Fiera Milano : POLICY ON THE PROCESSING OF PERSONAL DATA OF CANDIDATES FOR STATUTORY AUDITORS OF FIERA MILANO S.P.A.

POLICY ON THE PROCESSING OF PERSONAL DATA OF CANDIDATES FOR STATUTORY AUDITORS OF FIERA

MILANO S.P.A.

Dear Sir/Madam,

In compliance with Articles 13 and 14 of Regulation (EU) 2016/679 - General Data Protection Regulation (GDPR),1, Fiera Milano S.p.A. (hereinafter also referred to as "Fiera Milano" or the "Company") wishes to provide you with some information on the processing of your personal data carried out, as Data Controller, in relation to your application to become a Statutory Auditor of Fiera Milano.

The personal data concerning you, contained in the declaration of acceptance of the application completed by you and in the attached documents, will be acquired and processed by our Company using partially automated methods for fulfilment of the regulatory obligations to which Fiera Milano is subject (as a company listed on the Italian regulated markets) with reference to the procedure for the election of Statutory Auditors 2, as well as for the pursuit of the Company's legitimate interests relating to the performance of the related administrative, organisational and technical activities, including any need to defend legal rights in the event of challenges or disputes.

The provision of your personal data is mandatory for the aforementioned purposes and failure to provide it, even partially, would preclude your participation in the process of electing Statutory Auditors.

For the purposes highlighted above, your data may be known by our employees authorised for processing and/or by companies appointed by us that carry out, on our behalf, as data processors, certain technical and organisational activities, such as administrative, IT and postal service companies, as well as lawyers and legal consultants. Your data may also be communicated to public authorities and bodies (such as Consob, Chamber of Commerce, etc.), where required by applicable legislation. It should also be noted that, in order to comply with the aforementioned obligations provided for by current legislation on companies listed on Italian regulated markets, your personal data (with the exception of that indicated in the identity document) will also be published on the Company's website and within the scope of the storage mechanism authorised by Borsa Italiana (Italian Stock Exchange).

Your personal data will be retained for the entire duration of the procedure for the election of the Statutory Auditors, as well as, at the end of the latter, for the time established by applicable current legislation (generally, 5 years), without prejudice to the further retention of the minutes of the Shareholders' Meeting for the purpose of historical documentation of the Company's activities.

The GDPR3 guarantees you the right to access your data at any time, to rectify and supplement it if it is inaccurate or incomplete, to erase it or restrict its processing where the conditions are met, to object to its processing for reasons related to your particular situation, as well as the right to lodge a complaint with the Data Protection Authority, if you deem it necessary for the protection of your data.

For any questions relating to the processing of personal data and the exercise of the rights indicated above, you may contact Fiera Milano S.p.A., as Data Controller, with headquarters in S.S. del Sempione 28, 2019 Rho (Milan) and registered office in Piazzale Carlo Magno 1, 20149 Milan, [e-mail], or the Data Protection Officer of Fiera Milano, at the above locations, [e-mail].

Updated March 2024

1Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation).

1. See, for example, Articles 148, paragraph 2, and 147-ter, paragraph 1-bis, of the TUF (Consolidated Finance Act) and Article 144-octies, paragraph

1. of the Issuers' Regulation no. 1999/11971

1. See Articles 15-21 of the GDPR.