personal data” as those terms are defined in the EU General Data Protection Regulation 2016/679 (“GDPR”) and “personal information” as it is defined in the California Consumer Privacy Act, Cal. Civ. Code § 1798.100 et seq. (“CCPA”).

Personal Information becomes “Non-Personal Information” when it has been aggregated, deidentified, or otherwise anonymized sufficiently that the individual is no longer identified or identifiable and cannot be reidentified using reasonable efforts, resources, and technology. If we combine non-Personal Information with Personal Information, we treat the result as Personal Information in accordance with this Privacy Statement.

Information that We Collect from and about You

Categories of Personal Information that We Collect During Our Online Activities

• Names;

• Physical addresses;

• Email addresses;

• Telephone numbers;

• Business Contact Personal Information;

• User IDs and passwords;

• Personal Information that you choose to share with us voluntarily when you ask a

  question, request follow-up, post or respond to an online comment, register for an

  event, or otherwise interact with us;

• Identifiers of devices used to access the Websites and Mobile Apps;

• IP addresses from which devices access the Websites and Mobile Apps; and

• Locations of devices used to access the Websites and Mobile Apps

• Photos and videos

• Information that You Provide to Us Voluntarily

  If you choose to communicate with us through our Online Activities, by completing an online form, by sending us an email, by requesting additional information, by registering for one of our events, or by otherwise contacting us, we will collect whatever information, including Personal Information, that you choose to provide to us. We will combine that information with other information that we collect from and about you as described in this Privacy Statement.

Information that We Collect Automatically When You Interact with Us through Our Online Activities

Logs

Our Websites and Mobile Apps automatically create logs about user sessions that provide us with information about the features that you use, the actions that you take, and the information that you access while using our Websites. When your session ends, HII only retains that information in a statistical and aggregated format (non-Personal Information) that we use for research purposes, assessing the effectiveness of our Websites and Mobile Apps, improving user experience, and providing cybersecurity protection to HII.

Cookies

Cookies are small pieces of information transferred to your computer's hard drive through your web browser to enable our systems to recognize your preferences and settings. Cookies collect information from and about the websites you visit, including ours, such as the type of search engine you use, the sections of the websites you visit, and other website usage information.

Our Websites currently cannot process automated “Do Not Track” signals from your browser. Most browsers automatically accept cookies, but you may manually modify or disable the cookie acceptance function on your browser. For more information on modifying or disabling cookies, go to the "help" menu on your browser or to www.networkadvertising.org/choices/ or www.youronlinechoices.com. Our Websites may still be viewed if you choose to disable cookies, but your use and enjoyment of our Websites may be adversely affected.

We use session cookies for Website use and function, and those cookies expire at the end of the session. We only use persistent cookies, which collect information that can be used on future visits to our Websites, to support Website activities for our vendors and third party business partners and our prospective, current, and former employees, including for our Careers applicant tracking system, HII Discounts web application, and third-party benefits application. HII may retain information from the session and persistent cookies in a statistical and aggregated format (Non-Personal Information) for research purposes, assessing the effectiveness of our Websites, and improving user experience.

Analytics

Our Websites use Google Analytics, a web analytics service provided by Google, Inc. ("Google"). Google uses cookies to help us analyze how visitors use our Websites. The information generated by the cookie about your use of our Websites is generally transmitted to and stored on a Google server in the U.S. Google will use this information for evaluating your use of our Websites, compiling reports on Website activity, and providing us with other analytic services relating to our Websites and Internet use. Google will not associate your IP address with any other data held by Google.

You may manage and opt out of Google’s use of cookies by visiting Google’s Ads settings and selecting the appropriate settings in your browser. However, please note that if you do so, you may not be able to use the full functionality of our Websites. Alternatively, you can prevent Google’s collection and use of data by downloading and installing the browser plugin available at: http://tools.google.com/dlpage/gaoptout?hl=en and/or opt out by visitingwww.networkadvertising.org/choices/ or www.youronlinechoices.com. For further information on Google’s terms of use and data protection/privacy, please see https://www.google.com/policies/privacy/,http://www.google.com/analytics/terms/us.html, and http://www.google.com/analytics/learn/index.html.

We collect and retain information from Google Analytics in a statistical and aggregated format (Non-Personal Information) for research purposes, assessing the effectiveness of our Websites, and improving user experience.

Information that We Collect from Other Sources

HII does not collect Personal Information from or about you from third parties, or combine information from other sources with the information described in this Privacy Statement, except with regard to your interaction with us through our Online Activities. HII may obtain information, including Personal Information, from our business partners and service providers who provide services on our behalf as described in this Privacy Statement, including those involved in our Online Activities. Finally, while interacting with us through our Online Activities you may provide information about another individual. We assume that you have the permission and authority to provide that information and to consent on behalf of that individual to our collection and use of Personal Information as described in this Privacy Statement.

Why We Collect Information from and about You

HII does not collect, use, share, or disclose your Personal Information for anything other than the following lawful purposes:

To establish and maintain contractual relationships with our clients

• To establish relationships with new clients;

• To fulfill our obligations to current clients; and

• To contact clients regarding account-related issues and business communications,

  including technical notices, updates, security alerts, and administrative messages.

  To comply with our legal obligations:

• To demonstrate our compliance with applicable privacy and data security law;

• To comply with incident monitoring, reporting, assessment, and notification

  requirements; and

• To comply with other applicable criminal and civil law and regulatory

  requirements under federal, state, and international law.

  To provide Services that you request and consent to receive:

• To provide customer service and support;

• To communicate with you, including responding to your comments, questions,

  and requests; and

• To enable individuals, including our employees, to access and use our Services through our Online Activities.

To fulfill our other legitimate interests to the extent that they are not overridden by individual interests, fundamental rights, or freedoms:

• To administer, operate, maintain, and secure our Online Activities;

• To monitor and analyze trends, usage, and activities in connection with our

  Online Activities and to conduct our business activities;

• To investigate and prevent fraudulent transactions, unauthorized access to our

  Online Activities, and other illegal activities;

• To maintain and improve our cybersecurity program and our awareness of

  evolving threats;

• To investigate and respond to cybersecurity and privacy incidents;

• To verify compliance with our internal policies and procedures;

• For accounting, recordkeeping, backup, and administrative purposes;

• To customize and improve the content of our communications and Online

  Activities;

• To provide information and education;

• To receive information and feedback, including from employees, about our

  Services and business activities;

• To provide, operate, maintain, improve, personalize, and promote our business

  activities; and

• To market our Services (first-party marketing only; we do not provide Personal

  Information to third parties for use in marketing any non-HII goods or services).

  To the greatest extent possible, we will use aggregated, deidentified, or otherwise anonymized data (i.e., Non-Personal Information) to accomplish these purposes, but if we do not, or if we combine Non-Personal Information with Personal Information, we will continue to treat it as Personal Information in accordance with this Privacy Statement.

  HII Information Sharing and Disclosure

  Except to the extent necessary to fulfill our business obligations, to accomplish one of the lawful purposes described in this Privacy Statement, or in response to your express instructions, we do not sell, transfer, or otherwise disclose Personal Information that we collect from or about you.

  With your express consent: We will share your Personal Information with companies, organizations, or individuals outside of HII when we have obtained your prior express consent or when you have asked us, in writing, to do so.

When You Choose to Directly Share Your Information about Our Online Activities or Your Usage: When you use our Online Activities, certain features may allow you to make your usage and information and our content accessible to the public, directly or through your accounts on social media platforms. We urge you to consider the sensitivity of any information prior to sharing it publicly or with other users.

With Our Service Providers, Business Partners and Others to Accomplish Our Business Purposes as Stated in this Privacy Statement

We may share your information with our service providers and other third parties who perform services on our behalf, such as infrastructure, analytics, marketing, and email services, and to provide support and connectivity when you choose to download one of our Mobile Apps from an official app store.

When Necessary to Comply with Laws and Law Enforcement Requests or Otherwise to Protect HII, Its Clients, and Individuals

We may disclose your information (including your Personal Information) to a third party if:

• We believe that disclosure is reasonably necessary to comply with any applicable law, regulation, legal process, or governmental request;

• To enforce our agreements, policies, and terms of service;

• To protect the security or integrity of HII Services, including responding to a

  suspected or actual cybersecurity incident;

• To respond to a suspected or actual incident involving Personal Information for

  which HII has direct or indirect responsibility;

• To protect the property, rights, and safety of HII, our clients, or the public;

• To prevent harm or illegal activities;

• To respond to an emergency that we believe in good faith requires us to disclose

  information to assist in preventing the death or serious bodily injury of any

  person; or

• To investigate and defend ourselves against any third-party claims or allegations.

  As the Result of a Business Transition

  We may share or transfer your information (including your Personal Information) in connection with, or during negotiations of, any merger, sale of HII assets, financing, or acquisition of all or a portion of our business to another entity. We will take reasonable steps to assure that any other entity involved continues to comply with the terms of this Privacy Statement. We will notify you of such a change in ownership or transfer of assets, to the extent we are able to do so, by posting a notice on our Online Activities.

Your Control over Information that We Collect from and about You

• You may decline to share certain Personal Information with us, in which case we may not be able to provide you with some of the features and functionality of our Online Activities or fulfill your requests.

• You may opt out of receiving HII communications by using the unsubscribe link within each email. Note that, as long as you maintain an account with us or receive Services, you will continue to receive administrative messages from us regarding your account and the Services.

• You may request information about, and access to, the Personal Information that we collect from you.

• You may ask questions or make complaints about our privacy and data security practices with regard to your Personal Information.

• You may ask us to correct, update, or delete Personal Information that we have collected about you.

• To the extent we ever begin to share your Personal Information with third parties for marketing or other uses not directly related to HII Services and HII Online Activities, we would notify you in advance, and you would then have the right to withdraw your consent or otherwise ask us to stop providing your information to third parties for their use for non-HII purposes.

• You may ask us to stop processing your Personal Information.

• You may assert your legal rights with regard to our collection and use of your

  Personal Information under applicable federal, state, and international law.

• You have the right to receive a timely response from us with regard to your

  exercise of any of these options, including, if applicable, an explanation of why we cannot provide the requested response or an explanation of why we need additional time to respond.

  To exercise any of these options, or for additional information about this Privacy Statement and our privacy and data security practices, contact us through one of the methods given below.

  Security

  HII uses reasonable organizational, technical, and administrative measures to provide a level of security appropriate to the risk associated with the Personal Information that we collect. We protect Personal Information under our control against – and require our service providers to also protect against – accidental or unlawful destruction, loss, alteration, unauthorized disclosure of or access to, Personal Information that is transmitted, stored, or otherwise processed. Only authorized employees have access to the data you provide, and that access is limited to least privileged, need to know access. HII employees who have access to your Personal Information have agreed to maintain the confidentiality of that information.

Consistent with our legal and contractual obligations and with cybersecurity best practices, we will use public and non-public information, including Personal Information, to the extent necessary to maintain and improve our cybersecurity program and our awareness of evolving threats and to investigate and respond to suspected and actual cybersecurity and privacy incidents.

Unfortunately, no data transmission over the Internet or via email and no data storage system can be guaranteed to be 100% secure.

Data Retention

HII retains Personal Information in accordance with our records management practices and only as long as necessary to accomplish the business purpose for which it was collected and to comply with our legal and contractual obligations, and then securely disposes of that Personal Information or converts it to Non-Personal Information by aggregating it, de-identifying it, or otherwise anonymizing it so that it does not directly or indirectly identify an individual and cannot, with reasonable efforts, resources, and technologies, be used to re-identify an individual.

Children's Privacy

Our Online Activities, and our Services, are not directed to or intended for use by anyone under the age of 16. We do not knowingly collect Personal Information from anyone under the age of 16. If we become aware that a child under the age of 16 has provided us with Personal Information, we will take steps to delete that information. If you become aware that a child under the age of 16 has provided us with Personal Information, please contact us as described below:

California Privacy Rights

• not to be discriminated against for exercising the rights guaranteed by California Civil Code Section 1798.100 et seq.

Requests to Know
You have the right to request that we disclose:

• The categories of Personal Information we collect;

• The categories of Personal Information we have sold or disclosed for a business purpose;

• The categories of sources from which we collect your Personal Information;

• Our business or commercial purpose for selling or collecting your information;

• The categories of Personal Information sold or shared about you, as well as the categories

  of third parties to whom the Personal Information was sold, by category of Personal

  Information for each party to whom information was sold; and

• The specific pieces of Personal Information we have collected about you.

  Delivery may take place electronically or by mail. We are not required to provide Personal Information to you more than twice in a 12-month period.

  Requests to Delete
  You have the right to request that businesses delete any Personal Information collected about you. Upon receiving a verified request to delete your Personal Information, we will do so unless otherwise authorized by law.

  Verifiable Requests
  We will acknowledge the receipt of requests to know or requests to delete your information free of charge, within 10 business days. You may submit requests via the mechanisms given below.

  In order to protect your privacy and the security of your information, we may verify your request by asking you to provide additional information about yourself for us to match against our records.

  We will respond to your request within 45 calendar days of receipt, after we have successfully verified your identity.

  You may submit a request to know or a request for the deletion of your information via privacy@hii-co.com or by mail to:

Sale of Personal Information
We do not sell your Personal Information.

The Right to Non-Discrimination
You have a right not to receive discriminatory treatment for the exercise of your California privacy rights.

Categories of Sources from Which We Collect Personal Information Please see “Information We Collect from and about You,” above.

Business or Commercial Purpose for Collecting Your Information Please see “Why We Collect Information from and about You,” above.

Categories of Personal Information that We Have Sold in the Last 12 Months In the last 12 months, we have not sold Personal Information.

Categories of Personal Information We Disclose for a Business Purpose
We disclose the following categories of Personal Information for business purposes:

(A) Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
(B) Characteristics of protected classifications under California or federal law.

(C) Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. (D) Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.

(E) Geolocation data.
(F) Audio, electronic, visual, thermal, olfactory, or similar information. (G) Professional or employment-related information.

Authorized Agents
You may designate an authorized agent to make requests on your behalf. You must provide an authorized agent written permission to submit a request on your behalf, and we may require that you verify your identity directly with us. Alternatively, an authorized agent that has been provided power of attorney pursuant to Probate Code sections 4000-4465 may submit a request on your behalf.

Our Compliance with International Privacy Laws

Except to the extent limited by U.S. law and by HII’s contractual obligations to the U.S. federal government, HII complies with applicable international privacy laws, including with regard to transfers of Personal Information from one country to another.

Transfers of Personal Information from the EU to the U.S. and Subsequent Transfers

• •

•

Your Control over Information that We Collect from and about You,” above.

For questions

For more information about the EU Standard Contractual Clauses, see

https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-

contracts-transfer-personal-data-third-countries_en.

Individuals whose Personal Information is transferred in compliance with the EU

Standard Contractual Clauses or other EU compliant data transfer mechanism may have

additional legal rights beyond those described in this Privacy Statement about whether your Personal Information is subject to GDPR or other International Privacy Laws and whether you might have additional rights, contact HII at privacy@hii- co.com or by mail to:

Changes to this Privacy Statement

HII may update this Privacy Statement from time to time, including materially changing the use of Personal Information described herein.

Questions, Complaints, and Additional Information

If you have questions, complaints, or concerns about this Privacy Statement, your Personal Information, or our use and disclosure practices, or you wish to exercise your options as described in this Privacy Statement, please contact us at privacy@hii-co.com or by mail to:

Effective Date: June 26, 2020 Last Updated: June 26, 2020