Privacy Policy

Section 1

Introduction and Scope

1.1This Privacy Policy ("Policy") describes how Kimball Consulting ("Kimball Consulting," "we," "us," or "our") collects, uses, retains, discloses, and protects personal information in connection with our consulting services, our website (the "Site"), and all related interactions with clients, prospective clients, referral partners, and visitors.

1.2This Policy applies to all personal information collected or processed by Kimball Consulting in the course of our business operations, including information collected through the Site, by telephone, email, or in person.

1.3By accessing or using our Site or engaging our services, you acknowledge that you have read and understood this Policy. If you do not agree with the terms of this Policy, please discontinue use of our services and contact us using the information in Section 15.

1.4This Policy does not apply to third-party websites, applications, or services that may be linked from the Site. We encourage you to review the privacy policies of any third parties you interact with.

Section 2

Information We Collect

2.1Information You Provide Directly. We may collect the following categories of personal information that you provide directly to us:

• Identification Information: Full name, title, business name, and professional credentials.
• Contact Information: Business and personal mailing address, telephone numbers, and email addresses.
• Financial and Business Information: Business financial statements, tax returns, credit information, revenue figures, ownership structure, and related information required for the assessment and pursuit of financing arrangements on your behalf.
• Transaction Information: Records of transactions, requests, and correspondence related to our consulting engagements.
• Communications: The content of any communications you send us, including emails, letters, and records of telephone conversations.

2.2Information Collected Automatically. When you access the Site, certain information may be collected automatically, including:

• Log Data: Internet protocol (IP) address, browser type and version, the pages you visit, the time and date of your visit, and time spent on pages.
• Device Information: Hardware model, operating system and version, unique device identifiers, and mobile network information.
• Cookies and Similar Technologies: Session cookies, persistent cookies, and similar tracking technologies as further described in Section 11.

2.3Information from Third Parties. We may receive information about you from third parties, including:

• Referral Partners: Individuals or entities who refer prospective clients to us.
• Credit and Data Agencies: With your consent, credit bureaus, background screening services, and financial data providers.
• Lenders and Financial Institutions: In connection with the pursuit of financing on your behalf.
• Public Records: Publicly available government databases, court records, and business registries.

Section 3

How We Use Your Information

3.1Service Delivery. To provide, administer, and improve our consulting services, including evaluating your financing needs, identifying appropriate lenders, preparing financing packages, and managing your engagement.

3.2Communications. To respond to your inquiries, send engagement updates, and communicate regarding matters relevant to our services.

3.3Legal and Regulatory Compliance. To comply with applicable laws, regulations, legal process, and government requests, including know-your-customer (KYC) and anti-money laundering (AML) requirements.

3.4Risk Management. To assess and manage risks associated with our clients and engagements, including fraud prevention and due diligence.

3.5Business Operations. To analyze and improve our business practices, develop new services, and maintain the security and integrity of our operations.

3.6Marketing. With your consent where required by applicable law, to send you information about our services, industry insights, and firm updates. You may opt out of marketing communications at any time as described in Section 8.

Section 4

Legal Basis for Processing

4.1Where applicable law requires a legal basis for processing personal information, we rely on the following:

• Performance of a Contract: Processing necessary to perform our consulting engagement with you or to take steps at your request prior to entering an engagement.
• Legitimate Interests: Processing necessary for our legitimate business interests, including business development, risk management, fraud prevention, and service improvement, where those interests are not overridden by your fundamental rights and freedoms.
• Compliance with Legal Obligations: Processing necessary to comply with our legal and regulatory obligations under applicable federal and state law.
• Consent: Where you have provided express consent to a specific processing activity, including certain marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing prior to withdrawal.

Section 5

Disclosure of Your Information

5.1We may disclose your personal information to the following categories of recipients:

• Lenders and Financial Institutions: With your knowledge and in the course of pursuing financing arrangements on your behalf.
• Service Providers: Trusted third-party vendors who perform services on our behalf, including document management, cloud hosting, IT services, and professional services (e.g., legal counsel, accountants), subject to confidentiality obligations.
• Referral Partners: In limited circumstances, and only with your consent, to referral partners who may be in a position to assist with your financing needs.
• Legal and Regulatory Authorities: When required by applicable law, court order, subpoena, or government authority, or when we believe disclosure is necessary to protect the rights, property, or safety of Kimball Consulting, our clients, or others.
• Business Transfers: In connection with a merger, acquisition, reorganization, sale of assets, or similar corporate transaction, subject to appropriate confidentiality protections.

5.2We do not sell, rent, or trade your personal information to third parties for their own marketing or commercial purposes.

Section 6

Financial Privacy Notice (Gramm-Leach-Bliley Act)

6.1Information We Collect. We collect nonpublic personal financial information (NPI) from you, including information you provide to us directly, information about your transactions with us and others, and information we receive from third parties such as lenders and credit bureaus, as further described in Section 2.

6.2Information We Disclose. We may disclose NPI to lenders, financial institutions, and service providers as necessary to perform our consulting services. We do not disclose NPI to unaffiliated third parties for their independent marketing purposes.

6.3Protecting Your Information. We maintain physical, electronic, and procedural safeguards that comply with applicable regulations to protect your NPI. See Section 10 for further detail.

6.4Opt-Out Rights. To the extent the GLBA provides you with the right to limit certain sharing of your NPI, you may exercise that right by contacting us at the information set forth in Section 15. Please note that limiting sharing may affect our ability to provide consulting services on your behalf.

Section 7

Data Retention

7.1We retain personal information for as long as necessary to fulfill the purposes described in this Policy, unless a longer retention period is required by applicable law or regulation.

7.2Retention periods are determined based on the following criteria:

• Active Engagements: Information is retained for the duration of our engagement and for a minimum of seven (7) years following the conclusion of the engagement, consistent with financial industry record-keeping standards.
• Prospective Client Information: Information collected from prospective clients who do not proceed to engagement is retained for a period of two (2) years from initial collection.
• Website Usage Data: Log data and analytics data are retained for a period of thirteen (13) months.

7.3Following the applicable retention period, personal information is securely deleted or anonymized in accordance with our data disposal procedures.

Section 8

Your Rights and Choices

8.1Subject to applicable law, you may have the following rights with respect to your personal information:

• Right of Access: The right to request a copy of the personal information we hold about you.
• Right to Rectification: The right to request that we correct inaccurate or incomplete personal information.
• Right to Erasure: The right to request deletion of your personal information, subject to our legal and regulatory retention obligations.
• Right to Restriction: The right to request that we restrict processing of your personal information in certain circumstances prescribed by law.
• Right to Data Portability: The right to receive your personal information in a structured, commonly used, machine-readable format where processing is carried out by automated means.
• Right to Object: The right to object to certain types of processing, including processing carried out on the basis of legitimate interests or for direct marketing purposes.

8.2To exercise any of the foregoing rights, please submit a request using the contact information in Section 15. We will respond within thirty (30) calendar days, or such other period as required by applicable law. We may require verification of your identity before processing any request.

8.3You may opt out of marketing communications at any time by contacting us or following the unsubscribe instructions in any marketing email. Opting out of marketing does not affect our ability to send transactional or service-related communications.

Section 9

California Privacy Rights (CCPA / CPRA)

9.1This section applies to residents of the State of California and supplements the remainder of this Policy pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA").

9.2Categories of Personal Information Collected. In the preceding twelve (12) months, we have collected the following categories of personal information as defined by the CCPA/CPRA: identifiers (e.g., name, email, IP address); financial information; commercial information; internet or other electronic network activity information; and professional or employment-related information.

9.3Right to Know. California residents may request that we disclose (a) the categories of personal information collected; (b) the categories of sources from which it was collected; (c) the business or commercial purposes for collection; (d) the categories of third parties with whom we share the information; and (e) the specific pieces of personal information we hold about you.

9.4Right to Delete. California residents have the right to request deletion of personal information we have collected about them, subject to certain exceptions permitted by the CCPA/CPRA.

9.5Right to Opt-Out of Sale or Sharing. Kimball Consulting does not sell personal information, nor do we share personal information for purposes of cross-context behavioral advertising.

9.6Right to Correct. California residents have the right to request correction of inaccurate personal information we maintain about them.

9.7Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA/CPRA rights, including by denying services, charging different prices, or providing a different level of service.

9.8To exercise your California privacy rights, please contact us as described in Section 15. We will respond within forty-five (45) calendar days of receiving a verifiable consumer request.

Section 10

Security Measures

10.1We implement and maintain reasonable administrative, technical, and physical safeguards designed to protect your personal information against unauthorized access, disclosure, alteration, or destruction, consistent with the sensitivity of the information and applicable legal requirements.

10.2Safeguards include, but are not limited to: encryption of sensitive data in transit and at rest; access controls limiting system access to authorized personnel with a legitimate business need; multi-factor authentication for access to systems containing sensitive data; regular security assessments; and vendor due diligence and contractual security requirements.

10.3No method of data transmission or electronic storage is completely secure. While we take commercially reasonable precautions to protect your personal information, we cannot guarantee absolute security. In the event of a security incident involving your personal information, we will notify you as required by applicable law.

Section 11

Cookies and Tracking Technologies

11.1We may use cookies and similar tracking technologies to operate and improve the Site and to understand how it is used.

11.2The following types of cookies may be used:

• Strictly Necessary Cookies: Required for the basic operation and security of the Site. These cannot be disabled.
• Analytics Cookies: Used in aggregate form to understand how visitors interact with the Site and to improve its performance and content.

11.3You may disable cookies through your browser settings. Please note that disabling cookies may affect the functionality of the Site.

Section 12

Children's Privacy

12.1The Site and our services are directed exclusively to business professionals and are not intended for individuals under the age of thirteen (13). We do not knowingly collect personal information from children. If we become aware that we have collected personal information from a child under age 13 without parental consent, we will take prompt steps to delete such information.

Section 13

Third-Party Links and Services

13.1The Site may contain links to third-party websites or services. We are not responsible for the privacy practices or content of such third parties. We encourage you to review the privacy policies of any third-party sites or services before providing any personal information.

Section 14

Changes to This Policy

14.1We reserve the right to modify this Policy at any time. Material changes will be communicated by updating the "Effective Date" at the top of this document and, where appropriate, by posting a notice on the Site or contacting you directly.

14.2Your continued use of the Site or our services following notice of any change to this Policy constitutes your acceptance of the updated Policy. We encourage you to review this Policy periodically.

Section 15

Contact Information

15.1For questions, concerns, or to exercise your privacy rights under this Policy, please contact us:

15.2We will endeavor to respond to all privacy-related inquiries within thirty (30) business days of receipt.