Last updated: 3 October 2026
This is the business website of Eitan Schuler, presenting my services in technical due diligence and technology advisory for investors and startups. It is deliberately built to process as little personal data as possible: it sets no cookies, uses no analytics or tracking tools, embeds no third-party content, and loads all resources, including fonts, from its own servers. The information below explains the processing that does take place when you visit this site or contact me about my services, as required by the EU General Data Protection Regulation (GDPR).
1. Controller
The controller responsible for data processing on this website is:
Eitan Schuler
Trautenaustr. 8
10717 Berlin, Germany
Email: info@eitan-schuler.com
2. Hosting and server log files
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA (“Vercel”). When you visit this site, Vercel automatically processes technical information that your browser transmits, including:
- the IP address of the requesting device,
- date and time of the request,
- the requested page or resource,
- browser type and version, operating system (user agent), and
- the referring URL, where provided by the browser.
This processing is technically necessary to deliver the website, to ensure its stability and security, and to detect and defend against attacks. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and reliable operation of the website). Log data is not merged with other data sources, is not used to identify individual visitors, and is deleted or anonymised once it is no longer required for these purposes.
Vercel processes this data on my behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. Where data is transferred to the United States, the transfer is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
3. No cookies, no analytics, no tracking
This website does not set cookies, does not use web analytics, advertising, or social media plugins, and does not fingerprint or otherwise track visitors. Web fonts are self-hosted, so no request is sent to Google or any other font provider when you view this site.
4. Contact by email
This website contains no contact forms. If you contact me by email, the personal data you choose to provide (such as your name, email address, company, and the content of your message) is processed to handle your enquiry. Where your enquiry concerns a potential engagement (for example a request for a proposal or to discuss the scope of a due diligence), the legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract). For all other correspondence, the legal basis is Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries addressed to my business).
Providing this data is voluntary; without it, I cannot respond to your enquiry. Correspondence is deleted once it is concluded, unless it is subject to statutory retention obligations, in particular under German tax and commercial law (e.g. § 147 AO), which require business correspondence and records to be kept for up to ten years. In that case it is retained for the prescribed period and then deleted (legal basis: Art. 6(1)(c) GDPR).
My email is hosted by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (Microsoft 365 / Exchange Online), which processes emails on my behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. Where data is transferred to Microsoft Corporation in the United States, the transfer is based on the EU-U.S. Data Privacy Framework, under which Microsoft is certified (Art. 45 GDPR), and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
5. Clients and business partners
If you engage me, or act as a contact person for a client or business partner, I process the business contact details and communication necessary to prepare, perform, and invoice the engagement. The legal basis is Art. 6(1)(b) GDPR where you are the contracting party, and otherwise Art. 6(1)(f) GDPR (legitimate interest in communicating with the organisation you represent). Invoicing and accounting records are retained as required by tax and commercial law (Art. 6(1)(c) GDPR). Personal data is passed on only where necessary for these purposes (for example to a tax adviser bound by professional secrecy) or where required by law, such as to tax authorities. I do not sell personal data or use it for advertising.
6. Customer relationship management (HubSpot)
I use the CRM system HubSpot to organise my business contacts. Enquiries received by email, as well as contact details and correspondence relating to clients and business partners, may be recorded there, for example your name, email address, company, role, and notes on our communication. This serves to keep track of enquiries and ongoing engagements. The legal basis is Art. 6(1)(b) GDPR where the data relates to a (potential) contract with you, and otherwise Art. 6(1)(f) GDPR (legitimate interest in managing business contacts efficiently). HubSpot is not used on this website: no HubSpot tracking code, cookies, or forms are embedded here.
The provider is HubSpot Ireland Limited, 1 Sir John Rogerson’s Quay, Dublin 2, Ireland, which processes the data on my behalf as a processor under a data processing agreement pursuant to Art. 28 GDPR. The data is stored in HubSpot’s EU data centre. Where data is nevertheless accessed from or transferred to HubSpot, Inc. in the United States, the transfer is based on the EU-U.S. Data Privacy Framework, under which HubSpot is certified (Art. 45 GDPR), and additionally on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). CRM records are deleted once they are no longer needed for the business relationship or you successfully object to their processing, subject to statutory retention obligations.
7. Links to external websites
This website links to external sites, in particular to LinkedIn, where the Tech Due Diligence Playbook newsletter was originally published. Once you follow such a link, the privacy policy of the respective operator applies. No data is transferred to these providers merely by visiting this site.
8. Your rights
As a data subject, you have the right to:
- access the personal data processed about you (Art. 15 GDPR),
- rectification of inaccurate data (Art. 16 GDPR),
- erasure (Art. 17 GDPR),
- restriction of processing (Art. 18 GDPR),
- data portability (Art. 20 GDPR), and
- object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR).
To exercise any of these rights, contact info@eitan-schuler.com. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for this website is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information), Alt-Moabit 59-61, 10555 Berlin, www.datenschutz-berlin.de.
9. No automated decision-making
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this website.
10. Changes to this policy
If the way this website processes data changes (for example, if analytics or a contact form is added), this policy will be updated before those changes take effect. The date at the top of this page indicates the current version.