Contract analysis

I. Executive Summary This memorandum summarizes the principal findings from Calderwood & Harkness LLP's review of the data privacy practices, cybersecurity posture, and compliance profile of NovaMart Global Inc. ("NovaMart" or the "Company") with applicable privacy and data security laws and regulations, conducted in connection with Cascade Retail Holdings Inc.'s ("Cascade") proposed acquisition of one hundred percen

II. Scope of Review A. Documents and Materials Reviewed In connection with our data privacy and cybersecurity due diligence review, Calderwood & Harkness reviewed the following categories of documents and materials, each of which was produced by NovaMart through the virtual data room administered by Calloway, Brandt & Loewe LLP (Richard Calloway and Simone Adesanya, counsel for the Seller). A detailed index of all do

1. Public-Facing Privacy Policy. NovaMart's privacy policy as published on its website (www.novamart.com/privacy) and within its mobile application (iOS and Android), including the current version (effective January 15, 2025) and archived versions dating back to the Company's initial launch in 2016. We reviewed a total of seven (7) versions of the privacy policy reflecting material updates over the Company's operatin

2. Public-Facing Terms of Service. NovaMart's terms of service governing both buyer and seller use of the platform, including the current buyer terms of service (effective March 1, 2024), the current seller terms of service (effective March 1, 2024), and prior versions thereof.

3. Internal Data Governance Policy and Data Classification Framework. NovaMart's internal data governance policy (version 3.2, last updated September 2024) and the Company's data classification framework, which categorizes data into four tiers: Public, Internal, Confidential, and Restricted.

4. Data Processing Agreements (DPAs). Data processing agreements and related data security addenda executed between NovaMart and its key third-party vendors and partners, including: (a) Pinnacle Cloud Solutions Inc. ("Pinnacle Cloud") — cloud hosting and infrastructure services; (b) PayStream Financial Technologies Inc. ("PayStream") — payment processing services; (c) Stratton Digital Media Inc. ("Stratton Digital")

5. Information Security Policy Suite. NovaMart's information security policies, including the following individual policies and procedures documents: (a) Acceptable Use Policy (version 2.1, effective July 2024); (b) Access Control Policy (version 3.0, effective October 2024); (c) Encryption Standards Policy (version 2.5, effective June 2024); (d) Incident Response Plan (version 4.0, effective November 2024); (e) Busi

6. SOC 2 Type II Audit Reports. SOC 2 Type II reports issued by Severin Beck CPAs LLP for fiscal years 2023 and 2024, covering the trust service criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy as applied to NovaMart's marketplace platform and supporting infrastructure.

7. Penetration Testing and Vulnerability Assessment Reports. Reports from external penetration testing and vulnerability assessments conducted within the last twelve (12) months, including a comprehensive external penetration test conducted by Blackpoint Security Partners LLC in October 2024 and quarterly automated vulnerability scans performed using internal and third-party scanning tools.

8. Data Breach and Security Incident Logs. NovaMart's internal breach and security incident log covering the five-year period from January 2020 through March 2025, including incident reports, root cause analyses, notification records, and remediation documentation.

9. Employee and Contractor Training Materials and Records. Materials from NovaMart's mandatory annual data privacy and security awareness training program, including training content, completion records, and phishing simulation results for calendar years 2023 and 2024.

10. Privacy Impact Assessments / Data Protection Impact Assessments. Records of privacy impact assessments conducted by NovaMart's legal and compliance team in connection with new product features, data collection practices, and third-party data sharing arrangements. We reviewed a total of nine (9) PIAs completed between 2022 and 2025.

11. Cookie Consent Management Platform. Configuration documentation and operational records for NovaMart's cookie consent management platform (operated through Sundial Solutions), including cookie categorization, consent collection mechanisms, and opt-out functionality.

12. Data Subject Access Request (DSAR) Logs and Procedures. NovaMart's DSAR intake and response procedures and logs documenting all DSARs received and processed from January 2023 through March 2025.

13. Regulatory Correspondence. All correspondence between NovaMart and federal or state regulators relating to privacy or data security matters, including correspondence with the Federal Trade Commission ("FTC"), state attorneys general, and other regulatory authorities.

14. Cyber Insurance Policy. NovaMart's cyber liability insurance policy details (reviewed in detail in the Insurance Due Diligence Memorandum; referenced herein for coverage scope and adequacy).

15. Management Interviews. Interviews conducted by Calderwood & Harkness with the following NovaMart personnel: (a) Priya Narasimhan, Co-Founder & Chief Technology Officer — interviewed on March 14, 2025 (in-person at NovaMart's Austin headquarters), covering cybersecurity architecture, technical controls, vendor management, and incident response capabilities; and (b) Amanda Trevino, General Counsel — interviewed on

1. Outstanding Data Room Items. As of the date of this memorandum, certain documents requested by Calderwood & Harkness through the virtual data room have not yet been produced by NovaMart or Seller's Counsel (Calloway, Brandt & Loewe LLP, Richard Calloway / Simone Adesanya). Specifically, we are awaiting production of: (a) complete DPA documentation for four (4) mid-tier vendors identified in NovaMart's vendor regis

2. No Independent Technical Assessment. Calderwood & Harkness did not conduct independent technical penetration testing, vulnerability scanning, source code review, or any other form of independent technical security assessment of NovaMart's systems, applications, or infrastructure. Our assessment of NovaMart's cybersecurity posture is based solely on our review of the Company's existing third-party assessment report

3. No On-Site Inspection. Calderwood & Harkness did not conduct on-site inspections of any NovaMart data centers, fulfillment centers, or corporate offices. Our review of physical security controls and physical data handling practices at the Company's fourteen (14) fulfillment centers and its corporate headquarters is limited to documentary evidence and management representations.

4. Reliance on Representations. Certain factual statements contained in this memorandum are based on representations made by NovaMart's management during interviews and in responses to our due diligence questionnaire. We have not independently verified all such representations, and our findings are subject to the accuracy and completeness of the information provided to us.

III. Nature and Volume of Data Collected and Processed NovaMart collects, processes, stores, and shares a substantial volume of personal data across multiple categories of data subjects. The following sections describe the principal categories of personal data maintained by NovaMart, the approximate volumes thereof, and the data flows associated with the Company's operations. A visual representation of NovaMart's dat

1. Account Registration Data. Full legal name, email address, telephone number, mailing and/or shipping address(es), and date of birth (collected on an optional basis for age-verification and promotional purposes). NovaMart also collects account credentials (username and hashed password).

2. Payment Card and Financial Account Information. Credit card numbers, debit card numbers, and associated billing information. This data is processed through NovaMart's payment processor, PayStream Financial Technologies Inc. NovaMart represents that it does not store full payment card numbers (primary account numbers, or "PANs") on its own systems and instead relies on PayStream's tokenization infrastructure. NovaM

3. Transaction and Order Data. Complete transaction history, including order details, product descriptions, quantities, pricing, shipping addresses, delivery status, and return and refund records. NovaMart retains historical transaction data spanning from the Company's founding in 2016 to the present.

4. Browsing, Search, and Behavioral Data. Search queries, product browsing history, clickstream data, time-on-page metrics, product reviews and ratings authored by buyers, wish list and favorites data, and cart abandonment data. This data is used for personalization, recommendation algorithms, and advertising purposes.

5. Device and Technical Data. Device identifiers (including mobile advertising identifiers such as IDFA and GAID), IP addresses, browser type and version, operating system, geolocation data (derived from IP address and, where permitted, GPS data from mobile devices), and cookies and tracking technologies. NovaMart deploys first-party cookies and, through its advertising partnership with Stratton Digital Media Inc., c

6. Customer Service Communications. Records of customer service interactions, including email correspondence, live chat transcripts, and telephone call recordings and transcripts. NovaMart's customer service operations are conducted in-house from its Austin headquarters, with overflow support provided by a third-party customer service vendor.

7. Marketing Preferences. Records of marketing opt-in and opt-out elections, email subscription preferences, SMS marketing consent records, and push notification preferences. Estimated Volume and Historical Depth: NovaMart maintains approximately 9.1 million registered buyer profiles. Historical transaction data spans from the Company's launch in 2016 to the present, representing approximately nine years of accumulat

1. Business and Individual Identity Information. Seller name (individual or business entity name), business address, primary contact name, email address, telephone number, and website URL. For individual sellers (sole proprietors), this includes the individual's legal name and personal address.

2. Tax Identification and Financial Information. Employer Identification Number (EIN) or Social Security Number (SSN) for tax reporting purposes, bank account information (routing number and account number) for disbursement of seller proceeds, and W-9 certification data. NovaMart issues IRS Form 1099-K to sellers meeting applicable reporting thresholds.

3. Tax Documentation. Completed IRS Form W-9 (or W-8BEN/W-8BEN-E for non-U.S. sellers, though the platform is primarily U.S.-focused), copies of issued 1099-K forms, and associated tax correspondence.

4. Sales Performance and Platform Data. Sales volume and revenue data, product listing information and catalog data, seller ratings and reviews, seller performance metrics, and communications between sellers and NovaMart (including policy compliance notifications and seller support interactions).

5. Identity Verification Documents. Government-issued photo identification (e.g., driver's license, passport), proof of address documentation, and, for certain high-volume sellers, business registration documents. These documents are collected as part of NovaMart's seller onboarding and identity verification process. Estimated Volume: Approximately 62,400 active seller accounts plus approximately 18,700 inactive or c

1. Standard Human Resources Data. Full legal name, home address, Social Security Number, date of birth, compensation and payroll information, benefits enrollment records, direct deposit banking information, performance reviews and disciplinary records, and background check results (conducted at hire for all employees).

2. Fulfillment Center Employee Data — Biometric Data. At certain NovaShip fulfillment centers, NovaMart collects biometric data in the form of fingerprint scans or badge-based biometric scans for timekeeping and access control purposes. Based on our review, biometric data collection currently occurs at the following facilities: (a) NovaMart Fulfillment Center — Joliet, IL (fingerprint scan for timekeeping); (b) NovaM

3. Workplace Surveillance Data. Video surveillance footage from security cameras installed at fulfillment centers and corporate offices, badge swipe access logs, and, at certain facilities, vehicle license plate recognition data for parking access. D. Data Flows and Storage NovaMart's data flows across multiple internal and external systems, as depicted in the Data Flow Diagram attached as Appendix C. The principal d

1. Primary Data Hosting — Pinnacle Cloud Solutions Inc. NovaMart's marketplace platform, including the buyer and seller databases, transaction data, and application infrastructure, is hosted on cloud infrastructure provided by Pinnacle Cloud Solutions Inc. ("Pinnacle Cloud"), headquartered in Redmond, Washington. Pinnacle Cloud operates data centers located exclusively within the United States. Based on our review of

2. Payment Data — PayStream Financial Technologies Inc. Payment card data is tokenized at the point of entry and processed through PayStream Financial Technologies Inc. ("PayStream"). PayStream is a PCI DSS Level 1 certified payment processor. NovaMart represents that it does not store, process, or transmit full primary account numbers on its own systems; all payment card data is handled within PayStream's PCI-compli

3. Advertising Data — Stratton Digital Media Inc. NovaMart shares certain buyer behavioral data with Stratton Digital Media Inc. ("Stratton Digital") under a Data Sharing and Advertising Revenue Agreement for the purpose of enabling targeted advertising on and off the NovaMart platform. The categories of data shared with Stratton Digital include hashed email addresses, browsing and purchase history segments, device i

4. Logistics and Shipping Data — Redline Freight Corp. NovaMart shares buyer shipping data with Redline Freight Corp. ("Redline Freight") for the purpose of order fulfillment through the NovaShip logistics network. Data shared includes buyer name, shipping address, order reference number, and package contents descriptions. The DPA with Redline Freight includes a provision requiring deletion of buyer personal data wit

5. Data Retention Policy. NovaMart's Data Retention and Destruction Policy (version 1.8, effective May 2024) provides for the following retention periods: (a) Buyer data: Retained for seven (7) years following the date of the buyer's last activity on the platform (last login, purchase, or customer service interaction); (b) Seller data: Retained for seven (7) years following the date of seller account closure, which N

IV. Privacy Policy and Terms of Service Review A. Public-Facing Privacy Policy NovaMart maintains a publicly accessible privacy policy on its website (www.novamart.com/privacy) and within its mobile applications. The current version of the privacy policy is dated January 15, 2025, and reflects the most recent substantive revision. Prior to the current version, the privacy policy was updated in March 2024, June 2023,

V. Applicable Privacy and Data Protection Laws A. Federal Law

Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, prohibits "unfair or deceptive acts or practices in or affecting commerce." The FTC has used this authority extensively to bring enforcement actions against companies whose data practices are inconsistent with their privacy policy representations or that fail to implement reasonable data security measures. NovaMart's public-facing privacy policy constitut

2. CAN-SPAM Act The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, 15 U.S.C. §§ 7701–7713, governs commercial email communications. NovaMart's marketing emails, based on our review of sample emails provided in the data room, include the required elements: accurate sender identification, a physical mailing address, clear identification as advertising, and a functioning opt-out mechanis

3. COPPA. The Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the FTC's implementing regulations at 16 C.F.R. Part 312, impose requirements on operators of websites and online services directed to children under 13, or that have actual knowledge of collecting personal information from children under 13. NovaMart's terms of service require users to be at least 18 years of age, and the platform is

4. Gramm-Leach-Bliley Act The Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, and its implementing regulations apply to "financial institutions," a term defined broadly to include entities that are "significantly engaged" in financial activities. NovaMart is not a financial institution within the meaning of the GLBA. However, NovaMart's handling of payment card data through PayStream, its maintenance of sell

5. Internal Revenue Code / IRS Requirements NovaMart is subject to IRS Form 1099-K reporting requirements as a third-party settlement organization under Internal Revenue Code § 6050W. NovaMart issues 1099-K forms to sellers meeting applicable reporting thresholds. The Company's collection and retention of seller tax identification information (SSN/EIN) and financial data is driven in part by these reporting obligatio

1. Right to Know / Access (§ 1798.100, 1798.110, 1798.115). NovaMart provides California consumers with the ability to submit requests to know what personal information has been collected, the categories of sources, the business or commercial purposes for collection, the categories of third parties with whom information is shared, and the specific pieces of personal information collected. DSAR requests are submitted

2. Right to Delete (§ 1798.105). NovaMart provides California consumers with the ability to submit deletion requests. Upon receiving a verified deletion request, NovaMart deletes the consumer's account and associated personal information, subject to exceptions for data required to complete transactions, maintain security, comply with legal obligations, and fulfill internal business purposes. NovaMart received approxi

3. Right to Opt Out of Sale/Sharing (§ 1798.120, 1798.121). As discussed above, NovaMart's data sharing with Stratton Digital Media Inc. likely constitutes a "sale" and/or "sharing" of personal information under the CCPA. NovaMart provides a "Do Not Sell or Share My Personal Information" link and opt-out mechanism, and NovaMart represents that it implemented Global Privacy Control (GPC) recognition in Q4 2024. Based

4. Right to Correct (§ 1798.106). NovaMart provides a mechanism for consumers to correct inaccurate personal information through their account settings page and through DSAR submissions. This right appears to be adequately implemented.

5. Right to Limit Use of Sensitive Personal Information (§ 1798.121). NovaMart collects certain categories of sensitive personal information, including precise geolocation data (from mobile app users who grant location access), financial account information (truncated payment card data and transaction data), and account log-in credentials. NovaMart provides a "Limit the Use of My Sensitive Personal Information" link

6. Non-Discrimination (§ 1798.125). NovaMart's privacy policy includes a non-discrimination statement, and we did not identify evidence of discriminatory practices against consumers who exercise their privacy rights.

7. Service Provider and Contractor Agreements. The CCPA requires that businesses enter into contracts with service providers and contractors that process personal information on the business's behalf, restricting the service provider's or contractor's use of personal information to the business purposes specified in the contract. We reviewed the DPAs with NovaMart's five key vendors (Pinnacle Cloud, PayStream, Stratt

1. Texas Data Privacy and Security Act (TDPSA) The Texas Data Privacy and Security Act, Tex. Bus. & Com. Code §§ 541.001–541.205, is particularly relevant given NovaMart's headquarters in Austin, Texas and its substantial operational nexus with the state. The TDPSA, effective July 1, 2024, applies to entities that conduct business in Texas, process or engage in the sale of personal data, and are not classified as sma

2. Virginia Consumer Data Protection Act (VCDPA) The Virginia Consumer Data Protection Act, Va. Code §§ 59.1-575–59.1-585, applies to entities that control or process the personal data of at least 100,000 Virginia consumers or that control or process the personal data of at least 25,000 Virginia consumers and derive over 50% of gross revenue from the sale of personal data. NovaMart estimates that it has approximately

3. Colorado Privacy Act (CPA) and Connecticut Data Privacy Act (CTDPA) Both the Colorado Privacy Act and the Connecticut Data Privacy Act impose requirements similar to the VCDPA, including consumer rights, purpose limitation, data minimization, and opt-out rights for targeted advertising and sale of personal data. NovaMart's user base in both states exceeds applicable thresholds. NovaMart's privacy program appears g