Incident Response & Breach Notification Plan

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

LABAU ——————

Incident Response & Breach Notification Plan

LABAU Holdings, Inc. A Delaware Corporation

Internal — Confidential · September 2026

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 1

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

Purpose & Scope STATUS DRAFT FOR REVIEW BY KING & JURGENS LLC. Breach notification timing and

content are prescribed by statute and carry penalties. This plan must be reviewed by counsel and tested before launch.

This plan sets out what LABAU does when member, driver, partner or company information is exposed, lost, stolen or accessed without authorization — who decides, who is told, in what order, and within what time. It exists because the decisions in an incident are made badly under pressure. The point of writing them down now is that nobody has to invent them at two in the morning.

Scope · Any unauthorized access to, acquisition of, or disclosure of personal information held by LABAU or by a service provider on LABAU’s behalf · Loss or theft of a LABAU-issued device — driver iPhone, merchant kiosk, in-room iPad · Compromise of a LABAU account, credential, repository or hosting environment · Any incident at a service provider that affects LABAU data · Ransomware, extortion or any denial of access to LABAU systems

The Clock THIRTY DAYS FROM DISCOVERY New York requires notification of affected residents in the

most expedient time possible and without unreasonable delay, and in any event no later than thirty days following discovery. Notice to the Attorney General, the Department of State and the State Police is also required. Thirty days is an outer limit, not a target — the clock starts at discovery, not at the conclusion of the investigation.

Other states in which an affected member or driver resides may impose shorter deadlines or additional recipients. Counsel determines the full notification set once the affected population is known.

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 2

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

1 — Roles At six people, formal titles matter less than knowing who decides. These are roles, not headcount, and one person may hold more than one.

ROLE

HELD BY

RESPONSIBILITY

Incident Lead

Founder & CEO

Owns the incident. Makes the notification decision. Single point of authority — no committee.

Technical Lead

Technical co-founder

Contains the incident, preserves evidence, establishes what was accessed and when.

Legal

King & Jurgens LLC

Determines notification obligations, drafts regulator notices, advises on privilege.

Operations

Member Experience

Insurance

Director of Operations &

Partner and driver communications, device recovery,

Partnerships

operational continuity.

Director of Member

Member communications. Before Year 2 this sits with the

Experience (Year 2+)

Founder.

Founders Shield

Cyber policy notification — contact within the period the policy requires, which is usually short.

Notify the cyber insurer early, before the investigation concludes. Most policies require prompt notice and many provide breach counsel, forensics and notification services as part of the cover. Late notice can void the claim on an incident the policy would otherwise have paid for.

Contact Sheet Complete and keep current. Print a copy — an incident may take out the systems where it is stored.

Incident Lead — name and mobile: __________________________________ Technical Lead — name and mobile: __________________________________ King & Jurgens — contact and after-hours number: __________________________ Founders Shield — claims line and policy number: __________________________ Cloud hosting provider — support escalation: ____________________________ Payment processor — security contact: ______________________________ Device management — admin contact: ______________________________ LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 3

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

Forensics provider (if retained): ______________________________

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 4

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

2 — The Response Five phases. They overlap; phase two does not wait for phase one to finish.

Phase 1 — Detect and report (immediately) W HO

DOES WHAT

Anyone

Reports a suspected incident to the Incident Lead immediately, by telephone. Not email, not a form. There is no threshold for reporting a suspicion and nobody is ever criticised for raising one that proves to be nothing.

Incident Lead

Opens an incident record with the discovery time. That timestamp starts the statutory clock and must be accurate.

Incident Lead

Notifies the Technical Lead and counsel within the hour.

Phase 2 — Contain (first hours) · Lost or stolen device — lock and wipe remotely through device management immediately. Do not wait for the investigation. · Compromised credential — revoke, rotate, force re-authentication across all accounts for that person. · Compromised system — isolate rather than shut down where possible, so evidence survives. · Preserve everything. Do not delete logs, do not reimage a device, do not “tidy up”. Evidence of what was accessed determines the notification obligation. · Record every containment action with its timestamp.

Phase 3 — Assess (first days) Three questions determine everything that follows.

Q UE S TI ON

WHY IT MATTERS

What information was involved?

Determines whether it is “private information” under New York law, and whether any sensitive category is implicated.

Whose information was it?

Determines the notification set — New York residents, residents of other states, drivers, members, partners.

Was it actually accessed or

New York requires notification on unauthorized access as well as acquisition.

acquired?

Where a determination of no access is made, the basis must be documented and kept.

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 5

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

Assessment runs in parallel with preparing notification, never before it. Drafting begins on the assumption that notice is required; if the assessment concludes it is not, the draft is filed with the reasoning. Sequencing it the other way is how thirty days becomes thirty-one.

Phase 4 — Notify (within thirty days of discovery) Detailed at Section 3.

Phase 5 — Close · Written post-incident review within fourteen days of closure — what happened, how it was found, what was done, what would have prevented it · Remediation items assigned with owners and dates · Resource Center or policy updated where an article or a rule would have prevented it · Incident record retained permanently

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 6

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

3 — Notification 3.1 Who is notified RECIPIENT

WHEN

CONTENT

Affected individuals

Without unreasonable delay, and

See 3.2

no later than thirty days from discovery New York Attorney General

As required, on the state’s form

Timing, content, affected population, steps taken

New York Department of

As required

Same

New York State Police

As required

Same

Other state regulators

Where affected individuals reside

Per that state’s requirements

State

elsewhere — counsel determines Consumer reporting

Where the affected population

agencies

exceeds the statutory threshold

Cyber insurer

Immediately on discovery, ahead of

As required

Per policy

the assessment Affected partners

Where a building, hotel or

Direct, by telephone first

merchant’s information or people are involved

Law enforcement may request a delay to notification where it would impede an investigation. Any such request is documented and the delay runs only for the period specified.

3.2 What the notice says Plainly, in the LABAU voice, without minimising. A member paying $25,000 a year for discretion who learns of a breach from a defensive, lawyerly letter will draw a conclusion about LABAU that the breach itself did not warrant.

ELEM ENT

REQUIREMENT

What happened

In plain language, including the date of the incident and the date of discovery

What information was

Specific categories, not a generic list of everything LABAU holds

involved What LABAU has done

Containment, investigation, and any change made

What the individual should

Concrete steps, and what LABAU is providing — credit monitoring where

do

appropriate LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 7

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal ELEM ENT

REQUIREMENT

How to reach us

A named contact and a direct line, not a general support address

Regulator contacts

As required by law

Do not write “we take your privacy seriously.” Say what happened, say what was taken, say what you are doing, and apologise once. The members most likely to leave over a breach are the ones who feel managed rather than told.

3.3 Delivery · Members: written notice by email and by post, plus an in-app message. Telephone contact from the Founder for any member whose sensitive information was involved. · Drivers: written notice, plus a telephone call from operations. A driver whose bank details or taxpayer identifier were involved is called first. · Never notify members of a breach by push notification alone.

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 8

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

4 — Playbooks The four incidents most likely to occur, with the first three actions for each.

INCIDENT

FIRST THREE ACTIONS

Driver phone lost or stolen

1. Lock and wipe through device management immediately. 2. Confirm no delivery was active; if one was, secure the goods and the custody record. 3. Open incident record — assess whether any member data was resident on the device. Note: no member data is stored on a driver device outside an active delivery, and addresses decrypt only during one. This is usually an asset loss, not a data breach — but it is assessed every time.

Merchant kiosk stolen

1. Remote wipe. 2. Confirm the device cached no member data, per the fail-closed design. 3. Notify the partner and arrange replacement.

Platform or account

1. Revoke and rotate credentials, force re-authentication. 2. Isolate affected systems,

compromise

preserve logs. 3. Notify counsel and the insurer. Treat as a reportable breach until the assessment shows otherwise.

Service provider breach

1. Obtain written confirmation of what LABAU data was involved. 2. Assess LABAU’s independent obligation — the provider notifying its own regulators does not discharge LABAU’s duty to its members and drivers. 3. Notify counsel.

The last one is the trap. A breach at a payment processor, hosting provider or PMS vendor is still LABAU’s breach as far as LABAU’s members and drivers are concerned. The provider’s notification to its regulator does not satisfy LABAU’s obligation to the people whose information it collected.

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 9

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

5 — Preparation & Testing Before launch · Contact sheet completed and printed · Cyber policy confirmed, notification period noted, claims line recorded · Counsel briefed and an after-hours contact established · Data processing agreements executed with every service provider, each requiring prompt notification to LABAU of any incident affecting LABAU data · Device management tested — an actual remote wipe performed on a test device, not assumed to work · Logging confirmed sufficient to establish what was accessed and when. A breach that cannot be scoped must be notified at its widest. · A tabletop exercise run against the driver-phone and provider-breach playbooks

Ongoing AC TI VI T Y

FREQUENCY

Contact sheet reviewed and

Quarterly

reprinted Tabletop exercise

Annually, and after any material change to the platform

Plan reviewed by counsel

Annually, and on any change to applicable law

Service provider incident

At each contract renewal

obligations confirmed Remote wipe tested

Twice a year

Incident record One record per incident, retained permanently. Minimum contents:

Incident reference and date opened: __________________________ Discovery date and time (starts the clock): ________________________ Who reported it, and how: ______________________________ Description: ________________________________________ Information categories involved: ______________________________ LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 10

LABAU Holdings, Inc. | Incident Response & Breach Notification Plan | Internal

Individuals affected — number and states of residence: ______________________ Containment actions and timestamps: ____________________________ Notification decision and its basis: ____________________________ Notifications sent — to whom and when: __________________________ Closure date and post-incident review date: ________________________

LABAU Holdings, Inc. · Internal — Confidential · kristina@labauholdings.com

LABAU — INCIDENT RESPONSE & BREACH NOTIFICATION PLAN | INTERNAL | Page 11