DecaLeap
עב Start free
Legal

Privacy Policy

Last updated: 04/11/2026

This page explains what data ESK Marketing Services Ltd collects through the DecaLeap website and through the system itself, why, and what your rights are. We wear two different hats here, so there are two parts: what we collect about you, and what we process on your behalf about your own customers.

1. What we collect about you

  • Contact details you gave us on a contact form or at sign-up: name, company, email, phone.
  • Account details: full name, email address, role and permissions for each user.
  • Billing data: company name, company number, address and invoice history. Card details never pass through us, are never stored on our servers and are never seen by us - card payments are processed by a licensed external payment provider; card details never pass through or remain on our servers.
  • Usage logs: IP address, browser type, sign-in times and sign-in attempts, and sensitive actions in the system.

2. Why we use it

  • To provide the service, support it and bill for it.
  • To secure it - detecting intrusion attempts, blocking abuse and investigating incidents.
  • To contact you about operational matters (an incident, a renewal, a material change). Marketing email is sent only with consent, and always with an unsubscribe.

3. Data you enter about your own customers

For the data you put into the system, you are the controller and we are a processor acting on your instructions alone. We do not access it except for support you asked for, for maintenance, or where the law requires it.

Each customer sits on a separate database and a separate process. Backup, restore and deletion are operations on your data alone.

4. Cookies and visit measurement

The site keeps in your browser what it needs to work: your language, your sign-in to the system and basic protection for forms.

Visit measurement starts after you accept in the notice that appears on your first visit. A random identifier is then kept in your browser, and we record the pages viewed, where you came from (a referring site or campaign parameters in the address) and when. Your network address is kept in a scrambled form. This helps us understand which pages and campaigns help you. If you leave your details in a form, the visits are linked to your enquiry. The data is kept for 13 months. You can stop at any time by clearing the site data in your browser, and ask for deletion at the address below.

5. Security

Data sits in a database that is not exposed to the open internet. Access is limited to ESK Marketing Services Ltd staff, over an SSH key with two-factor authentication where required, and every sensitive action is logged.

Traffic is encrypted end to end - the site and the system run over HTTPS only. Backups are encrypted too, and copied off the server.

6. Sub-processors

To run the service we rely on an external hosting provider, an external payment provider, an email service for sending messages and system notifications, and an external AI model service that runs the free tier of the built-in AI assistant. That service receives the questions, the records the assistant reads to answer them, and the user's name and company name, and may keep them and use them to improve its models; your administrator can switch the assistant off in the settings. Their details are available on request at the address below.

On the payment page we check the country of your connection from the IP address, so that the country chosen for billing and VAT matches reality. The check runs against a database held on our own server (IP Geolocation by DB-IP, licence CC BY 4.0), with no call to an outside party. The order keeps the country code and the time of the check only; the IP address itself is not kept.

7. Where data is stored

Data is stored on the service's own servers, in a separate database per customer. Backups run daily, encrypted, and are copied off the server.

The system sends messages and documents to your customers and suppliers, and sends you system notifications: team invites, password resets and notices to your team.

8. How long we keep it

Account data is kept while the account is active. After the engagement ends we keep it for 90 days so the account can be restored or reactivated, and then the live account is deleted.

A student or staff card uploaded for an academic purchase is used to check eligibility and is kept in the customer file until a newer card replaces it. Staff who may view the customer details can see it.

On backups we are precise rather than generous: encrypted backup copies fall out of rotation within the retention set for you, seven days by default. A copy caught in the monthly archive is destroyed with that archive, at the end of the period the law requires it to be held.

Invoices and accounting records are the exception: they are kept for seven years under the statutory bookkeeping archive requirement, even after a deletion request, and cannot be waived.

9. Your rights

For privacy enquiries: info@decaleap.com. We answer within a reasonable time, and in any case within the period the law sets.

  • The right to see the data we hold about you.
  • The right to have inaccurate data corrected.
  • The right to erasure - subject to the mandatory retention set out above.
  • The right to a copy in a structured, usable format (Excel or CSV). Self-service export is open to you from every list screen at any time, without asking us.
  • The right to object to marketing email and to unsubscribe from any message.

10. Security incidents

If a security incident affects your data we will tell you without undue delay - what we know, what we did, and what we recommend you do.

ESK Marketing Services Ltd, company no. 516791738 · 5 Haasis St, Rishon LeZion 7549316 · info@decaleap.com