LEONARDO SINGLE VENDORS REGISTER - Information pursuant to Article 13, Regulation (EU) 2016/679 ("GDPR") Dear user, pursuant to art. 13, GDPR, and as Data Subject interested in the processing of your personal data (“Data”), we provide the following information, in order to disclose: - the identity and contact details of Controllers; - the purposes and methods of the processing; - the mandatory or optional nature of Data provision and the consequences of any refusal to provide Data; - the Data processing legal ground; - if the processing is based on art. 6, paragraph 1, letter f), the legitimate interests pursued by Controller

or by third parties; - any recipients or any categories of recipients of Data; - where applicable, the intention of the Controller to transfer Data to third country or to international

organization and the existence of an adequacy decision by the Commission or, in the case of transfers referred to in Article 46, 47 or 49 second paragraph, the reference to appropriate guarantees and the means to obtain a copy of such Data or the place where they are made available;

- the Data retention period or, if this is not possible, the criteria used to define this period; the existence of your right to request data Controllers to access Data and to rectify or delete them or limit the processing of Data or to object to their processing, in addition to the right to Data portability;

- the right to lodge a complaint with a Supervisory authority; - the existence of an automated decision-making process, including profiling pursuant to art. 22,

paragraphs 1 and 4 and, at least in such cases, significant information on the methodology used, as well as the importance and the expected consequences of such processing towards you;

- if Controller intends to further process Data for a different purpose than that for which they were collected, prior to such processing, he will provide you with information on this different purpose.

Processing Purpose Leonardo S.p.a., Leonardo Global Solutions S.p.A. and the operating companies of Leonardo Group set up the database called “LEONARDO REGISTER OF SUPPLIER” for an integrated management of the purchase process. Leonardo's procurement activities are managed by Leonardo Global Solutions SpA. (hereinafter also referred to as "LGS") and the Purchasing Business Units of each Leonardo Divisions / Operating Companies controlled and/or participated directly or indirectly by Leonardo S.p.a. (hereinafter also "LDO"), each for its area of competence. Your Data will be processed for the purposes of prequalification and qualification processes, preparatory to participation in tenders and to signing contracts and for the purposes indicated in this statement.

Data Controllers Data Controllers, in person of their legal representatives pro tempore, are: - Leonardo S.p.a. with registered office in Rome, Piazza Monte Grappa, 4 - Leonardo Global Solutions S.p.A with registered office in Rome, Piazza Monte Grappa, 4 - Telespazio S.p.a. with registered office in Rome, Via Tiburtina, 965; - E-Geos S.p.A. with registered office in Matera, Località Terlecchie, snc; - Fata Logistic System S.p.A, with registered office in Pianezza (TO), Via dei Prati 7 - Any Operating Companies of Leonardo Group not expressly listed in this statement. Data Processors Controllers, each for their area of expertise, have appointed more Data processing managers. The complete list of designated Processors can be found at the dedicated Help Desk.

Data Processing methods The Data processing will be in compliance with law and will be based on principles of correctness, lawfulness and transparency and protection of your privacy. In relation to the purposes described, the processing will be carried out by means of operations or set of operations, indicated in particular in Article 4, paragraph 1, letter a) of Privacy Code and in art. 4 paragraph 2 of GDPR - according to the principle of necessity as per art. 3 of the Privacy Code - and is however such as to ensure Data security and confidentiality. Data will also be kept in such a way as to minimize the risks of destruction, loss, unauthorized access, processing not allowed and not in accordance with the purpose of collection.

Categories of subjects to whom Data can be communicated and the transfer of Data to third countries Data will not be disseminated (meaning for this purpose, giving knowledge of Data to indeterminate subjects, in any form, including by making available or consulting), without prejudice to the hypothesis in which the disclosure is requested , in accordance with law, by law enforcement agencies, judicial authorities, information and security bodies or other public entities for the purposes of defense or security of the state or for the prevention or prosecution of offenses. Data will be processed by Controllers as identified above also by making use of other parties who will act as managers - internal or external - of the processing or in their capacity as representative. In this context and for the purposes described above, Data may be transferred to countries outside the EU, in which case, the Controller undertakes to ensure that the recipient respects the same standards required by European Union legislation. In particular, the employees or collaborators of the business units involved in the negotiation and contractual relationships established between the supplier and Leonardo Group (e.g. Purchases, Administration, Help Desk, etc.) may become aware of Data. This transfer, where the case occurs, will be governed by the use of standard contractual clauses adopted by European Commission with Decision 2010/87 / EU and any subsequent amendments or, alternatively, on the basis of an adequacy decision of the Commission, on the basis of binding corporate rules and / or any other instrument permitted by the relevant legislation. It will be possible to obtain information on the place where Data has been transferred and copy of such data by writing to moc@leonardocompany.com. Data Subject’s Rights Pursuant to articles 15 to 21 of GDPR, you, as data subject, may at any time exercise the following rights: 1. Right of access: the Data subject has the right to obtain confirmation of the existence or otherwise of the processing of Data, and the right to receive any information concerning the same processing; 2. Right to rectification: the Data subject has the right to obtain the updating, rectification or, when interested, integration of Data; 3. Right to cancellation: in some areas, the Data subject has the right to obtain the cancellation, transformation into anonymous form or blocking of Data processed in violation of law, including those that do not need to be kept for the purposes for which the Data were collected or further processed; 4. Right to processing limitation: upon the occurrence of certain conditions, the Data subject has the right to obtain the Data processing limitation, if it is not relevant for the continuation of the employment relationship or necessary to comply with the law provisions. 5. Right to portability: the Data subject has the right to obtain the transfer of Data held by the Controller in favor of a different Controller; 6. Right to object: The Data subject has the right to object, in whole or in part, for legitimate reasons, to the processing of Data, even though they are relevant to the purpose of the collection, including profiling and the processing of Data for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication; 7. Right to lodge a complaint: the Data subject has the right to lodge a complaint to the Supervisory Authority regarding how Controller processes Data. You may exercise your rights as indicated above, as well as ask for any information regarding our Data protection policy, by contacting the Help Desk at moc@leonardocompany.com or by calling the toll-free number 800 591122 or for calls from abroad +390650264588 Nature of Data supply and consequences of the possible refusal to respond The Data provision is necessary to achieve the purposes indicated and, therefore, the failure to provide Data reported as mandatory will make it impossible the prequalification and qualification processes for the participation in tenders and the signing of contracts.

Data Retention period Data will be processed by Controllers for the period necessary for the purposes for which they were collected and for the entire duration of any contractual relationship. In any case Data will be kept for a period not exceeding 10 years after the termination of said relationship, exclusively for purposes related to the fulfillment of legal obligations or the rights defense of the Controller in court.