PRIVACY POLICY & DATA PROTECTION PROTOCOL Effective Date: 02/16/2026 Last Updated: 02/16/2026 Version: 1.0 Phaedrus Trading & Services DBA Outriders Co. (“Company,” “we,” “us,” or “our”) operates a global motorcycle adventure touring business. We are committed to protecting your personal data with the same rigor we apply to our tour logistics. This Policy outlines our data practices in compliance with GDPR (EU/UK), PIPEDA (Canada), and US State Laws (including CCPA/CPRA).

1. WHO WE ARE

(DATA CONTROLLER) For the purposes of data protection laws, the Data Controller is: Phaedrus Trading & Services DBA Outriders Co. Registered Address: 30 N GOULD ST STE R SHERIDAN WY 82801 Privacy Officer Contact: RAJEEV BAGGA at [privacy@outridersco.com]

2. SCOPE OF INTEL

This policy applies to: ⦁ Website Visitors: Individuals browsing our digital assets. ⦁ Prospective Riders: Individuals submitting inquiries or downloading lead magnets. ⦁ Active Riders: Customers booking tours, utilizing support vehicles, or participating in expeditions.

3. INFORMATION WE COLLECT

A. Information You Provide (Direct Intel) ⦁ Identity Data: Name, passport details, nationality, date of birth. ⦁ Contact Data: Email address, phone number, billing/mailing address. ⦁ Financial Data: Payment details (processed securely via third-party processors; we do not store full credit card numbers). ⦁ Sensitive/Special Category Data (Critical): Due to the physical nature of our expeditions (high-altitude riding, remote locations), we may collect health and medical information, dietary restrictions, and emergency contact details. We collect this strictly for your safety and operational logistics. ⦁ Profile Data: Riding experience level, bike preferences, survey responses. B. Information Collected Automatically ⦁ Technical Data: IP address, browser type, time zone setting, location data. ⦁ Usage Data: How you navigate our site (heatmaps, clickstreams).

4. HOW WE USE YOUR INTEL

We do not sell your data. We use it to: 1. Execute the Mission: Process bookings, arrange permits (e.g., Inner Line Permits in Ladakh), book hotels, and manage motorcycle rentals. 2. Safety & Operations: Assess fitness for specific routes and provide medical aid if necessary. 3. Communication: Send booking confirmations, pre-ride briefings, and safety updates. 4. Marketing: Send the “Outriders Dispatch” newsletter (only with your consent). 5. Legal Compliance: Comply with local tourism laws in India, Vietnam, etc.

5. SHARING OF DATA

To execute a tour, we must share specific data with ground teams. We share only what is necessary: ⦁ Service Providers: Hotels, local guides, and motorcycle rental agencies in the destination country. ⦁ Government Authorities: For border permits, visa processing, and security checkpoints (e.g., Ladakh/China border areas). ⦁ Tech Stack: CRM systems, email marketing platforms, and payment gateways (all vetted for security).

6. INTERNATIONAL TRANSFERS

We are a US-based company operating tours in Asia. Your data will be transferred to: 1. The United States: Where our servers and HQ are located. 2. Destination Countries: (e.g., India, Vietnam) where local service providers require your details for bookings. For EU/UK/Canadian Residents: We transfer data based on Contractual Necessity (we cannot provide the tour without sending your info to the hotel in Ladakh) and/or Standard Contractual Clauses (SCCs) to ensure your data remains protected.

7. DATA RETENTION

We retain your data only as long as necessary: ⦁ Inquiry Data: 2 years (unless you subscribe to our newsletter). ⦁ Booking/Medical Data: 7 years (for liability, insurance, and tax purposes). ⦁ Marketing Data: Until you unsubscribe.

8. YOUR RIGHTS

A. For Global Users (including EU/UK/Canada) You have the right to: ⦁ Access: Request a copy of the data we hold. ⦁ Correction: Fix an error in your file. ⦁ Erasure (“Right to be Forgotten”): Ask us to delete data (subject to legal retention requirements). ⦁ Withdraw Consent: Unsubscribe from marketing at any time. B. For US Residents (California, Virginia, Colorado, etc.) ⦁ Right to Opt-Out: You may opt out of the “sale” or “sharing” of personal info for targeted advertising. ⦁ Non-Discrimination: We will not deny services if you exercise these rights. ⦁ Sensitive Data: You have the right to limit the use of your sensitive personal information (health data) to what is necessary for the service.

9. SECURITY PROTOCOLS

We utilize SSL encryption, secure servers, and limited-access protocols. However, no digital transmission is 100% secure. We encourage you to use our secure forms rather than emailing sensitive passport data.

10. CHILDREN

Our tours are strict 18+ (or 21+ for rentals). We do not knowingly collect data from children under 16.

11. CONTACT COMMAND

To exercise any rights or file a complaint, contact our Privacy Officer: Email: [privacy@outridersco.com] Subject Line: “DATA PRIVACY REQUEST”