Effective Date: October 30, 2026

Dunbar, Bender & Zapf, Inc. (“DBZ,” “we,” “us,” or “our”) respects the privacy of our clients, retirement plan participants and beneficiaries, website visitors, and others who communicate with us. This Policy explains the personal information we collect, how we use and disclose it, and the choices available to you. It applies to our website, communications, and services unless a separate notice or agreement applies.

1. Information We Collect

We may collect personal information that is reasonably necessary to provide our services, including:

• Contact and identification information, such as name, address, email address, telephone number, date of birth, and other identifying information.
• Employment and plan information, such as employer, compensation, service history, eligibility, beneficiary, contribution, distribution, account, and benefit information.
• Tax, financial, and government-reporting information needed for plan administration, compliance, filings, and related services.
• Client and business information, including plan documents, census data, trust or investment information, service requests, and communications.
• Website and technical information, such as IP address, browser or device information, pages visited, cookies, and similar data, if collected through our website.
• SMS information, including telephone numbers, consent records, and messaging preferences.

We may receive information directly from you or from plan sponsors, employers, participants, beneficiaries, financial institutions, recordkeepers, professional advisers, government agencies, and other authorized service providers.

2. How We Use Information

We may use personal information to:

• Provide retirement plan administration, actuarial, consulting, compliance, document, reporting, and related services.
• Determine eligibility, perform testing and calculations, process service requests, prepare filings and notices, and maintain required records.
• Communicate with clients, participants, beneficiaries, service providers, and government agencies.
• Operate, secure, support, and improve our business, website, systems, and services.
• Comply with contracts, professional obligations, applicable law, legal process, and regulatory requirements.

3. How We Disclose Information

We do not sell personal information. We may disclose personal information only as reasonably necessary for the purposes described in this Policy, including to:

• Authorized client or plan representatives, participants, beneficiaries, and professional advisers.
• Recordkeepers, financial institutions, investment providers, insurers, payroll providers, and other plan service providers.
• Vendors and subcontractors that support our systems, communications, document processing, data hosting, security, or professional services.
• Government agencies, regulators, courts, law enforcement, or other parties when required or permitted by law or valid legal process.
• Parties involved in a business reorganization, merger, acquisition, or transfer, subject to appropriate protections.

We may also disclose information at your direction, with your consent, or as otherwise described when the information is collected. We require service providers acting on our behalf to use information only for authorized purposes and to maintain appropriate safeguards.

4. SMS and Mobile Information

If you provide a mobile number and consent to receive text messages, we may use that number for service-related or other authorized communications. Mobile information, telephone numbers, and SMS consent data will not be sold or shared with third parties for their own marketing or promotional purposes. We may provide such information to vendors that support message delivery or related services on our behalf.

You may opt out of SMS messages at any time by replying STOP. For assistance, reply HELP. Message and data rates may apply.

5. Cookies and Website Technologies

Our website may use cookies and similar technologies to operate the site, remember preferences, understand site usage, and support security. You may adjust browser settings to limit cookies, although some website features may not function properly. If we use third-party analytics or similar tools, those providers may receive technical information under their applicable terms and privacy notices.

6. Information Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, alteration, or disclosure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of an incident involving personal information, we will respond and provide notice as required by applicable law and contractual obligations.

7. Data Retention

We retain personal information for as long as reasonably necessary to provide services, meet contractual, legal, regulatory, tax, professional, and recordkeeping obligations, resolve disputes, and enforce agreements. Retention periods vary based on the type of information and the purpose for which it is maintained.

8. Your Choices and Privacy Requests

You may contact us to request access to or correction of personal information you have provided, update communication preferences, or ask a privacy question. Certain information may be controlled by a plan sponsor, employer, recordkeeper, or other organization; in those cases, we may direct the request to the appropriate party. We will review and respond to requests as required by applicable law, subject to identity verification and lawful exceptions.

9. Children’s Privacy

Our website is not directed to children under 13, and we do not knowingly collect personal information from children under 13 through the website. Information about minor participants or beneficiaries may be processed when necessary to provide retirement plan services and as authorized by a plan sponsor, parent, guardian, or applicable law.

10. Third-Party Websites

Our website may link to websites or services that we do not control. Their privacy practices are governed by their own notices, and we are not responsible for those practices.

11. Changes to This Policy

We may update this Policy from time to time. The revised Policy will be posted on our website with an updated effective date.

12. Contact Us

Questions may be submitted to Dunbar, Bender & Zapf, Inc. using the contact information published on our website or through your day-to-day DBZ representative.