AmbientQA - Clients, Prospective Clients and Business Partners
Effective date: 17 September 2026
This Privacy Notice explains what personal data SKILLO EOOD collects and processes in connection with AmbientQA, why and how we use that data, the legal bases on which we rely, who may receive the data, how long we retain it, and the rights available to you under applicable data protection law.
AmbientQA is an AI-powered autonomous testing and quality assurance product developed and offered by SKILLO EOOD. “AmbientQA” is the product and brand name and is not a separate legal entity.
This Notice is intended primarily for prospective and existing clients, client representatives and users, business partners, suppliers, professional contacts, and individuals who contact us about AmbientQA. It should be read together with the AmbientQA Privacy Policy and, where applicable, the relevant contract and Data Processing Agreement (“DPA”).
1. WHO ARE WE?
SKILLO EOOD is a limited liability company incorporated under the laws of the Republic of Bulgaria and registered in the Bulgarian Commercial Register with UIC 205082213 (“SKILLO”, “we”, “us” or “our”). SKILLO develops and provides software engineering, quality assurance and related technology services and products, including AmbientQA.
For the processing described in this Notice, SKILLO generally acts as the data controller when it determines why and how personal data relating to business contacts, website enquiries, demo requests, commercial relationships and its own business operations is processed.
When AmbientQA processes personal data contained in a customer’s software environment, repositories, testing systems, requirements, documentation, issue trackers, CI/CD tools or other customer-authorised integrations on the customer’s behalf, SKILLO may act as a data processor. In that situation, the customer remains responsible for determining the purposes and legal basis of the processing, and the processing is governed by the applicable DPA and customer instructions.
2. SKILLO CONTACT DETAILS
• Legal entity: SKILLO EOOD, UIC 205082213
• Address: 111 Tsarigradsko Shose Blvd, Sofia 1784, Bulgaria, Incubator @ Sofia Tech Park
• Phone: +359 898 23 52 53
• Email for AmbientQA and privacy enquiries: business@skillo.bg
• Website: https://ambientqa.com
SKILLO has not appointed a Data Protection Officer where such appointment is not mandatory under applicable law. Questions about this Notice or the processing of your personal data may be sent to the contact details above.
3. MAIN PRINCIPLES WE FOLLOW WHEN PROCESSING PERSONAL DATA
We recognise our responsibility to handle personal data securely and transparently. In particular, we aim to:
• process personal data lawfully, fairly and transparently;
• collect personal data for specified, explicit and legitimate purposes and not use it incompatibly with those purposes;
• collect only personal data that is adequate, relevant and limited to what is necessary;
• keep personal data accurate and, where necessary, up to date;
• retain personal data only for as long as necessary or required by law;
• protect personal data using appropriate technical and organisational measures; and
• respect and facilitate the exercise of data subject rights under the GDPR.
4. WHAT IS PERSONAL DATA?
Under the General Data Protection Regulation (EU) 2016/679 (“GDPR”), personal data means any information relating to an identified or identifiable natural person. This may include, for example, a person’s name, business contact details, online identifiers, IP address, identification data or other information that can directly or indirectly identify that person.
5. WHAT PERSONAL DATA DO WE COLLECT AND PROCESS?
Depending on how you interact with AmbientQA and SKILLO, we may process some or all of the following categories of personal data.
5.1 Business identity and contact data
• name and surname;
• company, organisation and professional role or job title;
• work email address, business phone number and business correspondence details;
• professional information that you provide to us or that is reasonably available from public business sources.
5.2 Website enquiries and demo requests
When you contact us through the AmbientQA website, the contact form currently asks for:
• name;
• work email address;
• company;
• company website (optional); and
• message or other information you choose to provide (optional).
If you book a demo or meeting, including through our scheduling provider, we may also process scheduling details, meeting information, time zone, contact details and information you choose to provide in connection with the booking or subsequent correspondence.
5.3 Client, partner and contractual information
• information relating to negotiations, proposals, orders, contracts, DPAs and other commercial arrangements;
• communications and history relating to the business relationship;
• billing, invoicing and payment-related information where relevant, including bank account or payment information associated with agreed payments;
• identification or authority information where reasonably required to verify a representative’s identity or authority to act for an organisation;
• support requests, service communications and other information necessary to manage the commercial relationship.
5.4 Technical and website usage data
When you use our website or related online services, we or our service providers may process technical data such as IP address, browser and device information, operating system, date and time of access, pages or resources requested, referral information, and cookie or similar technology identifiers where applicable. Non-essential cookies or similar technologies are used only where required consent has been obtained.
5.5 Customer-provided product data
Depending on the deployment model and integrations selected by a customer, AmbientQA may be given access to software testing and engineering context such as application functionality, test cases, user stories, requirements, documentation, source repositories, issue tracker information, CI/CD data, execution logs and other project materials. Such materials may incidentally contain personal data.
Where this information is processed on behalf of a customer through AmbientQA, SKILLO generally acts as a processor and processes it only in accordance with the customer’s documented instructions, the applicable DPA and agreed security arrangements. This Notice does not replace those customer-specific terms.
Please do not submit special categories of personal data or other sensitive information through the public AmbientQA contact form unless it is strictly necessary and you have a lawful basis to do so.
6. WHERE DO WE OBTAIN PERSONAL DATA FROM?
We may obtain personal data from:
• you directly, including through website forms, email, meetings, contracts and support communications;
• your employer, company or another organisation that you represent;
• scheduling, communications or other service providers that you choose to use to contact or meet with us;
• publicly available professional sources, company websites, public registers and professional networks, where relevant and lawful;
• our website and technical systems through logs, cookies and similar technologies, where applicable; and
• customer-authorised systems and integrations when AmbientQA is used as part of a customer’s engineering and QA environment.
7. PURPOSES AND LEGAL BASES FOR PROCESSING
We process personal data only where we have a valid legal basis. Depending on the circumstances, the purposes and legal bases may include:
7.1 Taking steps before entering into a contract and performing a contract
We process information necessary to respond to requests, discuss product fit, organise demos, prepare proposals, negotiate terms, onboard customers or partners, provide AmbientQA and related services, administer accounts and support the ongoing commercial relationship. The legal basis is Article 6(1)(b) GDPR where the individual is a party to the contract and, for business contacts acting for an organisation, our legitimate interests under Article 6(1)(f) GDPR in managing the business relationship.
7.2 Legitimate interests
Where appropriate, we rely on our legitimate interests under Article 6(1)(f) GDPR, including to:
• manage relationships with clients, prospects, partners, suppliers and their representatives;
• respond to enquiries and maintain relevant business correspondence;
• operate, secure, troubleshoot and improve our website, systems and services;
• prevent misuse, fraud, security incidents and other unlawful activity;
• maintain records necessary for business continuity, audit and internal administration;
• establish, exercise or defend legal claims; and
• send relevant B2B communications about AmbientQA or related SKILLO services where permitted by applicable law.
Where processing is based on legitimate interests, we consider the nature of the data, the reasonable expectations of the individuals concerned and the potential impact on their rights and freedoms.
7.3 Legal obligations
We process personal data where necessary to comply with legal obligations applicable to SKILLO, including accounting, tax, commercial, regulatory, information-security and lawful authority requirements. The legal basis is Article 6(1)(c) GDPR.
7.4 Consent
Where applicable law requires consent, for example for certain non-essential cookies or marketing activities, we process the relevant data on the basis of Article 6(1)(a) GDPR. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
8. IS PROVIDING PERSONAL DATA MANDATORY?
In general, providing personal data to us is voluntary. However, some information may be necessary to respond to your request, arrange a demo, conclude or perform a contract, provide access to a service, process a payment, comply with a legal obligation or verify that a person is authorised to act for an organisation. If required information is not provided, we may be unable to take the requested steps or provide the relevant product or service.
9. WHO MAY RECEIVE YOUR PERSONAL DATA?
We do not disclose personal data to third parties without a lawful basis. Where necessary for the purposes described above, personal data may be shared with the following categories of recipients, subject to appropriate contractual, confidentiality and security safeguards:
• authorised SKILLO employees and contractors who need access for their duties;
• hosting, cloud infrastructure, IT, cybersecurity, communications and technical service providers;
• scheduling and meeting service providers, including Calendly where you use the AmbientQA demo-booking flow;
• email, CRM, customer-support, analytics and website service providers where applicable;
• accounting, legal, audit, insurance and other professional advisers;
• banks and payment service providers where necessary for agreed payments;
• business partners or subcontractors where necessary to deliver agreed services and where appropriate data protection arrangements are in place;
• competent public authorities, courts, regulators or other bodies where disclosure is required or permitted by law; and
• a purchaser, investor or successor entity in connection with a corporate transaction, subject to appropriate confidentiality and legal safeguards.
Where a service provider processes personal data on our behalf, we require appropriate data protection terms in accordance with Article 28 GDPR where applicable.
10. INTERNATIONAL DATA TRANSFERS
Some service providers or product configurations may involve access to or transfer of personal data outside the European Economic Area (“EEA”). Where this occurs, SKILLO applies the safeguards required by Chapter V of the GDPR. Depending on the circumstances, these may include an adequacy decision adopted by the European Commission, the European Commission’s Standard Contractual Clauses, binding corporate rules or another lawful transfer mechanism.
Where relevant, we also assess whether supplementary technical, contractual or organisational measures are appropriate for the particular transfer. Information about the applicable safeguards may be requested using the contact details in this Notice.
11. DATA RETENTION
We retain personal data only for as long as necessary for the purpose for which it was collected and for any additional period required or permitted by applicable law. The relevant retention period depends on the type of relationship and information involved.
• enquiry and demo information is retained for a reasonable period necessary to respond, follow up and manage the prospective business relationship;
• client and partner correspondence and contractual records are retained for the duration of the relationship and afterwards for periods necessary for legal, audit, accounting and claims purposes;
• accounting and tax records are retained for the statutory periods applicable under Bulgarian law, which may in certain cases be up to 10 years;
• records required for establishing, exercising or defending legal claims may be retained until the relevant limitation periods have expired; and
• technical and security logs are retained according to their operational and security purpose and applicable retention schedules.
When personal data is no longer required, we delete, anonymise or otherwise securely dispose of it in accordance with our applicable retention and destruction rules.
12. SECURITY OF PERSONAL DATA
SKILLO applies appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Measures are selected according to the nature, scope, context and risks of the processing and may include access controls, authentication measures, secure configuration, encryption where appropriate, logging, confidentiality obligations, backups, incident management and supplier controls.
13. AI PROCESSING AND AUTOMATED DECISION-MAKING
AmbientQA uses AI to analyse software and testing context, identify testing needs, generate or improve tests, execute testing workflows, analyse failures and adapt testing as software changes. This product functionality is directed at software quality assurance and is not intended, in SKILLO’s role as controller of client and business-contact data, to make decisions about individuals that produce legal effects or similarly significantly affect them solely by automated means.
If a customer uses AmbientQA in a way that involves personal data within its own software or project context, the customer is responsible for determining the lawful basis, transparency obligations and any other data-protection requirements applicable to that use. SKILLO processes such customer data in accordance with the agreed DPA where SKILLO acts as processor.
14. YOUR RIGHTS AS A DATA SUBJECT
Subject to the conditions and limitations set out in the GDPR and applicable law, you may have the following rights:
Right of access
You may request confirmation as to whether we process your personal data and, where applicable, access to that data and related information, including a copy of the personal data being processed.
Right to rectification
You may request correction of inaccurate personal data and completion of incomplete personal data.
Right to deletion
You may request deletion of your personal data where one of the grounds under Article 17 GDPR applies, for example where the data is no longer necessary for the purpose for which it was collected, consent has been withdrawn and no other legal basis applies, or the data has been unlawfully processed. The right is subject to statutory exceptions, including where retention is required by law or necessary for legal claims.
Right to restriction of processing
You may request restriction of processing in the circumstances set out in Article 18 GDPR, including while the accuracy of data or an objection to processing is being verified.
Right to data portability
Where processing is based on consent or contract and carried out by automated means, you may have the right to receive personal data you provided to us in a structured, commonly used and machine-readable format and, where technically feasible, to have it transmitted to another controller.
Right to object
Where we process personal data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is necessary for legal claims. You may object to direct marketing at any time; where you do so, the relevant data will no longer be processed for that purpose.
Withdrawal of consent
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Rights relating to solely automated decisions
Where Article 22 GDPR applies, you have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning you or similarly significantly affects you, subject to the exceptions and safeguards provided by law.
15. RIGHT TO LODGE A COMPLAINT
If you believe that your personal data has been processed unlawfully, you may contact us first so that we can review the matter. You also have the right to lodge a complaint with the competent supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (“CPDP”):
• Address: 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria
• Email: kzld@cpdp.bg
• Website: https://cpdp.bg
16. HOW CAN I EXERCISE MY RIGHTS?
You may submit a request using the SKILLO contact details in Section 2. We may ask for information reasonably necessary to verify your identity and understand the scope of your request. We will respond within the time limits provided by the GDPR, subject to any permitted extension for complex or multiple requests.
17. RELATIONSHIP WITH THE AMBIENTQA PRIVACY POLICY AND CUSTOMER DPA
This Notice provides additional transparency for clients, prospective clients, business partners and professional contacts. It should be read together with the public AmbientQA Privacy Policy. Where AmbientQA processes personal data on behalf of a customer, the applicable DPA, service agreement and customer instructions govern that processing and take precedence for the customer-specific processing relationship.
18. CHANGES TO THIS PRIVACY NOTICE
We may update this Privacy Notice when our processing activities, product, service providers or legal requirements change. The current version will identify its effective date. Material changes will be communicated through appropriate channels where required by law.
This Privacy Notice is issued by SKILLO EOOD in accordance with its personal data protection framework and applicable European Union and Bulgarian data protection law.