Electronic Communications Policy

Purpose and Scope

1.1Purpose. This Electronic Communications Policy ("Policy") governs the creation, transmission, receipt, storage, and retention of electronic communications by Kimball Consulting ("Kimball Consulting," "we," "us," or "our"). It establishes standards for the professional, secure, and legally compliant use of electronic communications in connection with Kimball Consulting's business activities and client engagements.

1.2Scope. This Policy applies to all electronic communications sent or received by Kimball Consulting personnel using firm-provided or personal devices and accounts when used for business purposes, including but not limited to email, text messaging, secure messaging platforms, facsimile transmissions, and electronic document delivery systems.

1.3Legal Framework. This Policy is designed to ensure compliance with, among other applicable authorities:

• Electronic Signatures in Global and National Commerce Act (E-SIGN Act), 15 U.S.C. § 7001 et seq.;
• Uniform Electronic Transactions Act (UETA), as enacted in applicable states;
• CAN-SPAM Act, 15 U.S.C. § 7701 et seq.;
• Gramm-Leach-Bliley Act (GLBA) and implementing regulations governing the protection and transmission of nonpublic personal financial information;
• Applicable state privacy, data security, and electronic records laws.

Definitions

2.1"Electronic Communication" means any information created, generated, sent, communicated, received, or stored in electronic form, including without limitation email messages, text messages, electronic faxes, instant messages, web-based messages, and documents transmitted electronically.

2.2"Electronic Record" means a contract or other record created, generated, sent, communicated, received, or stored by electronic means that is required to be maintained under applicable law or Kimball Consulting's record retention obligations.

2.3"Electronic Signature" means an electronic sound, symbol, or process attached to or logically associated with a record and executed or adopted by a person with the intent to sign that record, as defined under the E-SIGN Act and applicable state law.

2.4"Authorized Platform" means an electronic communication or document delivery platform that has been reviewed and approved by an authorized principal of Kimball Consulting for use in business communications involving Confidential Information.

2.5"Confidential Information" has the meaning set forth in Kimball Consulting's Information Security Policy (Document Ref: KCI-ISP-2026-001).

Consent to Electronic Communications

3.1By engaging Kimball Consulting's services, clients and counterparties consent to receive communications from Kimball Consulting in electronic form. This consent encompasses service agreements, engagement letters, disclosures, reports, statements, invoices, notices, and other correspondence arising from or related to an engagement with Kimball Consulting.

3.2This consent is granted in accordance with the E-SIGN Act and applicable state law and may be relied upon by Kimball Consulting as legally equivalent to written consent for the delivery of all documents that may be delivered electronically under applicable law.

3.3Hardware and Software Requirements. To access and retain electronic communications from Kimball Consulting, recipients must have access to the following minimum capabilities:

• An internet-connected device capable of accessing standard web content;
• A current web browser or email client capable of rendering HTML-formatted content;
• Software capable of opening and viewing PDF documents (e.g., Adobe Acrobat Reader or equivalent);
• Sufficient electronic storage capacity to retain records throughout any applicable retention period.

3.4Right to Withdraw Consent. Recipients may withdraw consent to receive electronic communications at any time by delivering written notice to Kimball Consulting at the contact information set forth in Section 14. Withdrawal of consent is effective within ten (10) business days of receipt and may result in additional time or cost for delivery of communications in paper form. Withdrawal does not affect the validity of any electronic communications previously delivered.

3.5Maintaining Current Contact Information. Recipients are responsible for maintaining current and accurate email addresses and contact information with Kimball Consulting. Electronic communications delivered to the most recently provided email address are deemed received regardless of whether they are actually accessed by the recipient.

Professional Standards for Electronic Communications

4.1All electronic communications sent on behalf of Kimball Consulting shall:

• Be professional, accurate, and consistent with Kimball Consulting's values, brand standards, and applicable law;
• Clearly identify the sender and Kimball Consulting as the originating firm;
• Not contain misleading, materially false, defamatory, discriminatory, harassing, or otherwise unlawful content;
• Comply with all applicable laws and regulations governing professional communications in the financial services context.

4.2Electronic communications shall not be used to make binding commitments on behalf of Kimball Consulting, accept client engagements, or materially modify contractual terms without prior authorization from an authorized principal, unless executed through an Authorized Platform with appropriate electronic signature capabilities.

Confidentiality and Secure Transmission

5.1Electronic communications containing Confidential Information must be transmitted using encrypted channels, consistent with Kimball Consulting's Information Security Policy.

5.2Standard unencrypted email is not a secure transmission medium. The transmission of highly sensitive financial data — including but not limited to complete tax identification numbers, full bank account numbers, full financial statements, and complete personal nonpublic information — via unencrypted email is prohibited. Authorized secure document portals or encrypted email services must be used for such transmissions.

5.3Required Confidentiality Notice. All outbound Kimball Consulting email communications shall include the following confidentiality notice in the message footer:

Electronic Signatures

6.1Kimball Consulting accepts and employs electronic signatures for engagement letters, agreements, authorizations, consents, and other documents where permitted by applicable law.

6.2An electronic signature executed in accordance with the E-SIGN Act, UETA, and applicable state law carries the same legal weight and effect as a handwritten (wet) signature and creates binding legal obligations to the same extent.

6.3Electronic signatures used by Kimball Consulting shall be implemented through reputable, commercially available electronic signature platforms that provide:

• Verified signer identity through reasonable authentication measures;
• A complete, time-stamped audit trail of signature events;
• Tamper-evident sealing of signed documents;
• Secure, long-term storage of executed documents and associated audit records.

6.4Certain document types may require original handwritten (wet) signatures as required by specific regulatory requirements, lender mandates, or applicable law. Kimball Consulting will advise clients in advance when wet signatures are required.

Record Retention of Electronic Communications

7.1Electronic records and communications created or received in connection with Kimball Consulting's business activities constitute official business records and are subject to applicable retention requirements.

7.2Retention Periods.

• Client Engagement Communications and Records: Minimum of seven (7) years from the conclusion of the engagement, consistent with financial industry record-keeping standards.
• Executed Agreements and Authorizations: Minimum of seven (7) years following expiration, termination, or full performance of the agreement.
• General Business Correspondence: Minimum of three (3) years from the date of creation.
• Records Subject to Specific Regulatory Requirements: As required by applicable federal or state law or regulation, which may exceed the periods set forth above.

7.3Electronic records subject to retention obligations must be stored in formats that are non-alterable, accessible, and capable of being accurately reproduced and printed throughout the full retention period.

7.4The deletion, alteration, or destruction of electronic records prior to the expiration of the applicable retention period is prohibited. This prohibition extends to situations in which litigation, regulatory investigation, or audit is reasonably anticipated.

Prohibited Uses

8.1Kimball Consulting's electronic communication platforms, systems, and firm email addresses shall not be used:

• To transmit, solicit, or receive material that is unlawful, fraudulent, defamatory, harassing, abusive, obscene, threatening, or otherwise objectionable;
• To infringe upon the intellectual property rights of any person or entity, including unauthorized reproduction or distribution of copyrighted materials;
• To engage in unauthorized collection, harvesting, or processing of personal information;
• To transmit unsolicited commercial communications (spam) in violation of the CAN-SPAM Act or any other applicable anti-spam law;
• To circumvent, defeat, or attempt to bypass any security control, encryption protocol, or access restriction;
• To transmit malicious code, viruses, ransomware, or any software designed to cause harm to systems or data;
• For personal financial transactions, investments, or activities wholly unrelated to Kimball Consulting's business operations.

Opt-Out and Unsubscribe Rights

9.1Recipients of Kimball Consulting marketing, informational, or newsletter communications may unsubscribe from such communications at any time by: (a) clicking the unsubscribe link included in any marketing email; or (b) sending a written opt-out request to the contact information set forth in Section 14.

9.2Opt-out requests will be honored and processed within ten (10) business days of receipt. Following the opt-out effective date, no further marketing communications will be sent to the requesting recipient, except as may be required for an active engagement or as required by law.

9.3Opting out of marketing communications does not affect Kimball Consulting's ability to send transactional, service-related, or legally required communications necessary for the performance of an active engagement.

Monitoring and Auditing

10.1Kimball Consulting reserves the right to monitor, log, and audit electronic communications transmitted through or stored on firm-provided systems and platforms for purposes of ensuring compliance with this Policy, applicable law, and regulatory requirements, and for the investigation of suspected violations or security incidents.

10.2Personnel using Kimball Consulting systems or accounts have no expectation of privacy in communications transmitted through or stored on those systems.

10.3Monitoring activities will be conducted in accordance with applicable law and the provisions of Kimball Consulting's Information Security Policy.

Non-Compliance and Enforcement

11.1Violations of this Policy by Kimball Consulting personnel may result in disciplinary action up to and including immediate termination of employment or engagement, at the discretion of the firm's principal(s).

11.2Violations that constitute unlawful conduct, including unauthorized disclosure of Confidential Information or transmission of regulated content in violation of applicable law, may be referred to appropriate law enforcement or regulatory authorities. Individuals may also be subject to civil liability for damages caused by such violations.

Review and Amendments

12.1This Policy shall be reviewed at least annually, or more frequently in response to material changes in applicable law, regulatory guidance, technology, or business operations.

12.2Amendments to this Policy are effective upon posting to Kimball Consulting's website and communication to affected personnel. The current version of this Policy, including the effective date and document reference number, is published on Kimball Consulting's website.

12.3Continued use of Kimball Consulting's electronic communication channels following notice of an amendment to this Policy constitutes acceptance of the updated Policy.

Relationship to Other Policies

13.1This Policy should be read in conjunction with Kimball Consulting's Privacy Policy (KCI-PP-2026-001) and Information Security Policy (KCI-ISP-2026-001). In the event of any conflict between this Policy and another Kimball Consulting policy with respect to electronic communications, the more protective or restrictive provision shall govern unless otherwise directed by an authorized principal.

Contact Information

14.1Questions about this Policy, requests to withdraw consent to electronic communications, or opt-out requests should be directed to:

14.2We will endeavor to respond to all inquiries within ten (10) business days of receipt.