Shareholders

Representation at shareholders' meetings

In compliance with the provisions of applicable law, any person entitled to vote may choose to be represented in a Shareholders' Meeting by proxy, if need be indicating the name of one or more possible representative's substitutes. If the terms of the proxy arrangement allow so, the proxy may elect to be replaced by a party of his/her choosing.

Proxies must be granted in writing, to a named party and are revocable at all times, notwithstanding any agreement to the contrary.

In order to grant a proxy, it is possible to make use of the proxy form issued by authorized brokers at the entitled person's request or of the proxy form prepared by UniCredit which may be downloaded and printed from the Company's website.

The proxy may be granted only for single Shareholders' Meetings and is valid also for the subsequent calls, unless it is a full power of attorney or a proxy granted by a company, association, foundation or other collective entity or institution to an employee of its own.

If the proxy is bestowed upon a company, association, foundation or other collective entity or institution, such parties may only delegate one of their employees or associates.

The granting of a proxy to a representative who is in a position of conflict of interest is permissible provided that the representative notifies the shareholder in writing of the circumstances out of which the conflict arises, and provided that specific voting instructions are issued for each resolution on which the representative is scheduled to vote on the shareholder's behalf. It is incumbent upon the representative to provide proof that he/she has notified the shareholder regarding the circumstances out of which the conflict of interest arises. The cases in which a conflict of interest arises in any event, regarding a representative or his/her replacement, are listed in Section 135-decies of Legislative Decree no. 58/98.

Representatives may deliver or send a copy of the proxy rather than the original - electronic media are also admissible - having, under their own responsibility, certified that the proxy corresponds to the original and having also certified the identity of the delegating party. Representatives must retain the original proxy and make a record of any voting instructions they have received, for a period of one year from the conclusion of the Meeting proceedings.

Voting proxies may also be granted by means of a document in electronic format with qualified electronic signature or digital signature and also electronically notified to the Company according to the instructions established in the call notice, or by other available methods pursuant to the provisions of law and regulations as in force at the time.

Company-Designated Proxy Holder

Pursuant to Section 135-undecies of Legislative Decree no. 58/98, the Company shall designate a party ("Designated Proxy Holder") to whom, no later than the end of the second trading day prior to the date scheduled for the Shareholders' Meeting even in call subsequent to the first one, voting rights holders may grant a proxy inclusive of voting instructions regarding all, or some of, the items on the agenda. Such proxies are valid only for the items for which voting instructions have been given.

Proxies of this nature are granted by signing a proxy form, which may be downloaded and printed from the Company's website, the content of which is provided for pursuant to CONSOB regulations. No expenses are incurred by shareholders in granting proxies of this nature. Proxies and voting instructions sent to the Designated Proxy Holder are always revocable prior to the above-stated deadline.

With regard to items on the agenda, the Designated Proxy Holder is duty-bound to provide information about any interest that he/she may have, either on his/her own account or on behalf of third parties. The Designated Proxy Holder shall also keep voting instructions confidential until the ballot starts, save for passing on said information to his/her own employees and assistants, who in turn are required to observe the same confidentiality requirements.

Shareholders who, even jointly, represent at least 0.50% of the UniCredit share capital, may ask for the Shareholders' Meeting agenda to be integrated and/or to submit resolution proposals on items already on the agenda, according to the cases, methods, terms and conditions outlined in Section 126-bis of the Legislative Decree no. 58/98 and in the Articles of Association. The requests, together with the documentation certifying the ownership of the shareholding, must be submitted in writing.

Shareholder integration of the agenda is not admissible for topics which Shareholders' Meetings are called upon to resolve, according to law, following the submission of proposals by the Directors, or on the basis of plans or reports drafted by the Directors, other than those indicated in Section 125-ter, sub-sec. 1, of the Legislative Decree no. 58/98.

Shareholders requesting additions to the agenda must prepare a report stating the reasons for their resolution proposals on the new matters they propose for discussion; such report shall be forwarded to the Board of Directors by the final deadline for the submission of the request for addition.

Within the deadline envisaged by the applicable provisions, Shareholders must sent to the Board of Directors the report giving the reason for the request of addition to the agenda or the resolution proposal on items already on the agenda.

Any person entitled to vote may individually submit resolution proposals at the Meeting.

Additions to the agenda and further resolution proposals on items already on the agenda shall be disclosed, in the same ways established for the publication of the notice of call, according to the terms outlined in the applicable provisions of law or regulations.

At the same time as the disclosure notice, the reports drawn up by the persons requiring the additions and/or the further resolution proposals submitted, together with any Board of Directors considerations, will be made available to the public, in the same ways provided for for the documents concerning the Shareholders' Meeting.

Pursuant to Section 127-ter of Legislative Decree no. 58/98, those who are entitled to vote may submit questions pertaining to the items on the agenda even prior to the Shareholders' Meetings. To this purpose, the notice of call sets out the terms, in compliance with the provisions by law, within which the questions must be submitted to the Company.

Questions received by the Company prior to the Shareholders' Meeting shall be answered - prior assessment of the right thereto being ascertained - in the form and by the deadlines established by law.

Answers may not be provided, neither during the Shareholders' Meeting, if the requested information has already been made available in "FAQ" format on the Company's website or when the answer has been published. Answers made available in paper form, at the beginning of the Meeting, to each Shareholders entitled to vote, shall be deemed to be provided during the Meeting itself.

INFORMATION NOTICE ACCORDING TO ARTICLES 13 AND 14 OF EU REGULATION 679/2016 (GDPR) RELATING TO THE SHAREHOLDERS' MEETING

1. Data Controller and Data Protection Officer

The Data Controller is UniCredit S.p.A. with registered office in Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (the Bank or UniCredit).

The Data Protection Officer can be contacted at UniCredit S.p.A., Data Protection Office Square Gae Aulenti n. 3, Tower A, 20154 Milano E-mail: Group.DPO@unicredit.eu, PEC: Group.DPO@pec.unicredit.eu

2. Purpose and legal basis of the processing

UniCredit processes your personal data in order:

a) to allow you to participate in the Shareholders' Meeting and to exercise the rights related to it, including the possibility of asking questions on the items on the agenda (including in the pre-Shareholders' Meeting phase) and to exercise your right to vote;

as well as

b) to ascertain the regular constitution of the Shareholders' Meeting, to record and verbalise the speeches and votes at the Shareholders' Meeting, also through audio/video recording systems in order to facilitate the subsequent drafting of the minutes.

These needs represent the legal basis that legitimizes the consequent processing. The provision of the data necessary for these purposes represents a legal obligation: it should be noted that in the absence of such provision it will not be possible for you to exercise the rights referred to in letter a), nor will the Bank be able to carry out the obligations referred to in letter b).

3. Categories of data processed

UniCredit processes personal data collected directly from you, or from third parties, which include, but are not limited to, personal data (e.g. name, surname, date of birth, tax code, address), image and voice data (e.g. filming and recordings during the Shareholders' Meeting) and other data attributable to you (e.g. the share ownership declared for the purpose of participation in the Shareholders' Meeting).

4. Recipients or categories of recipients of personal data

Your data may be disclosed in their capacity as Data Processors to the natural and legal persons listed in the list available at the Bank's premises open to the public or on the website www.unicredit.it, and as persons authorised to process personal data, in relation to the data necessary for the performance of the duties assigned to them, natural persons belonging to the following categories: employees of the Bank or seconded to it, temporary workers, interns, consultants and employees of external companies appointed as Data Processors.

The data may be communicated to those subjects to whom such communication must be made in compliance with an obligation provided for by law, by a regulation or by EU legislation. More information on this can be found in the customer policy published in the "Privacy" section of the website www.unicredit.it.

5. Rights of the data subjects

The General Data Protection Regulation ("EU Regulation 679/2016") gives natural persons, sole proprietorships and/or freelancers ("Data Subjects") specific rights, including the right to know what personal data the Bank holds and how it is used (Right of access), to obtain its updating, correction or, if interested, integration, as well as cancellation, anonymization or restriction.

To exercise their rights, each Data Subject may contact: UniCredit S.p.A., Claims, Via Del Lavoro n. 42, 40127 Bologna, fax +39 051.6407229, address e-mail: diritti.privacy@unicredit.eu.

The deadline for the response is one (1) month, extendable by two (2) months in cases of particular complexity; in these cases, the Bank shall provide at least one interim communication within one (1) month.

The exercise of rights is, in principle, free of charge; the Bank reserves the right to ask for a contribution in the event of manifestly unfounded or excessive requests (including repetitive ones). The Bank has the right to request information necessary for the identification of the applicant.

The Bank informs you that you have the right to lodge a complaint or make a report with the Personal Data Protection Authority or alternatively to appeal to the Judicial Authority. The contact details of the Personal Data Protection Authority can be found on the website www.garanteprivacy.it.

6. Data processing methods and retention period

The processing of Personal Data will be carried out using electronic and manual tools, in such a way as to guarantee the confidentiality, correctness and security of the Personal Data. UniCredit guarantees the use of all security measures, technical and organizational measures suitable to guarantee a level of security appropriate to the risk, pursuant to art. 32 of the GDPR.

In particular, the audio/video recordings will not be disclosed and all the data, as well as the audio/video supports, will be kept by the Bank together with the documents produced during the meeting to document what is written in the minutes.