Shareholders Rights

• To ask for the call of a Shareholders' Meeting (shareholders who, even jointly, represent 5% of the share capital)
• To be represented in a Shareholders' Meeting by proxy, indicating the name of one or more possible representative's substitutes. The proxy may be granted also to the Company Designated Proxy Holder, free of charge
• To submit lists of candidates for the office of Director or Statutory Auditor (holders of at least 0.5% of the share capital in the form of ordinary shares with voting rights)
• To ask for the integration of the Agenda and/or to submit further resolution proposals on items already on the Agenda (shareholders who even jointly represent at least 0.5% of the share capital)
• To submit questions pertaining to items on the Agenda even prior to Shareholders' Meeting. The Company shall provide answers during the Meeting itself at the latest.

Representation at shareholders' meetings

In compliance with the provisions of applicable law, any person entitled to vote may choose to be represented in a Shareholders' Meeting by proxy, if need be indicating the name of one or more possible representative's substitutes. If the terms of the proxy arrangement allow so, the proxy may elect to be replaced by a party of his/her choosing.

Proxies must be granted in writing, to a named party and are revocable at all times, notwithstanding any agreement to the contrary.

In order to grant a proxy, it is possible to make use of the proxy form issued by authorized brokers at the entitled person's request or of the proxy form prepared by UniCredit which may be downloaded and printed from the Company's website.

The proxy may be granted only for single Shareholders' Meetings and is valid also for the subsequent calls, unless it is a full power of attorney or a proxy granted by a company, association, foundation or other collective entity or institution to an employee of its own.

If the proxy is bestowed upon a company, association, foundation or other collective entity or institution, such parties may only delegate one of their employees or associates.

The granting of a proxy to a representative who is in a position of conflict of interest is permissible provided that the representative notifies the shareholder in writing of the circumstances out of which the conflict arises, and provided that specific voting instructions are issued for each resolution on which the representative is scheduled to vote on the shareholder's behalf. It is incumbent upon the representative to provide proof that he/she has notified the shareholder regarding the circumstances out of which the conflict of interest arises. The cases in which a conflict of interest arises in any event, regarding a representative or his/her replacement, are listed in Section 135-decies of Legislative Decree no. 58/98.

Representatives may deliver or send a copy of the proxy rather than the original - electronic media are also admissible - having, under their own responsibility, certified that the proxy corresponds to the original and having also certified the identity of the delegating party. Representatives must retain the original proxy and make a record of any voting instructions they have received, for a period of one year from the conclusion of the Meeting proceedings.

Voting proxies may also be granted by means of a document in electronic format with qualified electronic signature or digital signature and also electronically notified to the Company according to the instructions established in the call notice, or by other available methods pursuant to the provisions of law and regulations as in force at the time.

Company-Designated Proxy Holder

Pursuant to Section 135-undecies of Legislative Decree no. 58/98, the Company shall designate a party ("Designated Proxy Holder") to whom, no later than the end of the second trading day prior to the date scheduled for the Shareholders' Meeting even in call subsequent to the first one, voting rights holders may grant a proxy inclusive of voting instructions regarding all, or some of, the items on the agenda. Such proxies are valid only for the items for which voting instructions have been given.

Proxies of this nature are granted by signing a proxy form, which may be downloaded and printed from the Company's website, the content of which is provided for pursuant to CONSOB regulations. No expenses are incurred by shareholders in granting proxies of this nature. Proxies and voting instructions sent to the Designated Proxy Holder are always revocable prior to the above-stated deadline.

With regard to items on the agenda, the Designated Proxy Holder is duty-bound to provide information about any interest that he/she may have, either on his/her own account or on behalf of third parties. The Designated Proxy Holder shall also keep voting instructions confidential until the ballot starts, save for passing on said information to his/her own employees and assistants, who in turn are required to observe the same confidentiality requirements.

Shareholders who, even jointly, represent at least 0.50% of the UniCredit share capital, may ask for the Shareholders' Meeting agenda to be integrated and/or to submit resolution proposals on items already on the agenda, according to the cases, methods, terms and conditions outlined in Section 126-bis of the Legislative Decree no. 58/98 and in the Articles of Association. The requests, together with the documentation certifying the ownership of the shareholding, must be submitted in writing.

Shareholder integration of the agenda is not admissible for topics which Shareholders' Meetings are called upon to resolve, according to law, following the submission of proposals by the Directors, or on the basis of plans or reports drafted by the Directors, other than those indicated in Section 125-ter, sub-sec. 1, of the Legislative Decree no. 58/98.

Shareholders requesting additions to the agenda must prepare a report stating the reasons for their resolution proposals on the new matters they propose for discussion; such report shall be forwarded to the Board of Directors by the final deadline for the submission of the request for addition.

Within the deadline envisaged by the applicable provisions, Shareholders must sent to the Board of Directors the report giving the reason for the request of addition to the agenda or the resolution proposal on items already on the agenda.

Any person entitled to vote may individually submit resolution proposals at the Meeting.

Additions to the agenda and further resolution proposals on items already on the agenda shall be disclosed, in the same ways established for the publication of the notice of call, according to the terms outlined in the applicable provisions of law or regulations.

At the same time as the disclosure notice, the reports drawn up by the persons requiring the additions and/or the further resolution proposals submitted, together with any Board of Directors considerations, will be made available to the public, in the same ways provided for for the documents concerning the Shareholders' Meeting.

Pursuant to Section 127-ter of Legislative Decree no. 58/98, those who are entitled to vote may submit questions pertaining to the items on the agenda even prior to the Shareholders' Meetings. To this purpose, the notice of call sets out the terms, in compliance with the provisions by law, within which the questions must be submitted to the Company.

Questions received by the Company prior to the Shareholders' Meeting shall be answered - prior assessment of the right thereto being ascertained - in the form and by the deadlines established by law.

Answers may not be provided, neither during the Shareholders' Meeting, if the requested information has already been made available in "FAQ" format on the Company's website or when the answer has been published. Answers made available in paper form, at the beginning of the Meeting, to each Shareholders entitled to vote, shall be deemed to be provided during the Meeting itself.

INFORMATION NOTICE PURSUANT ARTT. 13 AND 14 EU REGULATION 679/2016 ¹

1. Data Controller and Data Protection Officer

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (Bank or

UniCredit).

You can contact the Data Protection Officer at: UniCredit SpA, Data Protection Office, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan,

E-mail: Group.DPO@unicredit.eu, PEC: Group.DPO@pec.unicredit.eu.

2. Purpose and legal basis of processing

UniCredit processes your personal data for the purposes of fulfilling legal obligations and therefore to allow you to formulate before the

Shareholders' Meeting (and/or during it) Your questions about the matter at the Agenda of the Shareholders' Meeting itself.

This need represents the legal basis that legitimizes the resulting processing. Providing the data necessary for these purposes is

a legal obligation: in the absence of these, it will not be possible to follow up what you have requested.

3. The categories of personal data concerned

UniCredit processes personal data collected directly from you, or from third parties, including, but not limited to, personal data (e.g.

name, surname, fiscal code), image data (e.g video during the Shareholders' Meeting) and voice recordings (e.g. registration during the

Shareholders' Meeting) and other data referable to the above indicated categories.

4. Recipients or recipients' categories of personal data

Your data may be communicated to the natural and legal persons in their capacity as Data Processors as specified in the list available at

the Bank's premises open to the public, or on the website www.unicredit.it, as well as the quality of persons authorized to process

personal data, with regard to the data necessary for the performance of the duties assigned to them, the natural persons belonging to

the following categories: Bank employees or seconded by it; temporary employees, interns, consultants and employees of external

companies appointed as Data Processors .

Your data can be communicated to those subjects to whom this communication must be carried out in compliance with an obligation

established by law, by a regulation or by EU legislation. Further information about it can be found in the customers' information notice

published in the website www.unicredit.it, section "Privacy".

The detailed list of recipients to whom the data can be communicated, can be furthermore requested writing to Group.DPO@unicredit.eu.

5. Data subjects' rights

The General Data Protection Regulation ("EU Regulation 679/2016") entries to the natural persons, individual companies and freelanders

("Data Subjects") specific rights, among which the one to know what personal data are held by the Bank and how they are used (Right of

access), to obtain the update, the correction or, if interested, the integration, as well as the cancellation, transformation into anonymous

form or limitation.

To exercise the rights, the Data Subject may contact: UniCredit SpA, Claims, Via Del Lavoro n. 42, 40127 Bologna, tel. +39 051.6407285,

fax +39 051.6407229, e-mail address: diritti.privacy@unicredit.eu

The deadline for the reply is one (1) month, that may be extended by two (2) further months in cases of particular complexity; in these

cases, the Bank provides at least one interim communication within one (1) month.

The rights' exercise is, in principle, free of charge; the Bank reserves the right to request a fee in the event of manifestly unfounded or

excessive requests (even repetitive).

The Bank has the right to request information necessary for identification purposes of the applicant.

6. Complaint or reporting to the supervisory authority for the protection of personal data

The Bank informs you that you have the right to lodge a complaint with or make a report to the Authority for the Protection of

Personal Data, or else to appeal to the Judicial Authority. The contacts of the Guarantor Authority for the Protection of Personal Data can

be consulted on the website http://www.garanteprivacy.it.

¹Relating to the Shareholders' Meeting.