SDR SRL

Via Giovanni Prati 2

Milano 20145
PIVA: 07999780963

via e-mail:
Sayyam Kamran
House no. 26-S-35 New Mozang, Samanabad, Lahore
Punjab, Pakistan.

Milan, 09​/24/2019
​SERVICE AGREEMENT
AND APPOINTMENT OF SUB-DATA CONTROLLER
ARTICLE 28 REGULATION (EU) 2016/679

between ​SDR S.R.L​., VAT No. ​07999780963​, with registered office in Via Giovanni Prati 2,
20145 Milan, Italy, in the person of its present legal representative, ("Contractor" and / or "Data
Processor”)
and
Sayyam Kamran​, in the person of its present legal representative, tel +923224176790,
e-mail: sayyamkamran86@gmail.com with registered office in Pakistan Address House no.
26-S-35 New Mozang, Samanabad, Lahore, Punjab ("Supplier" and / or " Sub Data
Processor”)

Contractor and Supplier, jointly, the Parties

provided that
- the Contractor provides Instagram profile management services ("Services") on behalf of
its clients;
- the Services provided to its clients may consist of: ​increase of brand awareness and target
follower acquisition through the creation of sponsored Instagram Stories; reporting the results
of the activities carried out; increasing profile engagement;
- the Contractor intends to entrust the execution of some of the Services to the Supplier;
- in execution of the agreement with the Contractor ("Contract"), the Supplier will carry
out, as Sub Data Processor, processing operations of personal data entrusted by the client
("Data Controller") to the Contractor as Data Processor;
- the Data Controller has authorized the Data Processor to appoint a Sub Data Processor;
 - the Sub Data Controller guarantees that it possesses the requisites of experience, ability
and reliability necessary to provide sufficient guarantees to put in place adequate technical and
organizational measures to guarantee compliance with the current provisions on the protection of
personal data, including the profile relating to the security of the data itself and the protection of
the rights of the data subject;
- the Supplier has expressed its availability to take on the role of "Sub Data Processor",
pursuant to art. 28 Regulation (EU) 2016/679 (hereinafter, "GDPR"), and to carry out processing
operations in accordance with the instructions given by the Data Processor;
- the Data Processor is established in the European Union while the Sub Data Processor is
established ​in a non-member state (EU);
- the transfer of personal data from the Data Processor to the Sub Data Processor will take
place in compliance with the standard contractual clauses, as per the annex to the European
Commission decision of February 5, 2010 no. 2010/87 / EU, which are an integral and
essential part of this contract, and are attached as ​Annex no. 1​;
- in execution of the Agreement the Sub Data Processor will receive communication of, or
may become aware of, the following types of personal data: ​common data, identification of
the interested parties (images concerning individuals, names and contact details of project
representatives, nicknames and usernames of users who interact with the customer's Instagram
page;
- the data will belong to the following categories of interested parties: ​subjects (clients /
collaborators) with whom the Data Controller has a contractual relationship.

***

Provided all this​, the Parties agree and stipulate the following.

1.​ ​Premises and attachments

1.1.​ The premises and attachments are an integral and essential part of this Agreement. The
parties confirm the truthfulness and essentiality, also for the purpose of interpreting this
Agreement, of what is stated in the premises.
1.2.​ This Agreement replaces any previous agreement between the Parties contained in any
oral or written agreements relating to the execution of this Agreement.
1.3​. If one or more clauses of the present Agreement are annulled or if they are rendered
inapplicable by the effect of the law or by a decision that is imposed on the Parties, this will
not have the effect of annulling the whole Agreement, nor alter the validity and mandatory
nature of all the other clauses. The parties will agree to make the amendments necessary to
this Agreement so that it can bring an effect that is as close as possible to the initial will of the
Parties.
1.4​. This Agreement may not be modified or supplemented without the consent of both Parties
and by means of a written act signed by duly authorized representatives.

​2. Object of the service agreement and appointment of the Sub Data Processor
​2.1.​ The Contractor entrusts the Supplier with the execution of the following Services: ​increase
in brand awareness and target follower acquisition by creating sponsored Instagram Stories;
reporting the results of the activities carried out; increase in profile engagement of the
Instagram account @biffiboutiques
​2.2.​ SDR s.r.l., pursuant to art. 28 of the GDPR, with reference to data processing carried out
in execution of the existing Agreement between the Parties, appoints as Sub Data Processor
Sayyam Kamran, who accepts the appointment under the conditions indicated below.
3. Fee and method of supplying Services
3.1.​ The global and all-inclusive fee for the provision of all the Services, object of this
Agreement, is equal to​ € 300,00 media budget plus € 50,00 as fee; this amount will be paid
through monthly instalments of € 350,00 (three hundreds and fifty thousand / 00) ​by bank
transfer to the current account held by the Supplier within 30 days of receipt of the
commercial invoice.
3.2.​ No further fee apart from what is agreed is due to the Supplier for the appointment and for
the activity carried out as Sub Data Processor.
3.3.​ T​he Services will be provided personally by the Supplier exclusively with its own work
and on a monthly basis ​ payment of the fee is subject to positive verification by the Contractor
of the Services performed.
3.4.​ If the Supplier does not carry the Services out to the letter according to the conditions
established by the Contractor, the latter may immediately suspend payment of the fee and set
a reasonable deadline within which the Supplier must comply with the established conditions.
3.5.​ The Supplier cannot make exceptions in order to avoid or delay the due Services.
4.​ ​Duration
4.1.​ The Agreement has a duration of ​three months​ starting from the day of signing.
4.2.​ The Parties, before the Agreement expires, will be able to evaluate the possibility of a
possible renewal.

5. Withdrawal
5.1.​ The Contractor may withdraw from the Agreement with 30 days' notice by e-mail, even if
the execution of the Services has begun.
5.2.​ The Supplier may withdraw from the Agreement only for just cause. In any case, the
Supplier will be required to complete the Services still in progress and to avoid any prejudice
for the Contractor.

6. Penalty clause
6.1.​ In the event of non-fulfillment, the Supplier must pay the Contractor, pursuant to art. 1382
of the civil code, a penalty equal to 30% of the agreed fee and, in case of delay in the fulfillment,
must pay, pursuant to art. 1382 of the civil code, a penalty of 10,00 euros for each day of delay.
The Supplier acknowledges the adequacy of the amount of each penalty.

7.​ ​Transfer of the Contract

7.1.​ SDR S.r.l. reserves the right to substitute a different legal entity in the relations arising
from the Agreement; the Supplier consents to the transfer of the Agreement. The transfer of
the Agreement will be communicated thirty days in advance by e-mail.
7.2.​ This Agreement is based on intuitus personae. It is forbidden for the Supplier to cede this
Agreement and the rights and obligations arising from it to others, in any form, or to
subcontract, even de facto, all or part of the Services commissioned with this Agreement,
without explicit written authorization from the Contractor.

8.​ ​Exclusion of liability

8.1.​ The Supplier shall be solely responsible for obtaining and retaining the ownership of any
license, authorization, qualification or concession necessary for the correct fulfillment of the
Services.
 8.2.​ The Supplier will be exclusively responsible for damages suffered by the Contractor, by
its customers or by third parties as a result of the execution of the Services by the Supplier or by
its auxiliaries or collaborators.
8.3.​ The Supplier indemnifies and holds harmless the Contractor for prejudice, cost, damage or
expense of any nature (including legal fees) that the Contractor may encounter due to inaccuracy
or non-correspondence to truth of what is declared and guaranteed in this Agreement or breach.
8.4.​ If the Contractor is called upon to respond, even jointly, to damage to persons or property
of third parties due to fact or omission deriving from the work or negligence of the Supplier or its
auxiliaries or collaborators, the Contractor will automatically be entitled to compensation from the
Supplier.
8.5.​ Some of the Services performed by the Supplier are intended to develop public interaction
with the client's Instagram profile via actions and / or expressions of thought by the public
(including, but not limited to, comments, likes, etc.) in relation to which the Contractor does not
assume any responsibility. The Supplier, therefore, indemnifies and holds harmless SDR S.r.l.
from any and all contractual and / or non-contractual liability for direct and / or indirect damages
(both with reference to the emerging damage and lost profits), suffered by the Contractor, its
clients and / or third parties as a result of the execution of the Services by the Supplier or its
auxiliaries or collaborators.
8.6.​ SDR S.r.l. assumes no responsibility if the services performed by the Supplier infringe the
Terms of Use governing the use of Instagram, accepted through the creation of an Instagram
account or by using Instagram and / or Facebook Products provided by Facebook Ireland Limited.
The Supplier therefore indemnifies and holds harmless SDR S.r.l. from any contractual and / or
non-contractual liability for direct and / or indirect damages and / or from any financial and
non-pecuniary damage caused to SDR Srl, to its clients, or to third parties, as a result of the
Services performed.
8.7.​ The Supplier therefore indemnifies and holds harmless SDR S.r.l. from any actions of any
nature undertaken by Facebook Ireland Limited (by way of example, but not limited to: blocking,
suspension, disabling, deletion, limitation of account functionality, etc.) or by any other person
even indirectly connected, , or by national and / or international supervisory authorities, as a result
of the Services performed.

9.​ ​Non-competition agreement

​9.1.​ Without prejudice to any other applicable law provision, for the duration of this
Agreement and for a period of 12 months from the expiration or termination date of the
Agreement, the Supplier undertakes not to make direct contact with the Contractor's clients on
whose behalf it will carry out the services and not to perform services similar to those covered by
the Agreement on the direct commission of the Contractor’s clients or without the Contractor's
intermediation.
9.2.​ The Supplier commits not to undertake, participate in , perform, carry out any activity as
member, administrator, employee, consultant or collaborator, directly or indirectly, against
payment or free of charge, ​for subjects that for its characteristic​s, quality and price level is or may
be in competition with the services performed by SDR Srl and with those covered by the
Agreement.
9.3.​ The Supplier expressly acknowledges that the agreed fee has been agreed and negotiated
also based on the assumption of the non-competition obligation, with the consequence that nothing
is due in addition to the fee.
9.4.​ The Parties agree from now on that in the event of a direct or indirect violation by the
Supplier of any of the obligations undertaken pursuant to this clause, the Supplier will be required
to pay the Contractor, pursuant to art. 1382 of the civil code, a sum equal to 50% of the fee,
without prejudice to the right of SDR S.r.l. to compensation for any greater damage. The Supplier
acknowledges the fairness of the penalty amount.
10.​ ​Personal data processing operations
10.1.​ Processing by computer and / or automated means will be carried out on behalf of the
Data Processor and limited only to the processing of personal data strictly necessary for the
execution of the Agreement.
10.2.​ The Sub Data Processor is not authorized to process independently, any type of
personal data communicated to him or which he has become aware of even accidentally in the
execution of the Agreement.
​10.3. ​The Sub Data Processor is obliged to observe the prohibition to communicate to
unauthorized third parties and to disclose the personal data subject to processing.

11.​ ​Obligations of the Sub Data Processor

11.1.​ The Sub Data Processor is obliged to respect the obligations set by the GDPR upheld by
the Data Processor and the instructions contained in this Agreement as well as those that will be
given in writing from time to time.
11.2.​ The Sub Data Processor - as per his responsibility - is required to guarantee the
integrity, availability and quality of the data being processed as well as the use of the
aforementioned data solely for the purposes specified in the Agreement.
11.3.​ The Sub Data Processor is required to comply at all stages of the processing with
the purposes, methods, areas of communication and any other characteristics of the
processing defined by the manager.
11.4.​ The Sub Data Processor is prohibited from transferring data to a third country or
international organization. If the transfer becomes necessary on the basis of the obligation
established by Union or national law, prior to processing, the Sub Data Processor will have to
promptly notify the Data Processor Responsible of this legal obligation.
11.5.​ The Sub Data Processor must immediately inform the Data Processor if, in his opinion,
an instruction violates the GDPR or other national or EU provisions relating to data protection.

12.​ ​Security obligations

12.1.​ Taking into account the state of the art and the costs of implementation, as well as the
nature, object and context and the purposes of the processing, as well as the risk of various
probabilities and seriousness for the rights and freedoms of individuals, the Sub Data
Processor will have to put in place adequate technical and organizational measures to
guarantee a level of security adequate to the risk, minimizing the risks of destruction or loss,
even accidental, of data, unauthorized access or unpermitted processing or processing not
compliant with the purposes of collection, in accordance with art. 32 GDPR and other
provisions in force concerning the security of personal data.
12.2.​ The Sub Data Processor must ensure the ability to promptly restore the availability of
and access to data in the event of physical or technical accident.
12.3​ The Sub Data Processor is required to promptly report to the Data Processor, within 24
hours by e-mail, the occurrence of any event that could compromise the processing of data on
behalf of the Controller and which may involve or has already entailed a risk of destruction or
loss of data, unauthorized access or processing not permitted or not in accordance with the
purposes of the collection.
13.​ ​Obligations regarding authorized persons
13.1.​ The Sub Data Processor is required to identify among his or her collaborators those
"authorized" to perform processing and to issue, in writing, the instructions relating to the
processing in accordance with the provisions of the legislation on protection of personal data.
13.2.​ The Sub Data Processor is obliged to avail himself for processing of "authorized"
personnel, qualified for the execution of the processing that guarantee the respect of the
obligations of the present Agreement, committing himself to supply to his "authorized"
personnel adequate training for this purpose.
13.3.​ The Sub Data Processor must guarantee that the persons authorized to process personal
data are committed to confidentiality or have signed an adequate confidentiality agreement.

14.​ ​Information and assistance obligations

14.1.​ The Sub Data Processor, in the execution of the Agreement, is required to promptly
notify the Data Processor of any requests for information and / or documentation, the start of
inspections made by the supervisory authority and the subsequent outcome of such activities.
14.2.​ The Sub Data Processor is obliged to provide the Data Processor with all the information
and collaboration necessary so that the latter can respond to requests made by the supervisory
authority and to satisfy the requests made by interested parties in the exercise of their rights.
14.3.​ If interested parties contact the Sub Data Processor directly, it must immediately inform
the Data Processor and agree with it on the response to be provided to the persons concerned.

15. Checks
15.1.​ The Data Processor has the right to carry out, with seven working days' notice to the
Sub Data Processor, periodic checks and tests on the Sub Data Processor to ensure the
timely compliance with the rules on the protection of personal data and the obligations set
forth in this Agreement.

16.​ ​Duration of appointment and obligations in the event of termination of treatment

16.1​. This appointment Agreement, pursuant to art. 28 GDPR, has a duration equal to the
Agreement stipulated between the Parties and will be considered terminated in the event of
dissolution, for whatever reason, of the Agreement.
16.2.​ At the end of the provision of Services related to processing or in the event of
termination of the Agreement stipulated between the parties, the Sub Data Processor must
arrange for:
• at the choice of the Data Processor, the cancellation or return of all personal data subject to
processing;
• and the cancellation of existing copies, unless the law of the Union or of the Member States
provides for the retention of data;
• and to make available to the Data Processor all the information necessary to demonstrate
compliance with the obligations referred to in the GDPR and to allow and contribute to the
review activities, including inspections, carried out by the Data Processor or another person
appointed by it.
16.3.​ In any case, the Sub Data Processor must issue, together with the return / destruction /
cancellation of the data, a written declaration that the same Sub Data Processor no longer has
any copy of the data subject of the processing

​17. Duty of confidentiality and secrecy

17.1.​ The Sub Data Processor has the obligation to ensure the respect of confidentiality also
by any personnel "authorized" for processing by having a confidentiality agreement signed by
employees, collaborators and / or temporary personnel of the Sub Data Processor.
 17.2​ Any confidential information, qualified in writing as such, or, if communicated
verbally, by telephone or by e-mail, subsequently confirmed in writing as such, whether it be
communicated by one party to the other in relation to or in implementation of this Agreement,
must be and remain confidential and classified in accordance with the provisions of this article
for the entire duration of this Agreement and for a further period of 1 year. The Supplier
undertakes from now on to keep secret and hold any information relating to the client of the
Contractor and his business strictly confidential.
17.3​. The Supplier undertakes to impose similar secrecy obligations on all its collaborators,
including external ones. The Supplier undertakes not to reproduce, use on its own or through
third parties, or otherwise exploit confidential information, logos, trademarks or patents of the
Contractor or its clients, except as expressly and previously agreed in writing between the
Parties.
17.4.​ In case of violation of the obligation of confidentiality and / or secrecy, the Supplier
will be required to pay the Contractor, pursuant to art. 1382 of the civil code, a sum equal to
50% of the fee, without prejudice to the right of SDR S.r.l. to compensation for any greater
damage.

18.​ ​Governing law and competent court

18.1.​ This Agreement is subject to Italian law and must be interpreted according to the same.
18.2.​ For any dispute that may arise between the Parties in relation to this Agreement or
connected to it, including those relating to its interpretation, execution and termination, the
Court of Milan will be exclusively competent.

Attachments
1) Standard Contractual clauses in annex to the decision of the European Commission 5 February
2010 no. 2010/87/EU.

Read, confirmed and signed

Place, Milan date Septembre 24​th​ 2019

SDR S.r.l. Sayyam Kamran ​,
The legal representative The legal representative

The parties, in accordance with art. 1341, subparagraph 2 of the civil code, expressly declare their
approval of articles 3 (​Fee and method of supplying Services)​ , 5 (​Withdrawal​), 6 (​Penalty
Clause)​ , 7 (​Transfer of the Agreement)​ , 8 (​Exclusion of liability​), 9 (​Non-competition
agreement​), 17 (​Duty of confidentiality and secrecy​), 18 (​Governing law and competent
court)​ .

SDR S.r.l. Sayyam Kamran,

The legal representative The legal representative