{"id":23926,"date":"2026-02-16T19:52:37","date_gmt":"2026-02-16T19:52:37","guid":{"rendered":"https:\/\/valoraestate.com\/security-and-privacy\/"},"modified":"2026-03-30T12:29:39","modified_gmt":"2026-03-30T12:29:39","slug":"security-and-privacy","status":"publish","type":"page","link":"https:\/\/valoraestate.com\/en\/security-and-privacy\/","title":{"rendered":"Security and Privacy"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t

Security and Privacy<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

Section 1 \u2014 Scope and Definitions<\/b><\/p>

1.1 Document Scope<\/b><\/p>

This Security & Privacy<\/b> page describes, at a general and public<\/b> level, the measures and principles applied by Valora Estate Concierge Inc.<\/b> (“VALORA<\/b>“) to protect the information and records processed within the scope of:<\/p>

  • the use of the valoraestate.com<\/b> website (“the Site<\/b>“), including contact\/quote forms and related communications;<\/li>
  • the provision of post-mortem<\/b> services (access & securing, on-site inventory, disposal\/storage, liquidation, final report);<\/li>
  • the provision of lifetime<\/b> services (living estate file: estate inventory, document index, access and key register, update plan, handover protocol).<\/li><\/ul>

    This page is intended to explain how<\/b> we approach security and privacy, without<\/b> replacing our Privacy Policy<\/b>, which specifies the categories of personal information, purposes, disclosures to third parties, retention periods, and applicable rights.<\/p>

    1.2 Applicable Framework (Summary)<\/b><\/p>

    VALORA operates in Quebec. The protection of personal information held, used, or disclosed in the course of business operations is notably governed by the Act respecting the protection of personal information in the private sector (P-39.1)<\/b> (often associated with “Bill 25” for its amendments). <\/p>

    Methodological note: security is implemented according to a logic of reasonable measures<\/b> proportionate to the sensitivity of the information and the context of use, in accordance with the framework of the Private Sector Act.<\/p>

    1.3 Definitions (for reading this page)<\/b><\/p>

    For the purposes of this page:<\/p>

    • Personal Information<\/b>: information concerning a natural person that allows them to be identified, directly or indirectly (e.g., contact details, financial information, information related to an estate file, etc.), according to the meaning recognized in Quebec law applicable to the private sector.<\/li>
    • Record<\/b>: all information (documents, photos, inventory, reports, communications) relating to a mandate entrusted to VALORA (post-mortem or living estate file).<\/li>
    • Confidentiality Incident<\/b>: an event involving, for example, unauthorized access, unauthorized use, unauthorized disclosure, or loss of personal information. The Private Sector Act provides a management framework and, in certain cases, the obligation to notify or keep a register regarding incidents. <\/li>
    • Supplier \/ Subcontractor<\/b>: third party that may provide technological or operational services (e.g., hosting, storage, signing, transport, warehousing, specialized services) within the scope of a mandate, according to applicable authorizations and the governance provided in the record.<\/li>
    • Security Measures<\/b>: administrative, physical, and technological controls designed to protect the confidentiality, integrity, and availability of information (e.g., access control, logging, backups), described here in general terms.<\/li>
    • Technological Means<\/b>: notably a website, an online form, or an application, through which personal information may be collected; the CAI emphasizes the importance of clearly written and publicly accessible policies when collection occurs through these means.<\/li><\/ul>

      Section 2 \u2014 Security Commitments (General Framework)<\/b><\/p>

      2.1 Guiding Principle: \u201cReasonable\u201d and Proportionate Measures<\/b><\/p>

      VALORA implements security measures designed to ensure the protection<\/b> of personal information collected, used, disclosed, stored, or destroyed. These measures are designed to be reasonable and proportionate<\/b>, particularly based on: <\/p>

      • the sensitivity<\/b> of the information (e.g., financial information, estate documents, photos, inventories);<\/li>
      • the purpose<\/b> of use;<\/li>
      • the quantity<\/b> and medium<\/b> (paper\/digital) of the information;<\/li>
      • the operational context (on-site, multi-stakeholder, urgency, etc.).<\/li><\/ul>

        Important: “zero risk” security does not exist. Our commitment is part of a structured and proportionate approach, focused on prevention, detection, response, and continuous improvement. <\/p>

        2.2 Governance: Responsibilities, Policies, and Internal Practices<\/b><\/p>

        VALORA frames the protection of personal information through governance policies and practices<\/b> aimed at ensuring its protection throughout its lifecycle. These policies and practices notably cover: <\/p>

        • retention<\/b> and destruction<\/b>;<\/li>
        • the roles and responsibilities<\/b> of staff members;<\/li>
        • internal mechanisms for handling complaints<\/b> related to the protection of personal information.<\/li><\/ul>

          VALORA also designates a personal information protection officer<\/b>, whose identity and contact details must be made accessible (notably via the Site, where applicable).<\/p>

          2.3 Minimization and \u201cNeed-to-Know\u201d<\/b><\/p>

          VALORA applies a discipline of minimization<\/b>: collecting and using only the information necessary to perform the mandate, while avoiding over-collection. This approach is combined with a need-to-know<\/b> principle: <\/p>

          • limited access for individuals who need to access information to perform the mandate;<\/li>
          • segmentation of information when relevant (e.g., separate access to sensitive documents);<\/li>
          • framing of internal and external communications based on role and scope.<\/li><\/ul>

            2.4 Traceability and Operational Discipline<\/b><\/p>

            In estate mandates, VALORA prioritizes a logic of traceability, notably through:<\/p>

            • logging<\/b> and registers when required by the mandate (e.g., site access, key handover);<\/li>
            • structured deliverables (exportable inventory, indexed photo album, decision log), to reduce grey areas and improve governance.<\/li><\/ul>

              This traceability aims for operational and evidentiary clarity, while remaining consistent with minimization (retaining only what is justified by the purpose of the mandate).<\/p>

              2.5 Security Culture: Awareness and Continuous Improvement<\/b><\/p>

              VALORA aims to maintain a security culture adapted to on-site realities and sensitive records, by:<\/p>

              • raising staff awareness<\/b> of best practices (confidentiality, communication prudence, document handling);<\/li>
              • reviewing and adjusting practices when risks are identified;<\/li>
              • a logic of continuous improvement (e.g., updating procedures as tools or threats evolve).<\/li><\/ul>

                Section 3 \u2014 Access Controls, Identity, and Logging<\/b><\/p>

                3.1 Principle: \u201cLeast Privilege\u201d and Separation of Roles<\/b><\/p>

                VALORA applies the principle of least privilege<\/b>: each person accesses only the information necessary to perform their tasks, for the required duration. Accesses are structured by roles<\/b> (e.g., field, coordination, administration) and adjusted according to the sensitivity of the record. <\/p>

                This approach is part of the obligation to protect personal information through reasonable security measures (particularly based on its sensitivity and context).<\/p>

                3.2 Identity Management and Authentication<\/b><\/p>

                When technological tools are used (e.g., storage, document sharing, signing, record management), VALORA prioritizes:<\/p>

                • named<\/b> identifiers (no shared accounts, where possible);<\/li>
                • enhanced authentication mechanisms (MFA<\/b>) when available and proportionate to the risk;<\/li>
                • a discipline of identifier management (creation, deletion\/deactivation, reset) to limit the risk of unauthorized access.<\/li><\/ul>

                  The exact measures vary depending on the tool and the scope of the mandate, but the logic remains: controlled, traceable, and reviewable access.<\/p>

                  3.3 Access Controls for Records and Data (Digital)<\/b><\/p>

                  VALORA structures access to records and documents according to:<\/p>

                  • rights per record<\/b> (e.g., record A \u2260 record B);<\/li>
                  • limitation of external sharing (e.g., controlled links, identified recipients);<\/li>
                  • separation, when relevant, between:
                    • operational management documents (inventory, indexed photos, reports),<\/li>
                    • highly sensitive documents (e.g., certain financial information), with restricted access.<\/li><\/ul><\/li><\/ul>

                      The objective is to avoid “implicit access” and maintain consistency between the purposes of the mandate and the access granted.<\/p>

                      3.4 Physical Access Controls (On-site) and \u201cChain of Custody\u201d<\/b><\/p>

                      On-site, VALORA applies access control practices adapted to estate mandates:<\/p>

                      • key register<\/b> (who holds what, handover\/return dates, restrictions);<\/li>
                      • access log<\/b> (who entered, when, why), when the context justifies it;<\/li>
                      • basic instructions<\/b> aimed at reducing ambiguities when multiple people are involved.<\/li><\/ul>

                        These mechanisms aim to reduce grey areas regarding access and support traceability, while remaining proportionate to the record (avoiding unnecessary over-documentation).<\/p>

                        3.5 Logging: Purpose, Minimization, and Duration<\/b><\/p>

                        When logging is implemented (depending on the tool and the record), VALORA aims for useful<\/b> logging:<\/p>

                        • to detect and understand unauthorized access or anomalies;<\/li>
                        • to support operational traceability (what was done and when).<\/li><\/ul>

                          Logs are retained based on a logic of necessity<\/b> and minimization<\/b> and should not become a disproportionate collection of information. The exact parameters (log type, duration) are adjusted based on risk, sensitivity, and context. <\/p>

                          3.6 Access Review and Withdrawal<\/b><\/p>

                          VALORA aims to:<\/p>

                          • review access when the scope changes (new milestone, new supplier, change of role);<\/li>
                          • withdraw or deactivate access when not required (end of mandate, staff change, etc.).<\/li><\/ul>

                            This discipline reduces the risks of residual access and supports overall compliance with the principle of information protection.<\/p>

                            Section 4 \u2014 Encryption, Backups, and Continuity (Realistic Level, Without Over-Promising)<\/b><\/p>

                            4.1 Principle: Protect Confidentiality, Integrity, and Availability (Proportionate)<\/b><\/p>

                            VALORA aims to protect:<\/p>

                            • confidentiality<\/b> (prevent unauthorized access),<\/li>
                            • integrity<\/b> (prevent unauthorized alteration),<\/li>
                            • availability<\/b> (maintain legitimate access when required),<\/li><\/ul>

                              through reasonable<\/b> measures proportionate to the sensitivity of the information and the context of use.<\/p>

                              4.2 Encryption: \u201cIn Transit\u201d and \u201cAt Rest\u201d When Available and Appropriate<\/b><\/p>

                              When VALORA uses technological tools (e.g., storage, sharing, record management, signing), we prioritize solutions that offer, when available<\/b>, protections such as:<\/p>

                              • in-transit<\/b> encryption (secure communications between systems),<\/li>
                              • at-rest<\/b> encryption (protection of stored data).<\/li><\/ul>

                                Important: the exact level of encryption depends on the tools chosen and the scope of the mandate. We avoid publicly disclosing precise technical parameters, while maintaining the objective of limiting information exposure and reducing the risk of unauthorized access, in accordance with the obligation to take reasonable security measures. <\/p>

                                4.3 Backups: Objective of Reasonable Recovery<\/b><\/p>

                                VALORA implements backup<\/b> mechanisms adapted to the criticality of operational information (inventories, reports, documents, and deliverables), to reduce the impacts of accidental loss or an incident.<\/p>

                                • Backups are designed to allow for reasonable recovery of information, depending on the context and the tool used.<\/li>
                                • The terms (frequency, retention, scope) are determined based on volume, sensitivity, usage, and risks.<\/li><\/ul>

                                  We avoid displaying quantified commitments (e.g., guaranteed deadlines) when this is not realistic for field operations; the objective remains proportionate resilience<\/b>.<\/p>

                                  4.4 Restoration: Pragmatic Verifications<\/b><\/p>

                                  Where applicable to the tools selected, VALORA performs pragmatic verifications<\/b> to ensure that backup and restoration mechanisms are usable (e.g., spot checks, verifications during major changes or as needed).<\/p>

                                  4.5 Business Continuity: Operational Priorities<\/b><\/p>

                                  In the event of tool unavailability or an incident, VALORA applies a proportionate<\/b> continuity logic, based on:<\/p>

                                  • prioritization of critical actions (e.g., access, inventory, deliverables required at milestone),<\/li>
                                  • use of reasonable alternative mechanisms (e.g., fallback procedures, rescheduling, limited manual consolidation),<\/li>
                                  • documentation of impacts when this affects deliverables or pace.<\/li><\/ul>

                                    This approach aligns with the obligation to protect information and manage risk reasonably within the scope of activities.<\/p>

                                    4.6 Limitations (Reality Clause)<\/b><\/p>

                                    No security measure can eliminate all risk. VALORA is committed to adopting a structured and proportionate approach and to adjusting its practices as risks or tools evolve, in compliance with the applicable framework. <\/p>

                                    Section 5 \u2014 Incident Management (Cyber\/Breach) and Register<\/b><\/p>

                                    5.1 Principle: Structured, Proportionate, Documented Response<\/b><\/p>

                                    VALORA applies an incident management<\/b> approach aimed at:<\/p>

                                    • detecting<\/b> and qualifying<\/b> the event (nature, scope, data concerned);<\/li>
                                    • containing<\/b> and limiting the impact (reasonable immediate measures);<\/li>
                                    • correcting<\/b> the cause or reducing the likelihood of recurrence;<\/li>
                                    • documenting<\/b> the incident and actions taken.<\/li><\/ul>

                                      This approach is part of the obligations of the Private Sector Act regarding confidentiality incidents<\/b> (definition, measures, keeping a register, notification when required).<\/p>

                                      5.2 Internal Process (Typical Steps)<\/b><\/p>

                                      Without claiming a heavy “enterprise” model, VALORA follows a pragmatic process:<\/p>

                                      1. Reporting and Evaluation<\/b><\/b>
                                        • receipt of a report (internal or external);<\/li>
                                        • initial evaluation (urgency, systems concerned, potentially affected data).<\/li><\/ul><\/li><\/ol>
                                          1. Containment \/ Immediate Measures<\/b><\/b><\/li><\/ol>
                                              • access limitation, account suspension, removal of a shared link, etc., as appropriate;<\/li>
                                              • measures aimed at reducing the risk of harm.<\/li><\/ul><\/li><\/ol>
                                                1. Analysis and Qualification<\/b><\/b><\/li><\/ol>
                                                    • identification of personal information concerned;<\/li>
                                                    • analysis of the probable cause (e.g., human error, unauthorized access, loss, supplier incident).<\/li><\/ul><\/li><\/ol>
                                                      1. Remediation and Prevention<\/b><\/b><\/li><\/ol>
                                                          • reasonable corrective actions (procedure, configuration, access, training, etc.);<\/li>
                                                          • adjustments to controls when relevant.<\/li><\/ul><\/li><\/ol>
                                                            1. Closure and Documentation<\/b><\/b><\/li><\/ol>
                                                                • recording in the incident register;<\/li>
                                                                • lessons learned and follow-up actions.<\/li><\/ul><\/li><\/ol>

                                                                  5.3 Confidentiality Incident Register<\/b><\/p>

                                                                  VALORA maintains a confidentiality incident register<\/b>, in accordance with applicable requirements. The register aims to keep a record of incidents and their handling, notably to support: <\/p>

                                                                  • internal traceability;<\/li>
                                                                  • compliance with the obligations of the Act;<\/li>
                                                                  • continuous improvement of practices.<\/li><\/ul>

                                                                    Note<\/b>: the register may include elements such as the date, nature of the incident, affected information (categories), measures taken, and, where applicable, notifications sent, as required by the legal framework.<\/p>

                                                                    5.4 Notification to the CAI and Individuals: When and Why<\/b><\/p>

                                                                    When a confidentiality incident presents a risk of serious harm<\/b>, the Private Sector Act provides for obligations to notify:<\/p>

                                                                    • the Commission d\u2019acc\u00e8s \u00e0 l\u2019information (CAI)<\/b>; and<\/li>
                                                                    • the person concerned<\/b>, subject to the terms provided by law (and applicable exceptions).<\/li><\/ul>

                                                                      VALORA assesses the risk taking into account, notably:<\/p>

                                                                      • the sensitivity<\/b> of the information involved;<\/li>
                                                                      • the anticipated consequences<\/b> of its use;<\/li>
                                                                      • the probability<\/b> that it will be used for harmful purposes.<\/li><\/ul>

                                                                        5.5 Mitigation Measures and Pragmatic Communications<\/b><\/p>

                                                                        Depending on the context, VALORA may implement reasonable measures to reduce the risk, for example:<\/p>

                                                                        • deactivation of access, resetting of links\/identifiers, limitation of sharing;<\/li>
                                                                        • targeted notifications to concerned individuals on prudent actions to take (without unnecessarily alarming);<\/li>
                                                                        • coordination with a technological supplier when the incident concerns them.<\/li><\/ul>

                                                                          External communications are framed to be factual<\/b> (what, when, plausible impact, measures taken) and to avoid unrealistic promises, while satisfying notification requirements when they apply.<\/p>

                                                                          5.6 \u201cIncident \/ Privacy\u201d Contact Point<\/b><\/p>

                                                                          VALORA maintains a contact point for:<\/p>

                                                                          • reporting an incident or a privacy concern;<\/li>
                                                                          • exercise rights relating to personal information.<\/li><\/ul>

                                                                            (The contact details of the officer are included in the appropriate documents, notably the Privacy Policy.)<\/p>

                                                                            Section 6 \u2014 Management of Suppliers and Subcontractors<\/b><\/p>

                                                                            6.1 Principle: Use of Suppliers, but Controlled Access<\/b><\/p>

                                                                            VALORA may use suppliers<\/b> and subcontractors<\/b> (e.g., hosting, storage, signing tools, messaging, operational services such as transport and warehousing, or specialized subcontracted services) when necessary to perform a mandate.<\/p>

                                                                            In all cases, the objective is to:<\/p>

                                                                            • limit access to personal information to the strictly necessary<\/b> (minimization);<\/li>
                                                                            • frame access and use with reasonable measures<\/b>;<\/li>
                                                                            • maintain traceability and governance consistent with the mandate.<\/li><\/ul>

                                                                              6.2 Typical Categories of Suppliers (Examples)<\/b><\/p>

                                                                              Depending on the mandates and tools selected, VALORA may use or coordinate suppliers, including:<\/p>

                                                                              • Technology<\/b>: hosting, storage and sharing, productivity tools, signing, CRM\/record management (if deployed), analytics (if activated).<\/li>
                                                                              • Field Operations:<\/b> transport, warehousing, disposal and processing of goods (depending on channels), as well as ad hoc services.<\/li>
                                                                              • Specialized Services<\/b>: e.g., Preparation of tax returns by subcontract (in accordance with defined mandates and scope). <\/li><\/ul>

                                                                                These examples are not exhaustive. The suppliers actually used depend on the mandate and operational choices. <\/p>

                                                                                6.3 Contractual Framework and Supplier Obligations<\/b><\/p>

                                                                                When VALORA entrusts<\/b> a third party with the mandate to collect, store, use, or disclose personal information on its behalf, the Private Sector Act requires a written contractual framework, including notably:<\/p>

                                                                                • the supplier’s obligation to implement security measures<\/b>;<\/li>
                                                                                • the obligation to notify VALORA in case of a confidentiality incident<\/b>;<\/li>
                                                                                • conditions on the disclosure<\/b> of information (e.g., limitation, authorization);<\/li>
                                                                                • requirements relating to the destruction<\/b> or return of information at the end of the mandate.<\/li><\/ul>

                                                                                  6.4 Access Control and Operational Principles<\/b><\/p>

                                                                                  In practice, VALORA applies a “reasonable” discipline to reduce exposure:<\/p>

                                                                                  • access limited to only the necessary persons\/functions at the supplier;<\/li>
                                                                                  • document sharing via controlled mechanisms (identified recipients, limited links when possible);<\/li>
                                                                                  • withdrawal\/deactivation of access when no longer needed (end of milestone, end of mandate);<\/li>
                                                                                  • framing of communications (avoiding sending sensitive data via uncontrolled channels).<\/li><\/ul>

                                                                                    6.5 Operational Subcontracting: Decisions, Approvals, and Proofs<\/b><\/p>

                                                                                    When suppliers intervene on-site (e.g., storage, transport, disposal), VALORA frames the execution by:<\/p>

                                                                                    • a clear scope (what, when, how);<\/li>
                                                                                    • approvals<\/b> when irreversible actions or significant disbursements are involved;<\/li>
                                                                                    • supporting documents<\/b>, when available (slips, confirmations, receipts), and their integration into the record.<\/li><\/ul>

                                                                                      6.6 Transparency: Where it is Documented<\/b><\/p>

                                                                                      Details on:<\/p>

                                                                                      • the categories of personal information,<\/li>
                                                                                      • the purposes,<\/li>
                                                                                      • disclosures to third parties,<\/li>
                                                                                      • and, where applicable, the possibility of transfers outside Quebec (if applicable)<\/li><\/ul>

                                                                                        are described in more detail in the Privacy Policy<\/b>, which must be accessible via the Site when collection is carried out through a technological means.<\/p>

                                                                                        Section 7 \u2014 Data Outside Quebec (If Applicable): Principle and Governance<\/b><\/p>

                                                                                        7.1 Principle: Transparency and Prudence<\/b><\/p>

                                                                                        VALORA may, where applicable<\/b>, use suppliers or technological solutions whose infrastructure or certain operations involve the disclosure of personal information outside Quebec<\/b> (“transfer outside Quebec”). In such a case, VALORA aims for a prudent approach: limiting what is disclosed, framing the disclosure, and ensuring that the level of protection remains adequate given the sensitivity of the information. <\/p>

                                                                                        7.2 Legal Framework: Assessment and Framing Before Disclosure<\/b><\/p>

                                                                                        When<\/b> personal information must be disclosed outside Quebec, the Act respecting the protection of personal information in the private sector provides for prior framing, including notably:<\/p>

                                                                                        • the assessment of privacy factors (including, among others, the sensitivity of the information, the purpose, protection measures, and the applicable legal framework in the destination State); and<\/li>
                                                                                        • the conclusion of a written agreement containing measures to ensure adequate protection.<\/li><\/ul>

                                                                                          Deliberately cautious wording: VALORA does not state here that transfers systematically occur; this section frames the case where<\/b> a transfer would be necessary.<\/p>

                                                                                          7.3 Minimization and Operational Choices<\/b><\/p>

                                                                                          In the event that a transfer outside Quebec is required, VALORA aims to:<\/p>

                                                                                          • limit disclosure to information necessary for the purpose;<\/li>
                                                                                          • prioritize, when reasonable, configurations that reduce exposure (e.g., restricted access, record segmentation);<\/li>
                                                                                          • avoid over-collection and uncontrolled sharing.<\/li><\/ul>

                                                                                            7.4 Information for data subjects <\/b><\/p>

                                                                                            Information on disclosures to third parties and, where applicable, on the possibility of disclosures outside Qu\u00e9bec is set out in the Privacy Policy<\/b>, which describes the categories of information, purposes, and disclosure practices.<\/p>

                                                                                            Section 8 \u2014 Privacy Settings, Technologies, and Consents<\/b><\/p>

                                                                                            8.1 Principle: Transparency and Control \u201cWhen Relevant\u201d<\/b><\/p>

                                                                                            VALORA aims to use technologies and privacy settings sparingly: only when necessary for the operation of the Site, the management of requests (quotes and evaluations), or the execution of a mandate. When technologies can identify, locate, or profile<\/b> an individual, transparency and prior information are essential. <\/p>

                                                                                            8.2 Identification, Location, or Profiling Technologies (If Used)<\/b><\/p>

                                                                                            If<\/b> VALORA uses, on the Site or via digital tools, a technology allowing identification, location, or profiling, VALORA aims to:<\/p>

                                                                                            • inform concerned individuals in advance<\/b>;<\/li>
                                                                                            • indicate the means offered to activate<\/b> these functions (or, where applicable, configure or deactivate them), in accordance with the applicable framework.<\/li><\/ul>

                                                                                              8.3 Consent: \u201cTransactional vs. Marketing\u201d Logic<\/b><\/p>

                                                                                              VALORA distinguishes between:<\/p>

                                                                                              • transactional<\/b> communications (responding to a request, managing a mandate), which are necessary for the service relationship;<\/li>
                                                                                              • marketing<\/b> communications (newsletter, offers), which require separate consent and appropriate withdrawal and unsubscribe mechanisms.<\/li><\/ul>

                                                                                                8.4 Cookies, trackers, and analytics<\/b><\/p>

                                                                                                When the Site uses cookies\/trackers (e.g., for statistics, performance, or conversion measurement), VALORA aims to:<\/p>

                                                                                                • clearly describe the categories of cookies\/trackers and their purposes;<\/li>
                                                                                                • offer, when relevant, configuration choices (especially for non-essential cookies).<\/li><\/ul>

                                                                                                  Details (categories, purposes, duration, preference management) are presented in the Cookie Policy<\/b>, available on the Site.<\/p>

                                                                                                  8.5 Communications and Document Sharing: Operational Prudence<\/b><\/p>

                                                                                                  To reduce exposure, VALORA prioritizes pragmatic practices:<\/p>

                                                                                                  • avoid sending highly sensitive information via generic, uncontrolled channels;<\/li>
                                                                                                  • use controlled sharing mechanisms when documents need to circulate (identified recipients, limited access when possible);<\/li>
                                                                                                  • limit shared information to that necessary for the mandate (minimization).<\/li><\/ul>

                                                                                                    Section 9 \u2014 Retention and Destruction<\/b><\/p>

                                                                                                    9.1 Principle: Retain Only What is Necessary<\/b><\/p>

                                                                                                    VALORA aims to retain information (including elements of a record<\/b>: inventory, photos, reports, communications) only for the duration necessary<\/b> for the purposes for which it was collected or used, notably:<\/p>

                                                                                                    • processing a request (quote and evaluation);<\/li>
                                                                                                    • executing a mandate and delivering agreed-upon deliverables;<\/li>
                                                                                                    • ensuring reasonable administrative follow-up (invoicing, record management, relevant operational proofs).<\/li><\/ul>

                                                                                                      This principle is part of a logic of governance and personal information protection within a company.<\/p>

                                                                                                      9.2 Retention Parameters: Adapted to Mandate and Risk<\/b><\/p>

                                                                                                      Retention duration may vary depending on:<\/p>

                                                                                                      • the nature of the mandate (partial vs. full management);<\/li>
                                                                                                      • the sensitivity of the information;<\/li>
                                                                                                      • operational needs (e.g., deliverables, follow-up, traceability);<\/li>
                                                                                                      • applicable legal obligations (if any).<\/li><\/ul>

                                                                                                        VALORA avoids “indefinite retention by default”: the objective is justified and proportionate retention.<\/p>

                                                                                                        9.3 Secure Destruction and Disposal<\/b><\/p>

                                                                                                        When retention is no longer necessary, VALORA aims for secure destruction<\/b> of information according to its medium:<\/p>

                                                                                                        • secure deletion of digital copies and removal of access;<\/li>
                                                                                                        • secure destruction of paper documents where applicable;<\/li>
                                                                                                        • confirmation or internal documentation of disposal when relevant (depending on the type of record).<\/li><\/ul>

                                                                                                          These practices aim to reduce the risk of unauthorized access and align with the obligation to take reasonable security measures.<\/p>

                                                                                                          9.4 Handover of Deliverables and File Closure<\/b><\/p>

                                                                                                          At the end of a mandate (or at the end of a major milestone), VALORA hands over the agreed-upon deliverables (e.g., final report, exportable inventory, document index) and applies a closure logic:<\/p>

                                                                                                          • confirmation of handed-over items;<\/li>
                                                                                                          • clarification of temporarily retained items (if applicable) and retention\/destruction terms;<\/li>
                                                                                                          • withdrawal of external access when not required.<\/li><\/ul>

                                                                                                            Details (typical retention periods, exact terms, deletion requests, etc.) are set out in the Privacy Policy<\/b> and, where applicable, in the terms of the mandate.<\/p>

                                                                                                            Section 10 \u2014 Security & Privacy Contact<\/b><\/p>

                                                                                                            10.1 Officer and Contact Point<\/b><\/p>

                                                                                                            For any questions regarding security, privacy, or the protection of personal information, you may contact VALORA’s personal information protection officer<\/b>.<\/p>

                                                                                                            The Act respecting the protection of personal information in the private sector stipulates that the person holding the highest authority within the company is responsible for the protection of personal information, unless this function is delegated in writing, and imposes related governance obligations.<\/p>

                                                                                                            Contact Information (to be inserted)<\/b><\/b><\/p>

                                                                                                            • Name \/ Title: Marie-Jos\u00e9e Legault, PIO \u2014 VALORA<\/li>
                                                                                                            • Email: legal@valoraestate.com<\/li>
                                                                                                            • Mailing address: 2572 Daniel-Johnson Blvd, 2nd floor, Laval, Quebec, H7T 2R3 <\/li><\/ul>

                                                                                                              10.2 Reporting an Incident or Concern<\/b><\/p>

                                                                                                              If you believe that personal information has been:<\/p>

                                                                                                              • lost,<\/li>
                                                                                                              • disclosed to a third party without authorization,<\/li>
                                                                                                              • accessed without authorization,<\/li>
                                                                                                              • or used inappropriately,<\/li><\/ul>

                                                                                                                You may contact VALORA using the contact details above. VALORA will evaluate the information received and apply its incident management process, including maintaining a register and, where applicable, issuing required notifications when the risk of serious harm justifies it. <\/p>

                                                                                                                10.3 Requests Regarding Your Personal Information<\/b><\/p>

                                                                                                                To exercise rights or submit a request regarding your personal information (access, rectification, withdrawal of consent where applicable, etc.), please consult the Privacy Policy<\/b>, which describes:<\/p>

                                                                                                                • the categories of information collected,<\/li>
                                                                                                                • the purposes,<\/li>
                                                                                                                • disclosures to third parties,<\/li>
                                                                                                                • and the request procedure.<\/li><\/ul>

                                                                                                                  Section 11 \u2014 Updates<\/b><\/p>

                                                                                                                  11.1 Evolution of Practices and Document<\/b><\/p>

                                                                                                                  VALORA may update this Security and Privacy<\/b> page to reflect:<\/p>

                                                                                                                  • the evolution of its services (post-mortem \/ living legacy file);<\/li>
                                                                                                                  • changes in technological tools or suppliers;<\/li>
                                                                                                                  • the improvement of its operational practices;<\/li>
                                                                                                                  • or the evolution of the applicable framework.<\/li><\/ul>

                                                                                                                    Any update is intended to maintain information that is clear and consistent with the Privacy Policy<\/b> and the Cookie Policy<\/b>, where these documents apply.<\/p>

                                                                                                                    11.2 Dates<\/b><\/p>

                                                                                                                    • Effective date<\/b>: February 26, 2026<\/li>
                                                                                                                    • Last updated<\/b>: February 26, 2026<\/li><\/ul>

                                                                                                                      11.3 Where to Find the Current Version<\/b><\/p>

                                                                                                                      The current version of this page is published on valoraestate.com<\/b> and accessible via the footer<\/b> of the Site.<\/p>\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"

                                                                                                                      Security and Privacy Section 1 \u2014 Scope and Definitions 1.1 Document Scope This Security & Privacy page describes, at a general and public level, the measures and principles applied by…<\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-23926","page","type-page","status-publish","hentry"],"yoast_head":"\nSecurity and Privacy - Valora<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/valoraestate.com\/en\/security-and-privacy\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security and Privacy - Valora\" \/>\n<meta property=\"og:description\" content=\"Security and Privacy Section 1 \u2014 Scope and Definitions 1.1 Document Scope This Security & Privacy page describes, at a general and public level, the measures and principles applied by…\" \/>\n<meta property=\"og:url\" content=\"https:\/\/valoraestate.com\/en\/security-and-privacy\/\" \/>\n<meta property=\"og:site_name\" content=\"Valora\" \/>\n<meta property=\"article:modified_time\" content=\"2026-03-30T12:29:39+00:00\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data1\" content=\"17 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/valoraestate.com\/en\/security-and-privacy\/\",\"url\":\"https:\/\/valoraestate.com\/en\/security-and-privacy\/\",\"name\":\"Security and Privacy - Valora\",\"isPartOf\":{\"@id\":\"https:\/\/valoraestate.com\/en\/#website\"},\"datePublished\":\"2026-02-16T19:52:37+00:00\",\"dateModified\":\"2026-03-30T12:29:39+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/valoraestate.com\/en\/security-and-privacy\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/valoraestate.com\/en\/security-and-privacy\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/valoraestate.com\/en\/security-and-privacy\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/valoraestate.com\/en\/accueil\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security and Privacy\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/valoraestate.com\/en\/#website\",\"url\":\"https:\/\/valoraestate.com\/en\/\",\"name\":\"Valora\",\"description\":\"Valora\",\"publisher\":{\"@id\":\"https:\/\/valoraestate.com\/en\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/valoraestate.com\/en\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/valoraestate.com\/en\/#organization\",\"name\":\"Conciergerie successoral Valora\",\"url\":\"https:\/\/valoraestate.com\/en\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/valoraestate.com\/en\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/valoraestate.com\/wp-content\/uploads\/2020\/04\/1875-624-max.png\",\"contentUrl\":\"https:\/\/valoraestate.com\/wp-content\/uploads\/2020\/04\/1875-624-max.png\",\"width\":1875,\"height\":624,\"caption\":\"Conciergerie successoral Valora\"},\"image\":{\"@id\":\"https:\/\/valoraestate.com\/en\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security and Privacy - Valora","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/valoraestate.com\/en\/security-and-privacy\/","og_locale":"en_US","og_type":"article","og_title":"Security and Privacy - Valora","og_description":"Security and Privacy Section 1 \u2014 Scope and Definitions 1.1 Document Scope This Security & Privacy page describes, at a general and public level, the measures and principles applied by…","og_url":"https:\/\/valoraestate.com\/en\/security-and-privacy\/","og_site_name":"Valora","article_modified_time":"2026-03-30T12:29:39+00:00","twitter_card":"summary_large_image","twitter_misc":{"Est. reading time":"17 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/valoraestate.com\/en\/security-and-privacy\/","url":"https:\/\/valoraestate.com\/en\/security-and-privacy\/","name":"Security and Privacy - Valora","isPartOf":{"@id":"https:\/\/valoraestate.com\/en\/#website"},"datePublished":"2026-02-16T19:52:37+00:00","dateModified":"2026-03-30T12:29:39+00:00","breadcrumb":{"@id":"https:\/\/valoraestate.com\/en\/security-and-privacy\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/valoraestate.com\/en\/security-and-privacy\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/valoraestate.com\/en\/security-and-privacy\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/valoraestate.com\/en\/accueil\/"},{"@type":"ListItem","position":2,"name":"Security and Privacy"}]},{"@type":"WebSite","@id":"https:\/\/valoraestate.com\/en\/#website","url":"https:\/\/valoraestate.com\/en\/","name":"Valora","description":"Valora","publisher":{"@id":"https:\/\/valoraestate.com\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/valoraestate.com\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/valoraestate.com\/en\/#organization","name":"Conciergerie successoral Valora","url":"https:\/\/valoraestate.com\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/valoraestate.com\/en\/#\/schema\/logo\/image\/","url":"https:\/\/valoraestate.com\/wp-content\/uploads\/2020\/04\/1875-624-max.png","contentUrl":"https:\/\/valoraestate.com\/wp-content\/uploads\/2020\/04\/1875-624-max.png","width":1875,"height":624,"caption":"Conciergerie successoral Valora"},"image":{"@id":"https:\/\/valoraestate.com\/en\/#\/schema\/logo\/image\/"}}]}},"_links":{"self":[{"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/pages\/23926","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/comments?post=23926"}],"version-history":[{"count":2,"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/pages\/23926\/revisions"}],"predecessor-version":[{"id":24141,"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/pages\/23926\/revisions\/24141"}],"wp:attachment":[{"href":"https:\/\/valoraestate.com\/en\/wp-json\/wp\/v2\/media?parent=23926"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}