"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects c

"The data subject shall have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her." However, this does not apply if: "is necessary for entering into, or performance of, a contract between the data subject and a data controller;" Cloudflare would therefore perhaps claim that this is "necessary".