Contract analysis

I. PURPOSE The Board of Directors (the "Board") of Cascade Retail Holdings Inc., a Delaware corporation listed on the Nasdaq Stock Market LLC ("Nasdaq") under the ticker symbol "CRHI," with its principal executive office located at 4800 Lakeview Blvd, Suite 1100, Bellevue, WA 98004 (together with its subsidiaries, the "Company"), hereby establishes the Technology & Cybersecurity Committee (the "Committee") as a stand

II. COMPOSITION AND MEMBERSHIP A. Number of Members The Committee shall consist of a minimum of three (3) members of the Board of Directors. All members of the Committee shall be "independent directors" as such term is defined under the applicable Nasdaq listing standards (including Nasdaq Listing Rule 5605(a)(2)) and the rules and regulations of the SEC. For the avoidance of doubt, no individual who serves as an off

III. AUTHORITY A. General Authority The Committee shall have the authority to carry out the purposes and responsibilities set forth in this Charter and to take such actions as it deems necessary or appropriate in the discharge of its oversight functions. The Committee is empowered to investigate any matter brought to its attention within the scope of its responsibilities, with full and unrestricted access to all book

IV. RESPONSIBILITIES AND DUTIES The following sets forth the principal recurring responsibilities and duties of the Committee. These responsibilities and duties are intended as a guide and are not exhaustive. The Committee may undertake such additional activities within the scope of its purpose as it deems necessary or appropriate in light of evolving business conditions, regulatory requirements, industry practices,

1. Overall IT Strategy. The Committee shall review and discuss with management the Company's overall information technology strategy, including digital transformation initiatives, technology infrastructure investments, and the alignment of the Company's technology strategy with its business objectives in multi-channel retail and e-commerce across the Company's specialty apparel, home goods, and outdoor lifestyle busi

2. Significant Technology Investments. The Committee shall review significant technology investments, capital expenditures, and major vendor relationships and contracts, including those involving cloud infrastructure, enterprise resource planning systems, point-of-sale systems, and e-commerce platforms. For purposes of this subsection, a "significant" technology investment or expenditure is one that (a) involves tota

3. Competitive Positioning. The Committee shall monitor the Company's technology competitive positioning relative to industry peers and shall periodically receive benchmarking reports and assessments comparing the Company's technology capabilities, maturity, and spending levels against comparable publicly traded retail companies.

4. Emerging Technologies. The Committee shall oversee management's evaluation and adoption of emerging technologies relevant to the Company's operations, including but not limited to cloud computing and multi-cloud strategies, e-commerce platforms and capabilities, supply chain and logistics technology, data analytics and business intelligence platforms, Internet of Things (IoT) applications in retail operations, and

1. Oversight of Cybersecurity Programs. The Committee shall oversee the Company's cybersecurity programs, policies, and procedures, including the Company's information security risk management framework (e.g., frameworks based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), the Center for Internet Security ("CIS") Controls, or comparable industry-standard frameworks).

2. Risk Management Strategy. The Committee shall review and assess the adequacy and effectiveness of the Company's cybersecurity risk management strategy, including threat identification and intelligence capabilities, vulnerability management and remediation processes, incident prevention, detection, and response capabilities, identity and access management controls, network security architecture and monitoring, endp

3. CISO Reports. The Committee shall receive and review periodic reports from the Chief Information Security Officer (or the functional equivalent thereof) regarding the state of the Company's cybersecurity posture. Such reports shall include, at a minimum, an overview of material cybersecurity incidents and near-miss events, a threat landscape assessment highlighting emerging threats relevant to the Company's indust

4. SEC Cybersecurity Disclosure Compliance. The Committee shall oversee management's compliance with the SEC Cybersecurity Disclosure Rules adopted in July 2023, including without limitation (a) the Company's processes for determining the materiality of cybersecurity incidents and the Company's obligations to file a Current Report on Form 8-K (Item 1.05) disclosing material cybersecurity incidents within four (4) bus

5. Coordination with Audit Committee. The Committee shall coordinate with the Audit Committee, currently chaired by Sandra Chen-Watkins, on cybersecurity risk matters that overlap with financial reporting, internal controls over financial reporting (as defined under the Sarbanes-Oxley Act of 2002, as amended), and enterprise risk management. The respective committee chairs shall communicate regularly to ensure that c

6. Incident Response Planning. The Committee shall review the Company's cybersecurity incident response plan (the "IRP") at least annually and shall oversee the conduct of tabletop exercises, simulations, and other testing activities designed to evaluate the effectiveness of the IRP and the Company's readiness to respond to cybersecurity incidents. The Committee shall receive a report on the results of each tabletop

7. Third-Party and Supply Chain Risks. The Committee shall review third-party and supply chain cybersecurity risks, including risks associated with key technology vendors, service providers, and business partners. The Committee shall oversee management's processes for assessing the cybersecurity posture of critical third parties, including the use of vendor risk assessment questionnaires, contractual cybersecurity re

1. Privacy Programs. The Committee shall oversee the Company's data privacy and data protection programs, policies, and compliance efforts, including the Company's privacy impact assessment processes and privacy-by-design principles.

2. Legal and Regulatory Compliance. The Committee shall monitor the Company's compliance with applicable data privacy laws and regulations, including without limitation the Washington Privacy Act (RCW 19.373, et seq.), the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and any other state consumer privacy laws applicable to the Company

3. Data Governance. The Committee shall review the Company's data governance framework, including data classification standards, data retention and disposal policies, data minimization practices, and data inventory and mapping processes.

4. Data Subject Rights and Breach Notification. The Committee shall oversee management's handling of data subject access requests, deletion requests, opt-out requests, and other rights requests under applicable privacy laws, as well as the Company's data breach notification obligations under applicable federal and state laws. D. Artificial intelligence Governance

1. AI Development and Deployment. The Committee shall oversee the Company's development, deployment, and use of artificial intelligence and machine learning technologies across its operations, including the procurement and integration of third-party AI tools and platforms.

2. AI Governance Framework. The Committee shall review and approve, or recommend to the Board for approval, the Company's AI governance framework, including the Company's ethical AI principles, bias monitoring and mitigation procedures, transparency and explainability standards, human oversight and accountability mechanisms, and processes for ongoing monitoring and auditing of AI systems.

3. Regulatory Developments. The Committee shall monitor legislative and regulatory developments related to AI governance at the federal, state, and international levels, and shall assess the potential impact of such developments on the Company's operations, compliance obligations, and strategic plans.

4. Significant AI Initiatives. The Committee shall review significant AI initiatives and use cases undertaken or proposed by the Company, including customer-facing AI applications (such as chatbots, personalized recommendations, and virtual try-on tools), algorithmic decision-making in supply chain management, demand forecasting, and inventory optimization, employee-facing AI tools (such as workforce scheduling and t

1. Digital Transformation Roadmap. The Committee shall oversee management's development and execution of the Company's digital transformation roadmap, including progress against milestones, key performance indicators, and return-on-investment metrics for significant digital transformation initiatives.

2. Partnerships and Acquisitions. The Committee shall review significant technology partnerships, joint ventures, and strategic technology acquisitions or investments, including any proposed transactions that involve material technology assets, intellectual property, or technology-related synergies. 3. intellectual Property. The Committee shall monitor technology-related intellectual property matters, including the C

1. Regulatory Monitoring. The Committee shall monitor regulatory developments in technology, cybersecurity, data privacy, and artificial intelligence at the federal, state, and international levels that may affect the Company's operations, compliance obligations, risk profile, or strategic plans.

2. Compliance Oversight. The Committee shall oversee management's compliance with applicable technology and cybersecurity-related laws, regulations, and listing standards, and shall receive reports from management on the results of compliance assessments, regulatory examinations, and external audits relating to technology and cybersecurity matters.

3. Information and Reporting Systems. Consistent with the Board's heightened Caremark oversight duties, the Committee shall ensure that appropriate information and reporting systems exist to provide the Committee and the Board with timely and accurate information regarding technology and cybersecurity risks. The Committee shall periodically assess whether the Company's reporting systems are adequate to enable the Boa

V. MEETINGS A. Frequency. The Committee shall meet at least four (4) times per year, approximately quarterly, or more frequently as circumstances require. The Chairperson of the Committee, or any two (2) members of the Committee, may call special meetings of the Committee at any time upon reasonable notice to all Committee members. Meetings may be held in person, by telephone conference, by video conference, or by an

VI. COORDINATION WITH OTHER COMMITTEES The Board recognizes that certain matters within the scope of the Committee's responsibilities may overlap with or relate to the responsibilities of other standing committees of the Board. To ensure comprehensive and coordinated oversight without gaps or unnecessary duplication, the Committee shall coordinate with the other committees of the Board as follows: Audit Committee. Th

VII. ANNUAL PERFORMANCE EVALUATION The Committee shall conduct an annual evaluation of its own performance, effectiveness, and the adequacy of this Charter. The evaluation shall assess, among other things, whether the Committee has fulfilled its responsibilities as set forth in this Charter, whether the Committee's composition and expertise are adequate, whether the Committee's meeting frequency and processes are suf

VIII. AMENDMENT This Charter may be amended, restated, or otherwise modified by the Board of Directors at any time by the affirmative vote of a majority of the directors then in office. The Committee shall review this Charter at least annually to determine whether amendments are warranted in light of changes in law, regulation, listing standards, governance best practices, or the Company's business operations. The Co

IX. DISSOLUTION OF AD HOC TECHNOLOGY & INNOVATION COMMITTEE The ad hoc Technology & Innovation Committee, established by resolution of the Board of Directors on September 15, 2022, is hereby dissolved effective as of the date of adoption of this Charter on March 11, 2024. The Ad Hoc Committee, having served the Company in a transitional capacity without a formal written charter, defined authority, or structured repor

X. GOVERNING LAW This Charter shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to the conflict of laws principles thereof. This Charter is adopted in furtherance of the authority vested in the Board under the DGCL, the Company's Restated Certificate of Incorporation, filed with the Delaware Secretary of State on October 3, 2016, and the Company's Amended and Rest

XI. EFFECTIVE DATE This Charter is effective as of March 11, 2024, the date of its adoption by the Board of Directors of Cascade Retail Holdings Inc. ATTESTATION AND CERTIFICATION This Charter of the Technology & Cybersecurity Committee of the Board of Directors of Cascade Retail Holdings Inc. was duly adopted by the Board of Directors at a duly convened meeting of the Board held on March 11, 2024, at which a quorum