Last updated September 2026

Notice at Collection

Draft for review by King & Jurgens LLC. Final wording will be confirmed by counsel before launch.

Notice at Collection Member and Driver — short-form notice given at the point of collection

STATUS DRAFT FOR REVIEW BY KING & JURGENS LLC. A Notice at Collection is a specific

statutory instrument with prescribed elements, and its applicability depends on whether LABAU meets the thresholds in the relevant state law and on the residence of the individual. Counsel should confirm both before publication.

Last updated: ______________________

Why This Document Exists Several state privacy laws require that an individual be told, at or before the moment their personal information is collected, what is being collected and why. That notice must be short, must appear at the point of collection rather than buried in a longer policy, and must cover six things: the categories of personal information collected including any sensitive categories; the purposes for which each is used; whether any of it is sold or shared; how long it is kept; a link to opt out of any sale or sharing where applicable; and a link to the full privacy statement. This document contains two notices — one for members and one for LABAU Concierge Drivers. Each is written to stand alone at the point of collection and links to the fuller statement behind it.

W HER E I T AP P E ARS

WHICH NOTICE

Member account creation, before the first

Member notice

field is completed Footer of every LABAU app screen that

Member notice

collects information, and the website footer Driver application and onboarding, before any

Driver notice

information is submitted Footer of the Concierge Driver App account

Driver notice

screens

Notice at Collection — Members

LABAU Holdings, Inc. collects the following categories of personal information about members, for the purposes stated. This notice is given at the point of collection. The full LABAU Privacy Policy sets out our practices in detail.

CATEGORY

WHY WE COLLECT IT

KEPT FOR

Identifiers — name, email,

Operating your membership and

The life of your membership, and a

telephone, membership number

contacting you about orders

reasonable period afterwards for legal and tax purposes

Delivery information —

Delivering to the right place, in the way

Same as above. Addresses are encrypted

addresses, unit or room

you asked

and decrypted only during an active

number, handoff preferences

delivery.

Commercial information —

Personalising the service and supporting

Retained to support disputes, returns and

orders, browse history, returns

your orders

the chain of custody record

Preferences — style profile,

Personalising recommendations and

Until you delete them, or on closure of

sizes, favourite merchants, pet

filtering out what will not fit

your account

Preparing recommendations ahead of

Until you delete them, or on closure of

occasions you choose to share

your account. Encrypted; not readable by

profile Private calendar events

LABAU staff. Financial — a token

Billing your annual membership and

Deleted on closure of your account,

representing your payment

passing on gratuity

subject to legal retention

Internet and device activity

Operating and securing the platform

Twelve months

Geolocation — delivery address

Completing a delivery. LABAU does not

With the delivery record

only

track member device location.

card

Sensitive personal information. LABAU does not collect biometric information, precise device geolocation, government identifiers, racial or ethnic origin, health information, or the contents of your communications with anyone other than LABAU. Where any information we hold would be treated as sensitive under applicable law, we use it only to provide the service you have asked for and for the security of the platform. SALE AND SHARING LABAU does not sell personal information. LABAU does not share

personal information for cross-context behavioral advertising. LABAU runs no advertising of any kind and has no advertising platform. Because there is no sale or sharing, there is no opt-out to offer — but where your browser or device sends a Global Privacy Control signal, we honour it.

Automated decision-making. LABAU uses recommendation technology to personalise what you are shown — Cart, 209 LABAU and lifestyle planning. These affect what is suggested to you and nothing else. No automated technology determines whether you are admitted to membership, what you are charged, or whether a delivery is accepted. Your rights and the full statement. You may access, correct or delete your personal information, and exercise any additional rights available where you live. See the LABAU Privacy Policy, linked below, or contact kristina@labauholdings.com.

Notice at Collection — LABAU Concierge Drivers LABAU Holdings, Inc. collects the following categories of personal information about Concierge Drivers and applicants, for the purposes stated. This notice is given at the point of collection. The full LABAU Driver Privacy Statement sets out our practices in detail.

CATEGORY

WHY WE COLLECT IT

KEPT FOR

Communications and incident

Supporting you and resolving incidents

The engagement, and while any matter is

reports

open

Claims information

Handling a claim arising from your

As required by law and the insurer

services

Biometric Information WHAT WE DO NOT COLLECT LABAU does not collect, capture, receive, store or possess a

biometric identifier, template, scan or image. Identity verification is performed on the LABAU-issued device by the device manufacturer's own biometric system. LABAU receives only the result — a pass or a fail — with its timestamp, location and device identifier.

Consent is obtained in writing before activation, and a non-biometric alternative is available to any driver who declines or withdraws consent. Declining does not affect your engagement. Retention and destruction. Verification records attached to a completed delivery are kept for the period required to resolve disputes, returns and claims relating to that delivery, and are then permanently deleted. Verification records not attached to a completed delivery are deleted after thirty days. All driver verification data is permanently deleted no later than one year after the engagement ends, or when the initial purpose has been satisfied, whichever occurs first. LABAU does not sell, lease, trade or otherwise profit from biometric information or verification data.

Sensitive Personal Information — Drivers Some of the categories above are treated as sensitive under applicable state law, including your government identifiers, financial account details, precise geolocation while on duty, and background screening outcome. LABAU uses each of them only for the purpose stated in the table and for the security and integrity of the platform. We do not use them to infer characteristics about you.

Sale, Sharing and Automated Decisions — Drivers LABAU does not sell driver personal information and does not share it for cross-context behavioral advertising. There is no advertising platform and no opt-out to offer.

Automated decision-making. LABAU does not use automated technology to decide whether you are activated, whether you are deactivated, or whether a delivery is assigned to you. Delivery assignment is

based on availability and proximity. There is no acceptance rate, no completion rate, no rating-based tier and no algorithmic ranking of drivers.

Your Rights · Access — ask what we hold about you and receive a copy · Correct — ask us to correct anything inaccurate · Delete — ask us to delete your information, subject to what we must keep by law or to resolve an open claim · Withdraw biometric consent — move to the alternative method at any time · Limit — ask us to limit the use of sensitive personal information to the purposes permitted by law · Confirm — ask us to confirm a request was actioned; the state is also shown in the app LABAU will not retaliate against you for exercising any of these rights. Your engagement, your rate, the deliveries assigned to you and your standing with LABAU are unaffected.

Contact and Full Statements LABAU Holdings, Inc. kristina@labauholdings.com · labau.com · New York, New York

Members: the LABAU Privacy Policy. Drivers: the LABAU Driver Privacy Statement and the LABAU Biometric Data Policy.

Both notices above must be linked, not buried. A Notice at Collection satisfies its purpose only if it is presented at or before the moment information is collected — on the account creation screen, on the driver application, and in the footer of any screen that collects information. Placing it only inside a settings menu does not satisfy the requirement.