Version 3, in effect from 2026-11-20Version 1Version 2Version 3

Privacy Policy

Monitor is a service of 2N5 Global Enabler. The company is 2N5 TECNOLOGIA DA INFORMACAO E TELECOMUNICACOES LTDA (trade name 2N5), CNPJ 26.593.241/0001-85, with its registered office at Rua Olimpíadas, 205, 4º andar, Vila Olímpia, São Paulo - SP, CEP 04551-000, Brazil. This page has two parts:

1. 2N5 Global Enabler’s Privacy Policy, which applies to every 2N5 service.
2. Monitor, which says exactly what this service collects, why, and for how long.

Part 2 adds to Part 1. Where the two differ, Part 2 applies to Monitor.

Part 1 — 2N5 Global Enabler Privacy Policy (LGPD, GDPR, PIPEDA and CCPA/CPRA)

1. Introduction

2N5 Global Enabler is committed to protecting personal data and to transparency in the processing of information. This Privacy Policy sets out how we collect, use, share, store, and protect personal data, in compliance with:

• Lei Geral de Proteção de Dados – LGPD (Brazil)
• General Data Protection Regulation – GDPR (European Union)
• Personal Information Protection and Electronic Documents Act – PIPEDA (Canada)
• California Consumer Privacy Act / California Privacy Rights Act – CCPA/CPRA (USA – California)

By accessing our services, the data subject declares to have read, understood, and agreed to this Policy.

2. Important Definitions

For the purposes of this Policy:

• Personal Data: any information related to an identified or identifiable natural person.
• Sensitive Personal Data: racial origin, religious belief, health, biometrics, etc.
• Data Subject: the person to whom the data refers.
• Controller: the party that decides on the processing (2N5 Global Enabler).
• Operator/Processor: the party that carries out the processing on behalf of the controller.
• DPO (Data Protection Officer): responsible for the communication channel with data subjects and authorities.
• Consent: free, informed, and unambiguous expression by the data subject.

3. Personal Data Collected

3.1. Information provided directly by the data subject

• First name, last name
• Email, phone, WhatsApp
• Company, job title, and business information
• Data entered in forms, chat, or email
• Support and customer service records

3.2. Information collected automatically

• IP address (anonymized when possible)
• Browsing data, approximate geolocation, and online identifiers
• Cookies, tags, and tracking pixels
• Device and system data
• Log records, site usage, and access behavior

3.3. Information from third parties

We may receive information from:

• Analytics platforms (Google Analytics, Meta, LinkedIn)
• Marketing and CRM tools
• Business partners and integrated platforms

4. Legal Bases for Processing

2N5 Global Enabler carries out processing based on legal grounds, including:

4.1. LGPD – Bases

• Consent
• Performance of contract
• Legitimate interest
• Compliance with legal/regulatory obligation
• Regular exercise of rights

4.2. GDPR – Bases

• Consent
• Contractual necessity
• Legitimate interests (when not overriding the data subject’s rights)
• Legal obligation
• Protection of vital interests (exceptional situations)

4.3. PIPEDA – Principles

• Informed consent
• Limiting collection and retention
• Accountability and transparency
• Appropriate safeguards

4.4. CCPA/CPRA – Rights and Obligations

• Transparency
• Opt-out of sale/sharing of data
• Limiting use of sensitive data
• Prohibition of discrimination against data subjects who exercise their rights

5. Purposes of Processing

We process personal data to:

• Provide and improve services
• Customer service and technical support
• Manage accounts, integrations, and communications
• Perform contracts and business obligations
• Analytics, metrics, and operational intelligence
• Authorized marketing, remarketing, and advertising campaigns
• Prevent fraud, incidents, and suspicious activity
• Comply with legal, tax, and regulatory obligations
• Security, auditing, and internal control

We do not use personal data for exclusively automated decisions that produce significant legal effects without human intervention, except where permitted by law.

6. Sharing and International Transfer

Data may be shared with:

• Service providers (hosting, analytics, cloud computing, automation, telephony, CRM)
• 2N5 group companies
• Business partners under a confidentiality agreement
• Government authorities, when legally required

International Transfer

Data may be stored or processed on servers in Brazil, Canada, the USA, Europe, or other countries. We ensure adequate mechanisms, such as:

• Standard Contractual Clauses – SCC (EU)
• Specific contractual clauses
• Privacy policy compatible with GDPR, LGPD, PIPEDA, and CCPA
• Data Processing Agreements – DPA

7. Data Retention and Deletion

We keep data only for the period necessary for:

• Fulfillment of the purposes of this Policy
• Legal and regulatory obligations
• Defense in judicial or administrative proceedings

After this period, data is deleted or anonymized according to secure technical standards.

8. Data Subject Rights

8.1. Rights under the LGPD

• Confirmation of processing
• Access
• Correction of incomplete data
• Anonymization, blocking, or deletion
• Portability
• Information about sharing
• Revocation of consent
• Objection to processing

8.2. Rights under the GDPR

• Access
• Rectification
• Erasure (“right to be forgotten”)
• Restriction of processing
• Data portability
• Objection
• Not to be subject to automated decisions

8.3. PIPEDA Rights

• Access
• Correction
• Revocation of consent
• Transparency

8.4. CCPA/CPRA Rights

• Right to know
• Right to delete
• Right to correct
• Right to opt-out of sale/sharing
• Right to limit sensitive data use
• Non-discrimination

Rights may be exercised by contacting the DPO directly.

9. Security Measures

We use technical, administrative, and organizational measures consistent with international standards:

• Encryption at rest and in transit
• Access controls and multi-factor authentication
• Firewalls, IDS/IPS, and 24/7 monitoring
• Data Loss Prevention (DLP)
• Network segmentation
• Secure backup and redundancy
• Internal policies and periodic audits
• Employee training

10. Cookies

We use essential, analytics, functional, and marketing cookies. For more information, see our Cookie Policy.

11. Updates

This Policy may be updated periodically. The most recent version will always be available on the website.

12. Contact – Data Protection Officer (DPO)

To exercise your rights, clarify questions, or request additional information, contact:

• Data Protection Officer (DPO), 2N5 Global Enabler
• Email: privacidade@2n5.com.br
• Phone: +55 (11) 2050-1096
• Website: www.2n5global.com

Part 2 — Monitor

Monitor monitors a company’s voice circuits, data circuits and online services, and alerts the right people when one fails. It is sold to companies as a managed service, and 2N5 sets up each customer’s monitoring from the information the customer provides.

1. Who decides how data is used

If your details were given to us by your employer or another company, for example as an alert contact, that company is the controller. We will help it answer your request.

2. What we collect, why, and for how long

2.1. Booking a demo on our website

• What: your name, work email, company (optional), language, and roughly how many of each service you want monitored: voice circuits, data circuits, websites and email addresses.
• Where the request came from: the page of our website where you opened the form, the name of the site that brought you to it (for example, www.google.com, never the full address) and any campaign tags in the page’s address (utm_source, utm_medium and utm_campaign). These describe the page, not your browser or your device, and no cookie is used to get them.
• Not collected: we do not store your IP address, browser details or any tracking identifier. Your IP address is held in memory for a few minutes only, to stop abuse of the form.
• Why: to reply to you and arrange the demo, and to learn which pages and channels bring demo requests.
• Legal basis: steps taken at your request before a contract (LGPD Art. 7, V). For where the request came from, 2N5’s legitimate interest in learning which pages and channels bring requests (LGPD Art. 7, IX).
• Kept for: 12 months after our last contact with you, unless you become a customer. You can ask us to delete it sooner.

2.2. A free test call from our website

• What: the number you ask us to call, the IP address your request came from (an IPv6 address is counted by its /64 block), when you asked, and how the call ended (whether it worked and its SIP code). You confirm you are allowed to test that number.
• A greeting file you upload: held in memory only while the call runs, to compare what answers with it and score the voice quality. It is never written to disk or storage, and it is deleted when the result is shown, within minutes.
• The call’s audio: compared in memory, then discarded. Nothing is recorded, kept or played back. Every free test call first plays a recorded message saying it is an automated test, except when you tell us the number is answered by a test tone or echo service.
• Why: to place the test you asked for, and to keep free test calls from being abused: at most one request a minute and five an hour from one address, and the same number tested at most twice in 24 hours.
• Legal basis: steps taken at your request before a contract (LGPD Art. 7, V), and 2N5’s legitimate interest in preventing abuse of the free test (LGPD Art. 7, IX).
• Kept for: 24 hours, then deleted.

2.3. Your sign-in account

• What: your name, email and language; your password, stored only as a one-way hash and never in readable form; the parts of your organization you can see; when you last signed in.
• Why: to let you sign in, show you your organization’s monitoring and keep the account secure.
• Legal basis: performance of the contract with your organization (Art. 7, V) and our legitimate interest in keeping the service secure (Art. 7, IX).
• Kept for: as long as you have access. The account is deleted with your organization or at your request.

2.4. Contacts who receive alerts and reports

• What: name, role, work email, phone and WhatsApp numbers, language and the hours you do not want to be called. We also keep the messages we sent you and whether they were delivered or acknowledged.
• Why: to tell the right people when a line or service fails, and to send the reports your organization asked for.
• Legal basis: the customer’s instructions, as controller (Art. 39).
• Kept for: while your organization keeps you as a contact. Messages already sent are kept for 13 months, so that yearly service reports can show who was told and when.

2.5. Test calls

• What we keep: the number called, the call’s technical record (signalling, timings and result codes), the verdict and the measured quality.
• Before a person can hear it: a call that may reach a person first plays a recorded message saying it is an automated test.
• We never keep the voice of a person who answers. Audio is kept only when the call is answered by the recording or automated menu (IVR) the customer told us to expect, and only to prove the line works and to measure its quality. If anything else answers, including a person, the audio is destroyed when the call ends and only the result is kept.
• Kept audio: stored encrypted and deleted after 90 days, or the shorter period the customer sets.
• Legal basis: the customer’s instructions, as controller (Art. 39).
• Kept for: technical call records 90 days; verdicts and quality figures for the length of the contract, so that service reports and yearly figures are complete.

2.6. Data-circuit monitoring agent

At the customer’s written request, 2N5 installs a small agent on a computer at the customer’s site.

• What it sends: the computer’s name, operating system and agent version; the computer’s local IP address, the router’s address and the public IP the measurements come from; network measurements such as latency, loss, jitter, DNS time and speed; processor and memory use.
• What it never collects: files, browsing, traffic contents, user names, programs, Wi-Fi names or other devices on the network.
• Legal basis: the customer’s instructions (Art. 39).
• Kept for: 13 months.

2.7. Website and email checks

• Website checks visit only public addresses the customer gives us.
• Website content checks, when the customer switches them on, read the public page’s text, its structure and the addresses and fingerprints of its scripts, to tell the customer when the page changes, loses something it must show, shows an error or carries code it did not have. The page’s own HTML is never stored. Its text may name people the page itself names. The reference text is kept while the website is checked; the text of a page that changed is kept for 93 days after it was last seen, so the change can be shown and accepted.
• Email checks send one test message an hour to a test mailbox the customer creates for the purpose. They read only the headers of our own test message, to see whether and where it arrived, then delete it. No other message in that mailbox is read.
• Legal basis: the customer’s instructions (Art. 39).
• Kept for: results for the length of the contract.

2.8. Access and security records

• What: for each request, the IP address, date and time, and what was requested; for each sign-in, whether it succeeded; a record of changes made in the service: who did what, and when.
• Legal basis: legal obligation under Marco Civil da Internet Art. 15 (Art. 7, II) and legitimate interest in security (Art. 7, IX).
• Kept for: access records 6 months, or longer only when an authority or court orders it; the record of changes for the length of the contract.

3. Cookies and storage in your browser

Part 1’s analytics, functional and marketing cookies are not used in Monitor. It has no analytics, no advertising, no tracking pixels, no third-party cookies, and loads nothing from other websites, so it does not ask you to accept cookies. It stores only what it needs to work:

Cookies and browser storage

You can delete these in your browser settings. Without vcia_session you cannot stay signed in.

4. Who we share data with

We do not sell personal data and do not use it for advertising. We share it only with:

• Service providers that run Monitor for us: hosting and cloud infrastructure, email delivery, text-message and voice-call alerts, and the telephone carriers that carry the test calls. Each is bound by contract to use the data only for this purpose and to protect it.
• The customer’s own email provider, when the customer connects a mailbox to send email or to run an email check.
• The customer company that the monitoring data belongs to.
• Public authorities, when a law or a court order requires it.

Some of these providers store or process data outside Brazil, including in the United States. We make these transfers under LGPD Art. 33, using the standard contractual clauses approved by the ANPD or another mechanism the ANPD allows.

5. How we protect data

• All traffic to the service is encrypted, and browsers are told to use encryption every time.
• Call audio, recordings, stored passwords for connected services, and signing keys are each encrypted in the database. The key that encrypts them is never kept on the server’s disk.
• Every organization’s data is kept separate, and a manager sees only the parts of their organization they were given.
• 2N5’s administrators sign in with two-step verification. Every manager can turn it on, and an organization can require it of all its managers.
• Repeated failed sign-ins pause sign-in for that address, and its owner is told by email. Changing a password signs out every other session.
• Administrative access to the servers is possible only over a private network. Daily backups are kept for 14 days.

If a security incident may cause relevant risk or harm, we will tell the ANPD and the people affected within 3 working days of learning that personal data was affected. For data we hold for a customer, we will tell that customer without delay.

6. Decisions made automatically

Monitor decides automatically whether a line, link, website or mailbox is working. It does not make automated decisions about people. You may still ask for a decision based only on automated processing to be reviewed (LGPD Art. 20).

7. Children

Monitor is a service for companies. It is not meant for anyone under 18, and we do not knowingly collect their data.

8. Your rights

You have the rights in Part 1, section 8. How to use them with Monitor, and how long we take to answer, is on our LGPD page. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd.

9. Changes

When this page changes in a way that matters, we publish the new version here with its date and tell signed-in users at least 30 days before it takes effect. Earlier versions stay available at their own address.

10. Contact

Write to the Encarregado / DPO of 2N5 Global Enabler, Cláudio Longo Dacome Jr, at privacidade@2n5.com.br, or call +55 (11) 2050-1096.