Data Processing Agreement under the General Terms and Conditions of Cloud Automation Solutions EOOD

Preamble

This Data Processing Agreement (“DPA”) is an appendix to the Terms of Service (“Terms”) of Cloud Automation Solutions EOOD and forms an integral part thereof.

The Customer (“Controller”) engages Cloud Automation Solutions EOOD (“Processor”, “we”, “us”) to provide the Felan AI platform and related services as described in the Terms. In the course of providing these services, the Processor may process personal data on behalf of and under the instructions of the Controller.

This DPA governs the rights and obligations of the parties in relation to the processing of personal data by the Processor on behalf of the Controller, in accordance with the EU General Data Protection Regulation (GDPR) and the Bulgarian Personal Data Protection Act (PDPA).

By accepting the Terms, the Controller also accepts this DPA. The categories of personal data processed are described in Appendix 1 to this DPA.

In the event of any conflict between the Terms and this DPA, the Terms shall prevail unless the conflicting provision of this DPA is required by GDPR, in which case this DPA shall prevail to the extent necessary for GDPR compliance.

1. Definitions

Unless the context or circumstances clearly indicate otherwise, the following terms have the meanings set out below. Capitalized terms not defined here have the meanings given in the Terms.

• “Personal Data” means any information relating to an identified or identifiable natural person (“Data Subject”) as defined in GDPR Article 4(1).

• “Processing” means any operation or set of operations performed on Personal Data, including collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure, dissemination, alignment, combination, restriction, erasure, or destruction.

• “Controller” means the Customer — the legal entity that determines the purposes and means of the Processing of Personal Data and has accepted the Terms.

• “Processor” means Cloud Automation Solutions EOOD (EIK: 203094836, registered address: Bulgaria, Sofia, 1797, 131-VA str. 1B), which processes Personal Data on behalf of the Controller.

• “Sub-processor” means any third party engaged by the Processor to process Personal Data on behalf of the Controller.

• “Data Subject” means an identified or identifiable natural person whose Personal Data is processed.

• “Data Breach” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data.

• “GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation).

• “PDPA” means the Bulgarian Personal Data Protection Act.

• “Standard Contractual Clauses (SCCs)” means the standard contractual clauses for the transfer of personal data to third countries adopted by the European Commission.

• “Technical and Organizational Measures (TOMs)” means the security measures described in Appendix 2 to this DPA.

2. Parties

2.1 Controller

The Controller is the Customer — the legal entity that has registered for and uses the Felan AI service and has accepted the Terms.

2.2 Processor

The Processor is:

Company: Cloud Automation Solutions EOOD

Registration Number (EIK): 203094836

Registered Address: Bulgaria, Sofia, 1797, 131-VA str. 1B

Email: privacy@felan.ai

The Processor may engage Sub-processors under the conditions set out in Section 6 of this DPA.

3. Controller Obligations

The Controller is responsible for:

• Determining the purposes and legal bases for the Processing of Personal Data

• Ensuring that it has a valid legal basis (under GDPR Article 6) for each type of Processing it instructs the Processor to perform

• Providing documented Processing instructions to the Processor

• Ensuring that it has obtained all necessary consents, authorizations, and rights to grant the Processor access to the Personal Data

• Informing Data Subjects about the Processing of their Personal Data in accordance with GDPR Articles 13 and 14

• Responding to Data Subject requests regarding the exercise of their rights (with assistance from the Processor as described in Section 7)

• Minimizing Personal Data made available to the Service, using synthetic or anonymized data where reasonably possible, and applying appropriate safeguards before authorizing access to production data

4. Processor Obligations

The Processor undertakes to:

• Process Personal Data only on the basis of documented instructions from the Controller, unless required to process by EU or Member State law to which the Processor is subject (in which case the Processor shall inform the Controller of that legal requirement before processing, unless that law prohibits such information)

• Ensure that all personnel authorized to process Personal Data are bound by contractual and statutory obligations of confidentiality and have received appropriate training on data protection

• Implement and maintain appropriate Technical and Organizational Measures (TOMs) as described in Appendix 2 to ensure a level of security appropriate to the risk, in accordance with GDPR Article 32

• Not independently determine the purposes or means of Processing — the Processor acts solely on the Controller’s instructions

• Assist the Controller in ensuring compliance with its obligations under GDPR Articles 32 to 36 (security, breach notification, data protection impact assessments, and prior consultation)

• At the Controller’s choice, delete or return all Personal Data to the Controller after the end of the provision of services, and delete existing copies unless EU or Member State law requires retention

• Make available to the Controller all information necessary to demonstrate compliance with this DPA and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller (subject to Section 9)

5. Security Measures

5.1 General

The Processor implements and maintains appropriate Technical and Organizational Measures for the security of Personal Data processing in accordance with GDPR Article 32. The applicable measures are described in Appendix 2 to this DPA.

5.2 Updates

The Processor reserves the right to update the TOMs as technology evolves and risk profiles change, provided that the overall level of protection is not materially reduced. The Processor will inform the Controller of any significant changes to the TOMs.

5.3 Data Breach Notification

In the event of a Data Breach, the Processor will:

• Notify the Controller within 24 hours of becoming aware of the breach

• Provide all relevant information about the breach, including the nature of the breach, categories and approximate number of Data Subjects affected, and likely consequences

• Cooperate with the Controller to investigate, contain, and remedy the breach

• Implement measures to prevent future breaches

• Assist the Controller in fulfilling its breach notification obligations under GDPR Articles 33 and 34

6. Sub-processors

6.1 General Authorization

The Controller grants the Processor general authorization to engage Sub-processors for the performance of the services described in the Terms. The Processor maintains a register of Sub-processors, which is set out in Appendix 1, Section 10.

6.2 Sub-processor Obligations

The Processor ensures that:

• Each Sub-processor is bound by a written agreement imposing data protection obligations no less protective than those set out in this DPA

• The Processor is fully responsible for the performance of each Sub-processor’s obligations relating to the processing of Personal Data

• The Processor has conducted appropriate due diligence on each Sub-processor before engagement

6.3 Changes to Sub-processors

The Processor will inform the Controller of any intended changes concerning the addition or replacement of Sub-processors at least thirty (30) days in advance by email or notification in the Platform.

The Controller may object to a Sub-processor change on reasonable data protection grounds within fourteen (14) days of being notified. If the Controller objects and the parties cannot resolve the objection within thirty (30) days, either party may terminate the Agreement.

The Controller acknowledges that objecting to a specific Sub-processor may result in limited functionality or delays in the provision of the Service.

6.4 Non-EEA Sub-processors

For Sub-processors established outside the European Economic Area (EEA), the Processor guarantees the application of an appropriate transfer mechanism in accordance with GDPR Chapter V (see Section 8).

7. Data Subject Rights

7.1 Controller Responsibility

The Controller is responsible for responding to Data Subject requests for the exercise of their rights under GDPR Articles 15 to 22.

7.2 Processor Assistance

The Processor does not independently respond to Data Subject requests or complaints unless explicitly authorized by the Controller. If the Processor receives a request from a Data Subject for the exercise of their rights under GDPR Articles 15 to 22, the Processor will:

• Notify the Controller within three (3) business days of receiving the request

• Forward the request to the Controller

• Provide reasonable technical assistance to enable the Controller to respond to the request within the required timeframes

7.3 Cooperation and Costs

The parties will cooperate in good faith to fulfill Data Subject requests. If a request requires extraordinary technical actions (e.g., retrieval of archival data, complex data extraction), the Controller shall bear the reasonable costs of such actions.

8. International Data Transfers

8.1 Primary Application Processing

The primary Felan application database and configured application analytics are hosted within the European Union. AI, payment, workspace, and other Sub-processor processing may occur in the United Kingdom, United States, or other locations identified in this DPA.

8.2 AI Processing (Non-EEA Transfer)

The Controller acknowledges that the Processor may use Anthropic PBC as a managed AI Sub-processor for request interpretation, generation, analysis, and agent coordination. Anthropic is located in the United States. For Customer data sent through the managed service, the Processor ensures that:

• A Data Processing Agreement is in place with Anthropic PBC

• Standard Contractual Clauses (SCCs) are applied as the legal basis for the transfer

• Data sent to the AI provider is limited to context reasonably necessary for the requested work

• Customer data is not used for training AI models

8.3 Legal Bases for Non-EEA Transfers

For any Sub-processor established outside the European Economic Area, the Processor ensures that the transfer is based on one of the following mechanisms under GDPR Chapter V:

• An adequacy decision by the European Commission (GDPR Article 45)

• Standard Contractual Clauses approved by the European Commission (GDPR Article 46)

• Derogations for specific situations (GDPR Article 49), where applicable

The Processor conducts transfer impact assessments and applies additional Technical and Organizational Measures when necessary to ensure an equivalent level of data protection.

9. Audit Rights

9.1 Documentation

The Processor will, upon reasonable request, provide the Controller with documentation (reports, certifications, summaries of security measures) demonstrating compliance with this DPA. This documentation-based approach is the default method of demonstrating compliance.

9.2 On-site Audits

The Controller has the right to conduct on-site audits of the Processor’s compliance with this DPA, subject to the following conditions:

• The Controller must submit a written request with reasonable justification at least thirty (30) days in advance

• Audits may be conducted no more than once per calendar year, unless required by a supervisory authority or following a Data Breach

• Audits must be conducted during normal business hours (CET/CEST 09:00–18:00, Monday–Friday)

• Audits must not unreasonably interfere with the Processor’s operations

• The auditor must be bound by appropriate confidentiality obligations

• The audit is conducted at the Controller’s expense

9.3 Cooperation

The Processor will cooperate with audits and provide all necessary information and reasonable access to demonstrate compliance with this DPA and GDPR.

10. Liability

10.1 Liability Cap

Each party’s liability under this DPA is subject to the limitation of liability provisions in the Terms. The total aggregate liability of the Processor for all claims arising under this DPA shall not exceed the total amount of fees paid by the Controller in the twelve (12) months preceding the event giving rise to the liability. This limit is cumulative for all claims under this DPA.

10.2 Indemnification

The Processor will indemnify the Controller against claims arising from the Processor’s breach of this DPA, to the extent permitted by law and subject to the liability cap in Section 10.1.

10.3 Exceptions

The liability limitations in Sections 10.1 and 10.2 do not apply in the event of intent, gross negligence, or personal injury, consistent with Bulgarian law and the Terms.

11. Term and Termination

This DPA enters into force upon the Controller’s acceptance of the Terms and remains in effect for as long as the Processor processes Personal Data on behalf of the Controller. The DPA will automatically terminate when all Personal Data has been deleted or returned in accordance with Section 4.

12. Data Deletion Upon Termination

Upon termination of the Agreement:

• The Controller has a thirty (30) day grace period to export its data using the Platform’s export features

• After the grace period, the Processor will use coordinated operational procedures to delete or return Personal Data, at the Controller’s choice, without undue delay

• Permanent-deletion automation and cross-storage verification are being implemented; until verified automation is in place, deletion requires operational handling across each active storage backend

• Backup copies expire through backup rotation within a maximum of ninety (90) days after removal from active systems

• On request, the Processor will provide the Controller with the known deletion status and, once completion has been verified across the applicable systems, written confirmation of completion

• Data that the Processor is required by law to retain (e.g., financial records under Bulgarian tax law) will be retained for the legally required period and then deleted

13. Governing Law

This DPA is governed by the laws of the Republic of Bulgaria and the EU General Data Protection Regulation (GDPR). Any disputes arising from this DPA shall be resolved in accordance with the dispute resolution provisions in the Terms.

14. Contact Information

For questions about this DPA or data processing practices:

Processor: Cloud Automation Solutions EOOD

Data Protection Contact Person: Milko Slavov

Email: privacy@felan.ai

Address: Bulgaria, Sofia, 1797, 131-VA str. 1B

Appendix 1 — Processing Details

1. Subject Matter of Processing

The processing of Personal Data by the Processor on behalf of the Controller in connection with the provision of the Felan AI teammate platform and related software-delivery services, as described in the Terms.

2. Nature and Operations of Processing

The Processor performs the following processing operations:

• Collection (receiving account registration data, integration credentials)

• Storage (account data, requests, session transcripts, team knowledge, execution logs, artifacts, and AI-generated content)

• Access/retrieval (access to Controller-authorized repositories, documentation, issue trackers, communication systems, test-management systems, environments, and other integrations)

• Use (analyzing authorized context and carrying out the Controller’s software-delivery instructions using AI models and agent tools)

• Modification and disclosure (creating or updating artifacts in connected systems when instructed and permitted by the Controller)

• Transmission (sending limited relevant context to AI and infrastructure sub-processors to provide the Service)

• Deletion (upon account termination or data subject request)

3. Purposes of Processing

• Providing the Felan AI teammate service to the Controller

• Account creation and management

• AI-powered planning, implementation, review, testing, documentation, investigation, and reporting

• Authorized repository, command-line, browser, and connected-system operations

• Integration with the Controller’s development tools

• Customer support and communication

• Security monitoring and fraud prevention

• Legal compliance

4. Categories of Data Subjects

• Controller’s employees and contractors (Users of the Service)

• Controller’s customers or end users (if their data appears in repositories, documentation, integrations, conversations, environments, or generated outputs)

• Third parties mentioned in the Controller’s systems

5. Categories of Personal Data

• Contact information (names, email addresses)

• Account credentials (encrypted passwords, OAuth tokens)

• Company information (company name, EIK/registration numbers)

• User-generated content (names, emails, or other personal data appearing in repositories, documentation, issue trackers, communication systems, uploaded files, or session messages)

• Technical data (IP addresses, browser type, device information)

• Integration credentials (encrypted API keys)

• Session, agent-execution, test, and generated-artifact metadata

6. Recipients of Personal Data

Personal Data may be disclosed to:

• The Processor’s authorized personnel (on a need-to-know basis)

• Sub-processors listed in Section 10 of this Appendix

• Competent authorities where required by law

7. Start of Processing

Processing begins on the date the Controller registers an Account and accepts the Terms.

8. Retention Periods

As specified in the Privacy Policy, Section 7 (Data Retention):

9. Transfers Outside the EEA

10. Sub-processors

Appendix 2 — Technical and Organizational Measures

The Processor implements and maintains the following Technical and Organizational Measures in accordance with GDPR Article 32: