The CloudAlly Data Processing Agreement (DPA) attached here specifically addresses how CloudAlly handles GDPR & PII.
You can also find more information about CloudAlly security here: https://uploads-ssl.webflow.com/6192d00bee4334aae1d1ab97/63ee2e34cff3088cb12f959f_Security%20Overview%20ConstantEdge.pdf