Unicredit — AGM Information 2022

Feb 21, 2022

Unlock your potential

5. Appointment of the Board of Statutory Auditors and of the substitute Statutory Auditors

Information on the appointment process of UniCredit S.p.A. Statutory Auditors

8 April 2022 Ordinary part Shareholders' Meeting

Index

Notice

1. General Information	4
2. Filing of the slates	5
3. Documentation to be filed with the slates	6
4. Minority slates and connections among slates	7
5. Gender composition	8
6. Appointment process	9
Annex – Template – Statement of candidacy

Notice

The contents of this document are made available to the UniCredit Shareholders merely for information purposes and as such, consequently, do not in any way intend to replace or complete the provisions brought by law, by regulation or by the Company's Articles of Association that regulate the appointment of the Statutory Auditors, which Shareholders are kindly asked to refer to.

General information

Statutory Auditors' number and term in office

The appointment of the Statutory Auditors is governed by the Italian Civil Code, the Legislative Decree no. 58/1998 (Consolidated Law on Finance, hereinafter also "TUF"), the Legislative Decree no. 385/1993 (Consolidated Law on Banking, hereinafter also "TUB") and the related regulations as well as by Clause 30 of UniCredit's Articles of Association, to all of which reference may be made.

Pursuant to the Articles of Association, the Ordinary Shareholders' Meeting appoints five permanent Statutory Auditors, among whom the Chair, and four substitute Statutory Auditors. The Board of Statutory Auditors' term in office is three financial years and ends on the date of the Shareholders' Meeting called for the approval of the financial statements relating to the last financial year in which they are in office.

The UniCredit Board of Statutory Auditors in its meeting held on 24 January 2022 has approved the "Qualitative and quantitative composition of the UniCredit S.p.A. Board of Statutory Auditors", which contains the results of the ex-ante identification carried out by the same Board of Statutory Auditors on its qualitative and quantitative composition deemed to be optimal in order to ensure the proper performance of its functions, in accordance with current provisions of both laws and regulations. Said document is published on the UniCredit website (www.unicreditgroup.eu).

Procedure for the Statutory Auditors' appointment

Permanent and substitute Auditors are appointed on the basis of slates submitted by the legitimate parties, in which the candidates must be listed using progressive numbers. Slates must be divided into two sub-lists, containing respectively up to five candidates for the office as permanent Auditor and up to four candidates for the office as substitute Auditor.

Who may file the slates

Holders of at least 0.5% of the share capital in the form of shares with voting rights at the Ordinary Shareholders' Meeting. The number of shares that gives the right to file slates may be held by one or more Shareholders.

Term for filing slates

No later than the 25th day prior to the date of the Shareholders' Meeting (March 14, 2022). The slates of candidates, together with the necessary documentation, must be filed with the Registered Office of the Company in Milan or by e-mail to corporate.law@pec.unicredit.eu, or with the other means outlined in the notice of call.

Term for disclosing the slates

At least 21 days prior to the date of the Shareholders' Meeting (March 18, 2022). Slates of candidates will be made publicly available at the UniCredit S.p.A. Registered Office in Milan, on the website of the authorized storage mechanism "eMarket STORAGE" managed by Spafid Connect S.p.A. (), as well as on the Company's website.

Filing of the slates

Each legitimate party may submit, or contribute to the submission of, only one slate (including via proxies or trustee companies). Shareholders belonging to the same group or Shareholders who are parties to a shareholders' agreement concerning UniCredit shares may not submit more than one slate (including via proxies or trustee companies).

Candidates may be included in one slate only, under penalty of forfeiture of their candidacy.

The ownership of the minimum number of shares required for filing slates is calculated with regard to the shares registered for each individual legitimate party, or for several legitimate parties jointly, on the day on which the slates are filed with the Company.

The certification on the ownership of the number of shares necessary for filing slates - sent by the intermediary in compliance with its accounting records, upon request of the entitled party - can be submitted to the Company also after the filing but strictly by the deadline within which the Company must make the slates public (i.e. at least 21 days prior to the date of the Shareholders' Meeting).

At least the first two candidates for the office as permanent Auditors and at least the first candidate for the office as substitute Auditor given in the respective directories must be enrolled with the Italian Legal Auditors Register and must have practiced the legal auditing of accounts for a period of no less than three years. In order to ensure a composition of the Board of Statutory Auditors that is compliant with the applicable rules, the first candidate in the sub-list for the office as permanent Auditor and at least one candidate in the sub-list for the office as substitute Auditor must also meet the professional experience requirements specified to hold the office of Chair of the Board of Statutory Auditors provided for in the Decree of the Ministry of Economics and Finance no. 169 of 23 November 2020.

Each slate for the appointment as permanent and substitute Auditor must present a number of candidates belonging to the least represented gender such as to ensure, within the slate itself, the abidance to the balance of genders at least in the minimum quantity established by the applicable provisions, also of a regulatory nature. In fact, the procedures for the drawing-up of the slates and the supplementary criteria for the determination of the members of the body must allow that the least represented gender obtains at least two-fifths of the appointed Auditors (see the following section "Gender composition").

Shareholders, in presenting slates, are invited to take into account the results of the ex-ante analysis carried out by the UniCredit Board of Statutory Auditors highlighted in the abovementioned document "Qualitative and quantitative composition of the UniCredit S.p.A. Board of Statutory Auditors".

Shareholders obviously retain the right to make their own assessments of what constitutes an optimal Board of Statutory Auditors' composition, justifying any differences with regard to the analysis made by the Board of Statutory Auditors.

Documentation to be filed with the slates

The following documents must also be filed, signed and dated, together with each slate no later than the 25th day prior to the date of the Shareholders' Meeting:

• information relating to the identity of the Shareholders who filed the slates specifying the total percentage of the equity held;
• a statement of the Shareholders, other than those who hold, even jointly, a control or relative majority shareholding, certifying the absence of connecting relationships with the latter pursuant to Sec. 144-quinquies of the CONSOB Issuers Regulation no. 11971/99, after having read the recommendations given by CONSOB with its Communication no. DEM/9017893 dated 26 February 2009;
• an exhaustive information on the personal and professional characteristics of the candidates (detailed curriculum vitae) as well as a list of the management and control offices held in other companies1;
• the statements with which each candidate irrevocably accept the office (subject to their appointment) and attest, under their own responsibility, that there are no reasons for their ineligibility, forfeiture or incompatibility, as well as that they meet the requirements provided for by current provisions.

Any slate that does not meet the above requirements will be deemed as not filed.

In order to allow the Shareholders to interpret the expertise held by each candidate more easily, the Board of Statutory Auditors also requests that each candidate files a declaration signed by the same providing analytical evidence of the expertise accrued in the various areas listed within the document "Qualitative and quantitative composition of the UniCredit S.p.A. Board of Statutory Auditors".

Please find attached to this document a template statement of candidacy including also the so-called "profile form" related to the competencies of the candidate as well as the information notice on the processing of the personal data. The persons concerned are invited to be aware of such information notice.

¹ Please provide this documentation both in Italian and English.

Minority slates and connections among slates

According to current laws and regulations, at least one permanent member of the Board of Statutory Auditors shall be chosen from the minority slate that obtained the largest number of votes and is not linked in any way, even indirectly, with the Shareholders who filed, or voted for, the slate which resulted first by number of votes. The UniCredit S.p.A. Articles of Association provide that there should be 2 permanent Auditors and 2 substitute Auditors elected by the minorities, according to the modalities described in the following paragraph "Appointment process".

CONSOB, in order to ensure full transparency on any connection between slates, made detailed recommendations to the Shareholders filing a minority slate for the appointment of the Statutory Auditors². In particular, CONSOB requires legitimate parties who submit "minority slates" to file - together with each slate - a declaration certifying the absence of any of the relationships specified in Section 144-quinquies of the CONSOB Issuers Regulation, including indirect relationships, with Shareholders who severally or jointly hold a controlling or a relative majority shareholding, specifying:

• the absence of any significant relationships with said controlling or relative majority Shareholders; or
• any existing relations, where significant, together with the reasons for which such relations have been deemed not crucial for the existence of such relationships.

The Company makes said declaration available to the public together with the slate.

CONSOB highlighted that the notion of connection is "non-technical" and "cannot be limited to the cases envisaged by law related to control and connection" and that to said notion "considering its anti-elusive purpose, must be attributed a wide meaning".

² See CONSOB Communication no. 9017893 dated February 26, 2009.

Gender composition

Italian Law no. 160/2019, amending Sections 147-ter and 148 of the Legislative Decree no. 58/1998, introduced in Italy a new criterion for the composition of the corporate bodies of listed companies to ensure the gender balance, envisaging that the least represented gender must granted with a representation of at least two-fifths of the appointed permanent members of the board of statutory auditors.

The above provisions apply to the renewal of the Board of Statutory Auditors and therefore the slates of candidates shall be made up in order to ensure the presence of at least two-fifths of members of the least represented gender.

Appointment process

All those entitled to vote may only vote for one slate.

The permanent and substitute Auditors are chosen from the majority and the minority slates - in the progressive order in which the candidates are given - as follows:

• as far as concerns the election of the permanent Statutory Auditors, the votes obtained by each slate are divided in succession by one, two, three, four and five. The ratios obtained are progressively given to the candidates in the first directory of each slate in the same order as in the directory and are reported in one single decreasing graduation: the persons elected are the first three candidates in the slate that obtains the majority of the votes and the first two candidates that have obtained the highest ratio among those belonging to the minority slates. The candidate who has obtained the highest share of votes among the candidates belonging to the slate that obtained the highest number of votes among the minority slates, is elected as Chair of the Board of Statutory Auditors;
• instead, as far as concerns the election of the substitute Statutory Auditors, the votes obtained by each slate are divided in succession by one, two, three and four. The ratios obtained are progressively given to the candidates in the second directory of each slate in the same order as in the directory and are reported in one single decreasing graduation: the persons elected are the first two candidates in the slate that obtains the majority of the votes and the first two candidates that have obtained the highest ratio among those belonging to the minority slates.

	Majority slate	Minority slate
Permanent Statutory Auditors	the first 3 candidates	the 2 most voted candidates among all the minority slates
Substitute Statutory Auditors	the first 2 candidates	the 2 most voted candidates among all the minority slates
Chair of the Board of Statutory Auditors		the first candidate belonging to the slates receiving the most votes among the minority slates

In the chart that follows there are briefly reported the above appointment criteria.

STATEMENT OF CANDIDACY AND DECLARATION ATTESTING THE INEXISTENCE OF REASONS FOR INELIGIBILITY, FORFEITURE OR INCOMPATIBILITY, AS WELL AS REGARDING THE MEETING OF THE REQUIREMENTS PROVIDED FOR BY CURRENT PROVISIONS

The undersigned _________________ born in __________________________ (__) on ________________, tax code_____________________, resident in __________ (__), _____________________ nationality, in relation to the appointment of the Board of Statutory Auditors of UniCredit S.p.A. ("UniCredit") on the agenda of the Ordinary Shareholders' Meeting convened for April 8th , 2022, under his/her own responsibility,

DECLARES TO

submit his/her candidacy as ☐ permanent Statutory Auditor / ☐ substitute Statutory Auditor of the Board of Statutory Auditors of UniCredit and, if appointed, to irrevocably accept his/her appointment as Statutory Auditor.

In view of the provisions, among others, of art. 26 of the Legislative Decree no. 385 of 1 September 1993 ("TUB"), of art. 148 of the Legislative Decree no. 58 of 24 February 1998 ("TUF"), of the Decree issued by the Ministry of Economics and Finance no. 169 of 23 November 2020 ("Decree"), of the Decree issued by the Ministry of Justice no. 162 of 30 March 2000, of the Supervisory Regulations on banks' corporate governance (Bank of Italy Circular no. 285/2013, First Part, Title IV, Chapter 1, Section III, Paragraph 3.2) and clause 30 of UniCredit S.p.A. Articles of Association and of art. 2, recommendations 7 and 9, of the Italian Corporate Governance Code

STATES THAT

there are no reasons for his/her ineligibility, forfeiture or incompatibility, and that the undersigned meets the requirements provided for by the current provisions and by the Articles of Association of UniCredit for the appointment as ☐ Chair / ☐ permanent Statutory Auditor / ☐ substitute Statutory Auditor of the Board of Statutory Auditors of UniCredit; with specific reference to the experience and independence requirements

DECLARES

I. EXPERIENCE REQUIREMENTS

1) ☐ to be enrolled with the Legal Auditors Register AND to have practiced the legal auditing of accounts for a period no less than ☐ three years ☐ five years

[enrollment no. with the Legal Auditors Register ____________; timeframe: from ______________ (month/year) to _________________ (month/year)]

or

• 2) ☐ to have practiced for at least ☐ three years ☐ five years one or more of the following activities, even alternatively:
• a) ☐ the legal auditing of accounts; [enrollment no. with the Legal Auditors Register: ____________; timeframe: from ______________ (month/year) to _________________ (month/year)]

b) ☐ administration or control activities or executive tasks in the credit, financial, securities or insurance sector;

__________________________________________________________________ [please indicate the activities and the relevant timeframe]

c) ☐ administration or control activities or executive tasks at listed companies or companies whose size and complexity are greater than, or comparable to, that of UniCredit (in terms of turnover, nature and complexity of the organisation or activity carried out);

__________________________________________________________________ [please indicate the activities and the relevant timeframe]

d) ☐ professional activities as a business accountant or lawyer, undertaken primarily in the credit, financial, securities or insurance sector:

__________________________________________________________________ [please indicate the professional firm and the relevant timeframe]

e) ☐ teaching, as university professor of first or second level, subjects concerning – in the field of law – banking, commercial, and/or tax law, as well as the running of financial markets and – in the field of business/finance – banking operations, business economics, accountancy, the running of the securities markets, the running of the financial and international markets and corporate finance, or other subjects which are functional to the credit, financial, securities or insurance sector:

__________________________________________________________________

[please indicate the taught subject, the relevant University and timeframe]

f) ☐ performing managerial, executive or top management duties, however called, within public organisations or offices of the Public Administration, relating to the credit, financial, securities or insurance sector, or to the investment services sector or to the collective investment-management sector as defined in TUF, whose size and complexity are comparable with that of UniCredit:

__________________________________________________________________ [please indicate the function carried out, the relevant entity and timeframe]

II. INDEPENDENCE REQUIREMENTS

• 3) ☐ to possess the independence requirements set forth under art. 148, para. 3, of TUF;
• 4) ☐ to possess the independence requirements set forth under art. 14 of the Decree;
• 5) ☐ to possess the independence requirements set forth under art. 2, recommendations 7 and 9, of the Italian Corporate Governance Code; or

☐ to NOT possess the independence requirements set forth under art. 2, recommendations 7 and 9, of the Italian Corporate Governance Code.

The undersigned, also:

• UNDERTAKES TO, in case of appointment, and, for the substitute Statutory Auditors, in case of subsequent appointment as permanent member of the Board of Statutory Auditors:
• to devote sufficient time for the effective discharge of the office, also considering the guidance on the activity carried out by the Statutory Auditors of UniCredit during 2021 described in the "Qualitative and quantitative composition of the Board of Statutory Auditors of UniCredit S.p.A." published on the website of UniCredit;
• to not undertake management or control offices in other companies exceeding the limits set forth by the applicable provisions;
• UNDERTAKES to timely notify to UniCredit each amendment to the declarations above and to provide, upon request of UniCredit, the appropriate documentation to confirm the truthfulness of the data declared;
• AUTHORIZES, having read the information notice pursuant to articles 13 and 14 of the General Data Protection Regulation - Reg. (EU) 2016/679 - attached below, the disclosure of the data above and of the information on the personal and professional characteristics set forth in the curriculum vitae, in the so-called "profile form" and in the list of management and control offices currently held in other companies.

Date, place ____________________

Signature ____________________________

Allegati:

• 1. Curriculum vitae (indicating the personal and professional qualities of the candidate)
• 1. List of management and control offices currently held in other companies
• 1. Competence Requirements "Qualitative and quantitative composition of the Board of Statutory Auditors of UniCredit S.p.A." (so-called "profile form")
• 1. Information notice on the processing of the personal data by Unicredit

[ANNEX 1 - CURRICULUM VITAE]

Date and place, _________________________ Signature ____________________________________

[ANNEX 2 – LIST OF MANAGEMENT AND CONTROL OFFICES CURRENTLY HELD IN OTHER COMPANIES]

Date and place, _______________________

Signature _____________________________

[ANNEX 3 - PROFILE FORM (COMPETENCE REQUIREMENTS - "QUALITATIVE AND QUANTITATIVE COMPOSITION OF THE UNICREDIT S.P.A. BOARD OF STATUTORY AUDITORS")]

The undersigned _____________________ declares:

• 1) to possess a good knowledge and experience in the following competence areas¹:
• a) $\Box$ Banking Business, gained through:
• b) $\Box$ Banking Corporate Governance, gained through:
• c) $\Box$ Risk Management, gained through:
• d) Internal Control Systems and Internal Audit, gained through:
• e) □ Corporate Legal and Compliance, gained through:
• f) Financial and non-financial Disclosure, gained through:

^<sup>1 Indicate (at least) two or more of the competences held.

E-MARKET SDIR
CERTIFIED

g) □ Digital Technology, gained through:

________
h) $\Box$ Sustainability (ESG), gained through:
. 1980 - John Stoff, amerikansk politiker (d. 1980)
as well as
2) $\Box$ to possess a specific experience on legal matters and adequate knowledge of
management and management processes, gained through:
________
Date and place, ________
Signature ______

[ANNEX 4 – INFORMATION NOTICE ON THE PROCESSING OF THE PERSONAL DATA BY UNICREDIT]

The following information notice aims at providing you with an overview on the use of your personal data by UniCredit S.p.A. and of your rights pursuant to the General Data Protection Regulation - Regulation (EU) 2016/679 (hereinafter also GDPR).

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is UniCredit S.p.A., with registered office in Milan, Piazza Gae Aulenti n. 3, Tower A, 20154 Milan (UniCredit).

The Data Protection Officer (DPO) can be contacted at:

UniCredit S.p.A. Data Protection Office, Piazza Gae Aulenti n. 1, Tower B, 20154 Milano, E-mail: Group.DPO@unicredit.eu, PEC: Group.DPO@pec.unicredit.eu.

2. PURPOSE AND LEGAL BASIS OF PROCESSING

UniCredit processes the personal data in its possession, that is collected directly from you, or from the relevant local administrations to verify, among others, their accuracy for the following purposes:

A. Need to fulfill legal obligations deriving from your candidacy as a Statutory Auditor of UniCredit.

These obligations imply, among others, verifying - both during the selection procedures and on an ongoing basis - the compliance with the eligibility requirements for taking on and maintaining the role of Statutory Auditor as well as of specific positions ( such as integrity requirements, criteria of correctness, professional experience requirements and competence, independence, time commitment, maximum number of offices covered, respect of the prohibition of interlocking ) as required by applicable law, by the Corporate Governance Code (i.e. Codice di Corporate Governance) as well as with social security and fiscal obligations linked to the remuneration provided.

To comply with the above-mentioned obligations, in some cases, UniCredit is required to carry out analyses that concern also your relatives² . For this reason, we kindly ask you to let them aware of this Information Notice.

These needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the obligations arising from your candidacy as a Statutory Auditor of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

B. Fulfilment of legal obligations and requests from Public and Supervisory Authorities, concerning the process, communication and/or disclosure - also during the selection procedures - on the website www.unicreditgroup.eu and/ or on specific corporate documents (e.g. Prospectus / Corporate Governance Report, Financial Statements) of your data (such as data contained in your curriculum vitae and in the list of the tasks carried out by you in other banks and commercial companies, as required by the applicable law, and according to the Articles of Association and the Corporate Governance Code).

The needs represented above are the legal basis legitimizing the related data processing. Data provided by you is necessary to comply with the legal obligations, the requests from the Authorities, as well as to take on the role of Statutory Auditor of UniCredit; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

3. CATEGORIES OF PERSONAL DATA PROCESSED

UniCredit processes personal data collected directly from you, or from third parties (e.g. relevant local administrations), which include, but are not limited to, personal data (e.g. name, surname, address, date and place of birth), banking data, information on the financial situation (e.g. patrimonial status, information on credit requests/relationships), positions held and related income, employment relationships, commercial/professional relationships

² The relatives scope is identified on the basis of the specific applicable regulations

This information may concern existing or past relationships with UniCredit as well as with Group Legal Entities or third parties.

3.1 JUDICIAL DATA

UniCredit may process judicial data (i.e. personal data relating to criminal convictions and offences or related security measures, including information on pending proceedings) referring to you, in order to verify the subjective and integrity requirements and/or conditions that prevent from being appointed as member of the Board of Statutory Auditors of UniCredit.

In such cases, the processing is necessary to fulfill legal obligations as well as to comply with requests coming from Public or Supervisory Authorities (e.g. filling the questionnaire requested by the ECB). This need represents the legal basis that legitimizes the related data processing. Data provided by you is necessary to comply with the legal obligations; without your personal data, UniCredit would not be in a position to establish a relationship with you or to comply with the law obligations.

4. RECIPIENTS OR CATEGORIES OF RECIPIENTS OF PERSONAL DATA

Your data may be communicated to the natural and legal persons that are acting as "Data Processors", listed in the UniCredit premises and on the website www.unicredit.it, as well as – in the quality of persons authorized to process personal data in relation to the data necessary for the performance of the duties they are assigned to – the natural persons belonging to the following categories: Bank employees or persons on secondment to it, temporary employees, interns, consultants and employees of external companies appointed as Data Processors .

Your data may be communicated:

• to those subjects to whom this communication must be carried out in compliance with an obligation established by law (e.g. Bank of Italy and ECB), by a regulation or by EU legislation. Further information can be found on the website www.unicredit.it in the "Privacy" section;
• to Legal Entities belonging to the UniCredit Group (also foreign Legal Entities), subsidiaries or associates under the terms of article 2359 of the Italian Civil Code, when such communication is permitted on the basis of a Garante per la Protezione dei Dati Personali's measure or by a law provision.

The detailed list of subjects to whom the data can be communicated is available on the website www.unicredit.it, in the "Privacy" section.

5. DATA TRANSFER TO THIRD COUNTRIES

UniCredit informs you that your personal data may also be transferred to the Countries outside the European Union or the European Economic Area (so called "Third Countries") if the EU Commission states that the Third Country ensures an adequate level of protection of personal data or in case of other appropriate safeguards, namely when the supplier of UniCredit located in the Third Country contractually ensures an appropriate level of personal data protection (e.g. through the signing of the standard contractual clauses provided by the European Commission), including enforceable and effective data subject rights. Further information can be requested by writing to Group.DPO@unicredit.eu.

6. DATA PROCESSING MODALITIES

The processing of personal data involves the usage of manual and IT instruments with modalities closely connected with the purposes defined above and, in any case, in such a way to guarantee the security and confidentiality of the data.

7. DATA SUBJECT' RIGHTS

GDPR grants and assures specific rights, including the right to know what data concerning you are held by UniCredit, as well as how they are used, and the right to obtain, under certain conditions, the copy, the erasure, the update, the rectification or, if interested, the integration of your data, as well as the right to data portability.

7.1 DATA RETENTION PERIOD AND RIGHT TO ERASURE

UniCredit processes and stores your personal data for all the time you keep the role of Statutory Auditor, to execute the related and connected obligations, to comply with the applicable legal, contractual and regulatory obligations, as well as for its own defensive purposes or those of third parties until the expiration of the longest mandatory retention period provided by the applicable law (i.e. 11 years) starting from the date of termination of the relationship with you. UniCredit processes and stores your personal data even after the expiry of the employment relationship when this is necessary for archiving purposes for historical research purposes, according, to the methods set out in the "Ethical rules of processing for archiving purposes in the public interest or historical research"³ .

At the end of the applicable mandatory retention period, your personal data will be erased or kept in a form which does not permit your identification (e.g. irreversible anonymization), unless the further processing is necessary for one or more of the following purposes: i) for resolution of pre-litigation and/or litigation, started before the expiration of the mandatory retention period; ii) to follow up with investigations/inspections by internal control functions and/or external authorities, started before the expiration of the mandatory retention period; iii) to follow up with requests from the Italian and/or foreign Public Authorities, received/notified to UniCredit before the expiration of the mandatory retention period.

8. PROCEDURE TO EXERCISE THE RIGHTS

The e-mail address which you can refer to for the exercise of your rights described in the paragraph 7 is the following one: corporate.law@pec.unicredit.eu.

The deadline for the reply is one (1) month, that may be extended for two (2) further months in cases of particular complexity; in these cases, UniCredit informs you about such extension within one (1) month from the receipt of the request. The exercise of rights is, in principle, free of charge.

9. COMPLAINT OR REPORTING TO THE "GARANTE PER LA PROTEZIONE DEI DATI PERSONALI"

UniCredit informs you that you have the right to lodge a complaint with, or to report to the Garante per la Protezione dei Dati Personali, or else to appeal to the Judicial Authority. The contacts of the Garante per la Protezione dei Dati Personali can be consulted on the website http://www.garanteprivacy.it

³ Record of the provisions 19 December 2018, n. 513