PRIVACY POLICY CREVAL SHAREHOLDERS THAT ARE ADDRESSEES CA ITALIA OFFER

Who is the Controller of your personal data processing?

Crédit Agricole Italia S.p.A. (hereinafter also “CA Italia”) – with Registered Office at Via Università, 1 - 43121 Parma, Italy, the Parent Company of the Crédit Agricole Italia Banking Group, which, in its capacity as the Controller of the processing of your personal data (hereinafter also the “Controller”) undertakes to protect your Personal Data, as defined below, in order to inform you, in your capacity as a shareholder of Piccolo Credito Valtellinese S.p.A.. (hereinafter also “CreVal Shareholder”) of the features of the voluntary public tender offer made by CA Italia for all CreVal shares and to give you any clarifications on that matter (hereinafter “Information Service”). In general, all the information and data of CreVal Shareholders to be processed by CA Italia in order to provide the Information Service will be processed by CA Italia in a lawful, fair and transparent manner.

What type of data will be processed?

Some of the data processed by the Controller to provide the Information Service identify or make the CreVal Shareholder identifiable and are defined as “Personal Data". The types of Personal Data that may be processed by CA Italia through the Information Services are:

• Personal data taken from the Register of CreVal Shareholders (consulted by CA Italia in its capacity as a shareholder), including: first name, last name, taxpayer identification number, residence address, date of birth and number of CreVal shares held.
• Contact details obtained from publicly accessible and general phone directories (such as “pagine bianche” or the like): phone number.
• Data directly provided by the CreVal Shareholder: any other data provided to CA Italia directly by the data subject, such as contact details other than those already held by CA Italia. Please bear in mind also that your data shall not be processed with automated means.

What are the purposes of the processing?

The Personal Data described above will be processed for the only purpose of informing the shareholders of Piccolo Credito Valtellinese S.p.A. (“CreVal Shareholders”) of the features of the voluntary public tender offer for all CreVal shares made by CA Italia and of providing any clarifications on that matter (for example having CreVal Shareholders contacted by specialist advisors of the data processors Morrow Sodali S.p.A. and Equita SIM S.p.A.). If any CreVal Shareholder denies his or her interest in receiving said Information Service, CA Italia will erase his or her Personal Data and will refrain from any other use of said Data.

What is the legal basis and optionality of processing?

The legal basis on which Crédit Agricole Italia may process your Personal Data, in accordance with the above-represented purpose, is its legitimate interest in submitting the terms and conditions of its tender offer for CreVal ordinary shares to CreVal Shareholders (Article 6(1) (f) of Regulation (EU) 679/2016).

Whom may your personal data be communicated to?

Your Personal Data may be communicated to natural persons who have been authorized by Crédit Agricole Italia to process Personal Data after signing a confidentiality agreement; parties that operate as External Data Processors, for example the Vendors Morrow Sodali S.p.A. and Equita SIM S.p.A., in charge of contact activities. Your Personal Data will not be communicated to other parties, other than as strictly necessary to purchase your shares, where the case, or in case of audits or requests made by competent Authorities.

Where do your Personal Data circulate?

CA Italia will not transfer the Personal Data outside the European Economic Area.

For how long are your personal processed?

Your Personal Data will be stored for only for the duration of the public tender offer made by CA Italia and for one hundred days thereafter; at the end of the 100 days the data will be erased.

What is the address of the Data Protection Officer (“DPO”) of the Crédit Agricole Italia Banking Group?

The DPO’s e-mail address is: dpo@credit-agricole.it

What are your rights?

As the data subject, you have the right to obtain the following from Crédit Agricole Italia, at any time:

• Access to your Personal Data (or to a copy thereof), as well as further information on the processing underway of your Personal Data; • The rectification or update of your Personal Data, if said data are incomplete or not up to date;
• The erasure of your Personal Data from CA Italia’s databases in the cases provided for by the applicable legislation in force at the relevant time;
• The right to object, on grounds relating to any particular situation you are in, at any time to processing of your personal data, pursuant to Article 6(1)(e) or (f) of the GDPR;
• Restriction of the processing of your Personal Data.

You can exercise your rights writing to the address a privacy@credit-agricole.it.

In any case, you are entitled to lodge a complaint with the competent Supervisory Authority (Garante per la Protezione dei Dati Personali, the Italian Data Protection Authority).