PRIVACY POLICY ON CREVAL PTO FOR SHAREHOLDERS THAT ARE CRÉDIT AGRICOLE CUSTOMERS

Your privacy is important!

This is the reason why we are giving you this privacy policy supplementing the information that your received when you opened your current account, available in the “La tua Privacy” section (also “Privacy policy” section) of Crédit Agricole Italia website, in the “Informativa privacy clientela” area, where you can find all information to data subjects under Articles 13 and 14 of the GDPR which is not expressly given hereinafter.

Who is the Controller of your personal data processing?

Crédit Agricole Italia S.p.A. (hereinafter referred to also as “CA Italia”, or the “Controller”) – with Registered Office at Via Università, 1 - 43121 Parma, Italy, Parent Company of the Crédit Agricole Italia Banking Group, in its capacity as your Bank and holder of shares in Piccolo Credito Valtellinese S.p.A. (hereinafter also “CreVal Shareholder”)

What type of data will be processed?

• First name, last name, e-mail address/phone number and number of CreVal shares held;
• Personal data resulting from the CreVal shareholders' register (consulted by CA Italia as a shareholder): your role as shareholder and the number of CreVal shares you hold;
• Any other data provided to CA Italia directly by the data subject, such as contact details other than those already held by CA Italia.

Please bear in mind also that your data shall not be processed with automated means.

What are the purposes of the processing?

The Personal Data will be processed in order to inform the holders of shares in Piccolo Credito Valtellinese S.p.A. (“CreVal Shareholders”) of the features of the voluntary public tender offer for all CreVal shares made by CA Italia and to give any clarifications.

What is the legal basis and optionality of processing?

The data processing falls within the Bank – Customer relationship and, as such, the legal basis lies in the current management of accounts (e.g. “securities accounts”, etc.). Crédit Agricole Italia also pursues its legitimate interest to make its tender offer for CreVal ordinary shares (Article 6(1)(f) of Regulation (EU) 679/2016.

Whom may your personal data be communicated to?

The Personal Data will be processed by natural persons who have been authorized by Crédit Agricole Italia to process Personal Data; Vendors operating as External Data Processors (such as the Vendor Morrow Sodali S.p.A., which carries out the activity of inbound and outbound phone contacts with Customers and manages the related website). The Personal Data will not be communicated to other parties, other than as strictly necessary to pursue the set purposes and as requested by competent Authorities.

Where do your Personal Data circulate?

CA Italia will not transfer the Personal Data outside the European Economic Area.

For how long are your personal processed?

The Personal Data will be stored for the time set forth in the general information to data subjects, whereas the Vendor Morrow Sodali S.p.A. will erase them after one hundred days of the end of the Public Tender Offer.

What is the address of the Data Protection Officer (“DPO”) of the Crédit Agricole Italia Banking Group?

The DPO’s e-mail address is: dpo@credit-agricole.it

What are your rights?

As the data subject, you are entitled to exercise your rights provided for by the GDPR (e.g. access, erasure, objection, rectification, etc.) writing to privacy@credit-agricole.it. For more exhaustive information, please see the “Informativa privacy clientela”. In any case, you are entitled to lodge a complaint with the competent Supervisory Authority (Garante per la Protezione dei Dati Personali, the Italian Data Protection Authority).