Arixa Capital SMS and Text Messaging Compliance Policy

This Privacy Policy was last updated on October 26th, 2026

1. Purpose

Arixa Capital ("Arixa") is committed to conducting SMS and text messaging communications in a lawful, transparent, and compliant manner. This policy establishes requirements for the collection, use, retention, and monitoring of text message communications with prospective borrowers, borrowers, brokers, vendors, investors, and other business contacts. Objectives: Comply with laws governing text communications; reduce Telephone Consumer Protection Act (TCPA) risk; satisfy The Campaign Registry (TCR) requirements; protect customer privacy and confidential information; ensure business communications occur through approved systems; establish clear employee expectations regarding SMS usage.

2. Scope

Applies to all employees, officers, contractors, temporary personnel and all business-related SMS, MMS and text messaging communications conducted through approved platforms including RingCentral, approved CRM systems, messaging applications, and company-issued devices.

3. Approved Business Purpose

Permitted communications include borrower inquiries, scheduling, application submissions, document requests, loan status updates, servicing, broker and investor communications. Prohibited communications include unlawful, deceptive, harassing or unauthorized marketing messages and sharing confidential information without authorization.

4. Consent Requirements

When an individual voluntarily provides a mobile telephone number through a website inquiry form, loan application, broker submission, customer portal, email communication, or other documented business interaction, Arixa may use that mobile telephone number to communicate regarding the individual's inquiry, application, transaction, servicing matter, or other legitimate business purpose, subject to applicable law and the requirements of this policy. Where feasible, forms collecting mobile telephone numbers should include disclosures informing individuals that SMS communications may be used.

5. Marketing Communications

SMS marketing campaigns require prior Compliance, Legal (if applicable), and Executive Management approval and must include consent and opt-out procedures.

6. Permissable Sending Hours and Message Frequency

Arixa shall send marketing and promotional text messages only in compliance with applicable federal and state law. Unless a more restrictive legal requirement applies, marketing text messages may be sent only between 8:00 a.m. and 9:00 p.m. in the recipient's local time zone. If customers consent to receive SMS messages, they may receive communications such as: Example: "Hello, this is a reminder of your upcoming appointment with [Name] at [Location] on [Date] at [Time]. Reply STOP to opt out of SMS messaging at any time." Arixa shall limit text message frequency to the scope and frequency disclosed at the time consent is obtained and shall not exceed the scope of the recipient's consent. Although federal law does not establish a maximum number of marketing text messages that may be sent within a specified period, Arixa generally limits marketing communications to no more than two to four messages per recipient per week, unless a documented business justification and Compliance approval supports a higher frequency. Customers who consent to receiving SMS messages may receive communications regarding SMS frequency such as: Example: "Message frequency may vary. You may receive up to 2 SMS messages per week regarding your appointments or account status." Recipients who revoke consent or submit an opt-out request shall be suppressed from future marketing text campaigns in accordance with applicable law and Company procedures. Arixa shall comply with any state law requirements that impose more restrictive sending-hour, consent, or message-frequency limitations than federal law.

7. One-to-One Business Communications

Individualized business communications are permitted for legitimate business purposes when the recipient has provided contact information and has not opted out. Individualized one-to-one text messages sent by loan originators, account managers, servicing personnel, or other employees for legitimate business purposes remain subject to this policy, including privacy, consent, record retention, monitoring, and opt-out requirements. Employees may not assume that one-to-one communications are exempt from company SMS compliance requirements.

8. Opt-Out Procedures

Recipients may opt out by replying STOP, UNSUBSCRIBE, or providing another written request. Opt-out requests shall be processed and documented in accordance with applicable law, carrier requirements, and Company procedures. Recipients who submit a valid opt-out request shall be suppressed from future marketing text campaigns.

9. Privacy Requirements

Mobile telephone numbers are confidential business information. Arixa does not sell, rent, disclose, transfer, or share mobile telephone numbers, mobile opt-in information, SMS consent records, subscriber information, or text messaging usage data with third parties or affiliates for marketing or promotional purposes. Any disclosure of such information shall be limited to service providers or vendors performing services on behalf of Arixa and only to the extent necessary to provide those services, subject to appropriate confidentiality and information security requirements. All business-related text messaging communications must be conducted through RingCentral or another Compliance-approved messaging platform. Employees are prohibited from conducting business text communications through personal mobile numbers, personal messaging applications, or any system not approved by Compliance and Information Technology except as specifically authorized in writing.

10. Approved Messaging

Platforms Business texting must occur only through approved company systems. Personal numbers and unapproved messaging platforms are prohibited unless specifically authorized. All business-related SMS, MMS, and text messaging communications must be conducted through RingCentral or another messaging platform approved by Compliance and Information Technology. Employees are prohibited from conducting company business text messaging through:  Personal mobile telephone numbers;  Personal messaging applications;  Consumer texting platforms;  Temporary or disappearing-message applications; or  Any system not expressly approved by Compliance and Information Technology. Exceptions may be granted only with prior written approval from Compliance and Information Technology.

11. Record Retention

Business text messages are business records and must be retained in accordance with company record retention requirements.

12. Monitoring and Auditing

Arixa may monitor, review, and audit business messaging systems and related consent and opt-out records.

13. Employee Training

Personnel using SMS communications shall receive periodic training regarding privacy, TCPA, opt-outs, and approved communication methods.

14. Responsibilities

Compliance administers the policy; IT manages systems and controls; Managers supervise compliance; Employees follow requirements and escalate concerns.

15. Violations

Violations may result in disciplinary action, removal of messaging privileges, corrective training, or other management action. Appendix A Website disclosure: By submitting this form, you consent to receive calls and text messages from Arixa Capital regarding your inquiry, loan request, application, account, or related services. Reply STOP to opt out. Appendix B SMS and Mobile Communications Arixa Capital may use the mobile telephone number you provide to communicate with you regarding your inquiry, loan application, financing transaction, account, servicing matter, or other business-related communications. By providing your mobile telephone number, you consent to receive calls and text messages from Arixa Capital regarding these matters. Message and data rates may apply. Mobile opt-in information, consent records, and related text messaging data will not be shared, sold, rented, disclosed, or transferred to third parties or affiliates for marketing or promotional purposes. You may opt out of text communications at any time by replying STOP where applicable or by otherwise notifying Arixa that you no longer wish to receive such communications. Privacy language: Arixa Capital may use the telephone number you provide regarding your inquiry, application, financing transaction, account, or related business matters. Mobile opt-in information and consent data will not be shared with third parties or affiliates for marketing purposes.