Legal

Privacy Policy

Last updated: 10/09/2026

This page explains what data ESK Marketing Services Ltd collects through the DecaLeap website and through the system itself, why, and what your rights are. We wear two different hats here, so there are two parts: what we collect about you, and what we process on your behalf about your own customers.

1. What we collect about you

Contact details you gave us on a contact form or at sign-up: name, company, email, phone.
Account details: full name, email address, role and permissions for each user.
Billing data: company name, company number, address and invoice history. Card details never pass through us, are never stored on our servers and are never seen by us — payment is handled by PayMe (Isracard), a regulated processor approved by the Bank of Israel and responsible for PCI-DSS compliance.
Usage logs: IP address, browser type, sign-in times and sign-in attempts, and sensitive actions in the system.

2. Why we use it

To provide the service, support it and bill for it.
To secure it — detecting intrusion attempts, blocking abuse and investigating incidents.
To contact you about operational matters (an incident, a renewal, a material change). Marketing email is sent only with consent, and always with an unsubscribe.

3. Data you enter about your own customers

For the data you put into the system, you are the controller and we are a processor acting on your instructions alone. We do not access it except for support you asked for, for maintenance, or where the law requires it.

Each customer sits on a separate database and a separate process — not a shared schema with a tenant column. Backup, restore and deletion are operations on your data alone.

4. Cookies

The site uses strictly necessary cookies only: remembering your language, keeping you signed in, and basic protection against automated form submission. We use no advertising cookies, pass no identifiers to ad networks, and run no cross-site tracking. That is also why this site has no cookie consent banner — there is nothing to ask consent for.

5. Security

Data sits in a database that is not exposed to the open internet. Access is limited to ESK Marketing Services Ltd staff, over an SSH key with two-factor authentication where required, and every sensitive action is logged.

Traffic is encrypted end to end — the site and the system run over HTTPS only, with a certificate from Let’s Encrypt. Backups are encrypted too, and copied off the server.

6. Sub-processors

To run the service we rely on two suppliers, and these are they:

Hostinger International Ltd — hosting for the server that runs the site, the application and the database.
PayMe (Isracard) — card payment processing.

7. Where data is stored

Data is stored in Frankfurt, Germany — inside the EU, which is to say inside the European Union and under the GDPR. Backups run daily, encrypted, and are copied off the server.

Mail the system sends goes out from our own server rather than through an external mailing service, so the contents of messages to your customers do not pass through a third party.

8. How long we keep it

Account data is kept while the account is active. After the engagement ends we keep it for 90 days so the account can be restored or reactivated, and then the live account is deleted.

On backups we are precise rather than generous: encrypted backup copies fall out of rotation within the retention set for you, seven days by default. A copy caught in the monthly archive is destroyed with that archive, at the end of the period the law requires it to be held.

Invoices and accounting records are the exception: they are kept for seven years under the statutory bookkeeping archive requirement, even after a deletion request, and cannot be waived.

9. Your rights

For privacy enquiries: info@decaleap.com. We answer within a reasonable time, and in any case within the period the law sets.

The right to see the data we hold about you.
The right to have inaccurate data corrected.
The right to erasure — subject to the mandatory retention set out above.
The right to a copy in a structured, usable format (Excel or CSV). Self-service export is open to you from every list screen at any time, without asking us.
The right to object to marketing email and to unsubscribe from any message.

10. Security incidents

If a security incident affects your data we will tell you without undue delay — what we know, what we did, and what we recommend you do.

ESK Marketing Services Ltd, company no. 516791738 · 5 Haasis St, Rishon LeZion 7549316, Israel · info@decaleap.com · +972-54-2400700