Driver Privacy Statement

Driver Privacy Statement LABAU Concierge Drivers — what we collect, why, and what you can ask us to do

STATUS DRAFT FOR REVIEW BY KING & JURGENS LLC. State privacy law and biometric law

are jurisdiction-specific and carry statutory penalties. This statement must be reviewed against New York law and the law of any state in which a LABAU Concierge Driver resides before publication.

Last updated: ______________________

Contents 1. What this statement covers 2. What this statement does not cover 3. What personal information we collect 4. How we collect it 5. How we use it 6. Who we disclose it to, and why 7. What we do not do with your information 8. How long we keep it 9. Biometric information — collection, retention and destruction 10. How we communicate with you 11. How we secure your information 12. Your rights and how to exercise them 13. Children 14. Changes to this statement 15. Contact

1. What This Statement Covers This Driver Privacy Statement describes how LABAU Holdings, Inc. (“LABAU,” “we,” “us”) collects, uses, discloses and protects personal information relating to LABAU Concierge Drivers and prospective drivers. It applies to information collected through the LABAU Concierge Driver application, the LABAU-issued device on which that application runs, the driver onboarding process, and any other interaction with the LABAU driver program. LABAU Concierge Drivers are salaried W-2 employees of LABAU. This statement applies to you whether you are an active driver, a former driver, or an applicant who was not placed.

2. What This Statement Does Not Cover Information about LABAU members — the people to whom you deliver — is governed by the LABAU Privacy Policy, not by this statement. You will encounter limited member information in the course of a delivery. Your obligations regarding that information are set out in your W-2 employee agreement and your confidentiality agreement.

Information collected by a merchant partner on its own premises, including any camera system that merchant operates, is governed by that merchant’s own practices and not by this statement. Information collected by Starboard or Hire Society in the course of screening and placing you is governed by that agency’s own privacy practices. LABAU receives the outcome of that screening, as described in Section 4.

3. What Personal Information We Collect Not every category is collected for every driver. The categories below are the complete set.

CATEGORY

WHAT IT INCLUDES

Identity

Name, telephone number, email address, home address, date of birth, signature

Government identifiers

Driver’s license number and the information on the license, Social Security number or other taxpayer identifier, work authorization documentation

Screening outcome

The result of criminal background screening conducted by the placement agency, and of any supplementary check LABAU commissions

Vehicle

Make, model, year, registration, inspection status, and evidence of active personal auto insurance

Financial

Bank routing and account details for weekly settlement, tax information, earnings and gratuity records

Device

The identifier of the smartphone you use with the LABAU Driver app, its operating system version, application version, and device management status

Application usage

Your interactions with the Concierge Driver application — screens viewed, actions taken, timestamps, and Resource Center articles completed

Location

GPS coordinates captured at each verification moment, and continuously while you are on duty with an active delivery

Verification records

The pass or fail result of each identity verification, together with its timestamp, GPS coordinates and device identifier

Delivery evidence

Photographs you take at collection and at delivery, barcode scans, and digital signatures captured at handoff

Hours and earnings

Clock-in and clock-out times, hours worked, salary and overtime, gratuity received through payroll

Communications

Messages between you and LABAU operations, support enquiries, and incident reports you submit

Claims

Information collected when an accident, injury, loss or other claim arising from your services is reported

BIOMETRIC INFORMATION LABAU does not collect biometric identifiers. Identity verification

is performed on your device by the device manufacturer’s own biometric system. LABAU receives only the result of that verification — a pass or a fail — together with its timestamp, location and device identifier. See Section 9.

4. How We Collect It Directly from you · When you apply to the LABAU driver program · During onboarding, training and your test delivery · When you use the Concierge Driver application · When you contact operations or support, or submit an incident report · When you report a claim Automatically, through the LABAU-issued device The Concierge Driver application collects device information, application usage, location and verification records as you work. Location is collected at each verification moment and continuously while you are on duty with an active delivery. It is not collected while you are off duty. The device is enrolled in mobile device management. That system reports device status, application version and compliance state to LABAU. It does not report the content of anything on the device. From the placement agency Starboard, operating through Hire Society, screens and places LABAU Concierge Drivers. LABAU receives your identity information, the outcome of criminal background screening, and confirmation of your license and insurance status. From service providers acting for us Where LABAU commissions a supplementary background check, that provider returns the outcome to LABAU. Payment and payroll providers return settlement confirmations. What we do not collect · We do not collect information from your personal phone. Deliveries are performed on the LABAUissued device. · We do not access the camera, microphone or photo library of the LABAU device except for the delivery photographs you take within the application. · We do not collect location while you are off duty. · We do not collect information about you from social media or data brokers.

5. How We Use It · Operating the driver program — activating your account, assigning deliveries, and supporting you while you work · Verifying your identity at each of the three chain-of-custody moments · Building and maintaining the chain of custody record for each delivery · Paying you — calculating hours, applying the correct rate, settling weekly, passing through gratuity in full, and issuing your annual Form W-2 · Confirming that you meet and continue to meet the vehicle, license and insurance standards · Investigating and resolving a member dispute, a merchant dispute, an insurance claim or an incident you report · Protecting the security of the platform, the devices and the goods in transit, and detecting and preventing fraud · Meeting our legal, tax and regulatory obligations, and establishing or defending legal claims · Improving the driver application and the Resource Center

LABAU does not use automated decision-making to determine whether you are activated, deactivated, or whether a delivery is assigned to you. Delivery assignment is based on availability and proximity. A designated preferred-driver relationship is offered to you and to the member, and either may decline it.

6. Who We Disclose It To, and Why RECIPIENT

WHAT THEY RECEIVE

WHY

Payment processor

Bank details, settlement amounts, gratuity

To pay you weekly and to pass through

records

gratuity

Payroll and bookkeeping

Identity, taxpayer identifier, hours,

To run payroll and issue your Form W-2

provider

earnings

Cloud hosting provider

All platform data, encrypted at rest

To operate the platform

Device management

Device identifier and compliance status

To manage and secure the LABAU-issued

provider

device

Placement agency

Confirmation of your activation status

To administer the placement relationship

Background screening

Identity information, where a

To complete that check

provider

supplementary check is commissioned

Insurance provider

Claims information and related records,

To handle a claim involving you or a delivery

where a claim is made

you performed

RECIPIENT

WHAT THEY RECEIVE

WHY

Merchant or member

Your first name only, where necessary to

To allow a handoff to be completed

complete a delivery Law enforcement, courts

Only what is legally required

and regulators

To respond to valid legal process, or where necessary to protect safety

An acquirer

Driver records, as part of a corporate

Only in a merger, acquisition or similar

transaction

transaction, with the same protections applied

A member never receives your surname, your home address, your telephone number or your vehicle registration. A merchant receives your first name and the order reference. Contact between you and a member is masked through the application in both directions.

7. What We Do Not Do With Your Information LABAU does not sell your personal information. LABAU does not share it for cross-context behavioral advertising. LABAU runs no advertising of any kind and has no advertising platform. There is no commercial incentive to hold more information about you than the service requires, and no third party is permitted to use your information for its own purposes.

· We do not use your location to evaluate your performance, and we do not track you off duty · We do not use your verification records for anything other than the chain of custody · We do not disclose your information to a member beyond your first name · We do not permit any service provider to use your information for its own purposes

8. How Long We Keep It I NF OR M ATI ON

RETENTION

Identity, screening outcome,

For the duration of your engagement, and afterwards for the period

vehicle and insurance records

required by law and to resolve any open claim

Financial, hours, earnings and tax

For the period required by tax and employment law

records Delivery evidence and chain of

For the period required to resolve disputes, returns and insurance claims

custody records

relating to that delivery

Verification records

See Section 9

I NF OR M ATI ON

RETENTION

Location data not attached to a

Thirty days

completed delivery Application usage and device logs

Twelve months

Communications and incident

For the duration of your engagement and for the period required to resolve

reports

any open matter

When a retention period ends, records are permanently deleted. Deleted records are not archived, and no backup copy is retained beyond the routine backup cycle after which it is overwritten.

9. Biometric Information What we collect LABAU does not collect, capture, receive, store or possess a biometric identifier, template, scan or image. Identity verification is performed entirely on the LABAU-issued device by the device manufacturer’s own biometric system. The template remains in the secure hardware of that device and is not accessible to the LABAU application or to LABAU. What LABAU receives and stores is the result of each verification — a pass or a fail — together with its timestamp, GPS coordinates, the device identifier and, where verification failed, the error code returned by the device. Why Verification confirms that the person holding a member’s purchase is the driver assigned to it. It runs three times per delivery: when you go on duty, at collection from the merchant, and at delivery. Together these form the chain of custody record that protects you, the member and the merchant. It is not used for timekeeping, productivity measurement, performance evaluation or any purpose other than identity confirmation at those three moments. Consent and the alternative You are given the LABAU Biometric Data Policy and asked for written consent before activation. You may decline. If you decline, or withdraw consent later, you use the alternative method — your device passcode together with a one-time code sent to your registered number — which produces an equivalent record. Declining does not affect your engagement. Retention and destruction schedule RECORD

RETENTION

DESTRUCTION

Verification records attached to a

Retained for the period required to

Permanently deleted at the end of that

RECORD

RETENTION

DESTRUCTION

completed delivery

resolve disputes, returns and insurance

period

claims relating to that delivery Verification records not attached to

Thirty days

Permanently deleted

On the end of your engagement,

Permanently deleted no later than one

retained only where required by law or

year after the engagement ends, or

to resolve an open claim

when the initial purpose has been

a completed delivery All driver verification data

satisfied, whichever occurs first

LABAU does not sell, lease, trade or otherwise profit from biometric information or from verification data, and will not do so.

10. How We Communicate With You We may contact you by application notification, text message, email, telephone and mail. Delivery notifications while you are on duty cannot be turned off, because a driver with an active delivery needs them. Everything else can be adjusted in the application.

11. How We Secure Your Information · Encrypted in transit at TLS 1.3 and at rest at AES-256 · The LABAU-issued device is supervised, enrolled in device management, restricted to the Concierge Driver application, and can be locked and wiped remotely · No member data is stored on the device outside an active delivery · Access to driver records is restricted by role and every access is logged · Verification and delivery records are immutable — they cannot be altered after the fact · Service providers with any access are bound by written obligations no less protective than this statement No system is perfectly secure. If a breach affects your personal information, we will notify you and the relevant authorities as required by law.

12. Your Rights Wherever you live, LABAU will honour the following. Depending on your state of residence you may have additional rights. · Access — ask what personal information LABAU holds about you and receive a copy · Correct — ask us to correct anything inaccurate

· Delete — ask us to delete your personal information, subject to what we must retain by law or to resolve an open claim · Withdraw biometric consent — move to the alternative verification method at any time · Limit — ask us to limit the use of sensitive personal information to the purposes permitted by law · Confirm — ask us to confirm that a request you made has been actioned How to make a request Contact us using the details in Section 15. We will verify your identity before acting on a request, normally by asking you to confirm details we already hold. We respond within thirty days, or tell you if we need longer. An authorised agent may make a request on your behalf with written authorisation signed by you. No retaliation LABAU will not retaliate against you for exercising any right in this section. Your employment, your pay, the deliveries assigned to you and your standing with LABAU are unaffected.

13. Children The LABAU driver program is not directed at anyone under eighteen, and LABAU does not knowingly collect information from anyone under that age.

14. Changes We may update this statement. Where a change is material we will notify you at least thirty days before it takes effect, and where the change concerns biometric information or your rights we will ask you to acknowledge it in the application. The date at the top records the last revision.

15. Contact Questions, requests or complaints about this statement: LABAU Holdings, Inc. kristina@labauholdings.com labau.com New York, New York

For support relating to your account or a delivery, contact operations through the Concierge Driver application.