Contract analysis

I. Executive Summary This memorandum provides a legal-compliance review of the data-mapping report prepared and delivered by Fieldhaven Consulting Group LLC ("Fieldhaven") on May 19, 2025 (the "Fieldhaven Report"). The Fieldhaven Report was commissioned by Cascade Retail Holdings Inc. ("Cascade" or "CRH") as part of the technical workstream under Fieldhaven's fixed-fee statement of work (total contract value: $3,150,

II. Background A. Engagement Context Calderwood & Harkness LLP was engaged by Cascade Retail Holdings Inc. on June 2, 2025, pursuant to an executed engagement letter of the same date, to design, build, and implement a comprehensive US state-privacy compliance program. The engagement encompasses legal analysis, policy and notice drafting, contract template development, vendor assessment, regulatory-response framework

1. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — Cal. Civ. Code §§ 1798.100 et seq.

2. Virginia Consumer Data Protection Act (VCDPA) — Va. Code §§ 59.1-575 et seq.

3. Colorado Privacy Act (CPA) — Colo. Rev. Stat. §§ 6-1-1301 et seq.

4. Connecticut Data Privacy Act (CTDPA) — Conn. Gen. Stat. §§ 42-515 et seq.

5. Utah Consumer Privacy Act (UCPA) — Utah Code §§ 13-61-101 et seq.

6. Iowa Consumer Data Protection Act (ICDPA) — Iowa Code ch. 715D

7. Indiana Consumer Data Protection Act (INCDPA) — Ind. Code §§ 24-15-1-1 et seq.

8. Tennessee Information Protection Act (TIPA) — Tenn. Code §§ 47-18-3201 et seq.

9. Montana Consumer Data Privacy Act (MCDPA) — Mont. Code §§ 30-14-2801 et seq.

10. Texas Data Privacy and Security Act (TDPSA) — Tex. Bus. & Com. Code ch. 541

11. Oregon Consumer Privacy Act (OCPA) — Or. Rev. Stat. §§ 646A.570 et seq.

12. Delaware Personal Data Privacy Act (DPDPA) — Del. Code tit. 6, ch. 12D

13. New Jersey Data Privacy Act (NJDPA) — N.J. Stat. §§ 56:8-166 et seq.

14. New Hampshire Data Privacy Act (NHDPA) — N.H. Rev. Stat. ch. 507-H

15. Nebraska Data Privacy Act (NDPA) — Neb. Rev. Stat. §§ 87-1101 et seq.

16. Minnesota Consumer Data Privacy Act (MCDPA) — Minn. Stat. ch. 325O

17. Maryland Online Data Privacy Act (MODPA) — Md. Code, Com. Law §§ 14-4601 et seq.

18. Kentucky Data Privacy Act (KYDPA) — Ky. Rev. Stat. ch. 367

19. Additional statutes enacted or effective through the 2025–2026 legislative cycle as identified during the engagement. Cascade operates retail locations in thirty-one (31) US states and ships e-commerce orders to all fifty (50) states plus the District of Columbia. The geographic scope of Cascade's consumer base, combined with the broad applicability thresholds of most state privacy statutes (typically triggered b

1. Cascade Retail Holdings Inc. (parent entity; Delaware corporation; EIN: 84-3192057). Cascade Retail Holdings is the publicly traded parent entity and operates the core direct-to-consumer retail business and e-commerce platform at cascade.com. This entity is the primary "business" for CCPA purposes and is the entity that collects the majority of consumer personal information through its online and in-store channels

2. Cascade Digital Marketplace LLC ("CDM") (Delaware limited liability company; EIN: 85-4107638). CDM operates the third-party seller marketplace at cascade.com/marketplace, which hosts approximately 3,800 third-party sellers. CDM collects and processes consumer data generated through marketplace transactions, seller account information, and related commercial data. CDM is a wholly owned subsidiary of Cascade Retail

3. Ridgeline Fulfillment Services Inc. ("Ridgeline") (Washington corporation; EIN: 91-1647823). Ridgeline operates warehousing and logistics services for Cascade's retail and e-commerce operations, including order fulfillment, shipping, and returns processing. Ridgeline processes shipping addresses, order data, and limited consumer contact information for delivery coordination purposes. Ridgeline is a wholly owned su

4. Peakview Analytics Inc. ("Peakview") (Delaware corporation; EIN: 87-2250194). Peakview is Cascade's in-house advertising technology and customer analytics subsidiary. Peakview receives consumer-event data from across the Cascade ecosystem and processes it for audience segmentation, ad targeting, personalization, and analytics purposes. Peakview is a wholly owned subsidiary of Cascade Retail Holdings and is the mos

5. Cascade Rewards Corp. ("Cascade Rewards") (Delaware corporation; EIN: 86-3381729). Cascade Rewards operates the Cascade Rewards loyalty and stored-value card programs. With approximately 41.2 million registered members, Cascade Rewards maintains one of the largest consumer databases within the Cascade ecosystem. Cascade Rewards is a wholly owned subsidiary of Cascade Retail Holdings. All five entities share common

III. Scope and Methodology of the Fieldhaven Report A. Data-Mapping Scope Fieldhaven mapped data flows across all five Cascade entities identified in Section II.D above. The scope of the data-mapping exercise was defined in the Fieldhaven statement of work and further refined during the data-mapping workshop held on June 16, 2025. The scope encompassed the following systems, platforms, and data environments: • Consum

IV. Categories of Personal Information Collected A. Overview of PI Categories Identified The Fieldhaven Report identifies the following categories of personal information collected by Cascade across its five entities and consumer-facing platforms. We present these categories using the CCPA/CPRA statutory taxonomy (Cal. Civ. Code § 1798.140(v)), which provides the most granular and widely referenced classification fra

V. Legally Significant Data Flows — Detailed Analysis This Section provides a detailed analysis of each legally significant data flow identified in the Fieldhaven Report. For each data flow, we describe the factual findings from the Fieldhaven Report, apply the relevant CCPA/CPRA classification framework, note additional state-statute implications where material, and provide remediation recommendations. A. Peakview A

1. Factual Findings Peakview Analytics Inc. is the most data-intensive entity within the Cascade corporate family. The Fieldhaven Report documents that Peakview processes approximately 2.1 billion consumer-event data records per month. This volume reflects the aggregation of consumer interactions from across the Cascade ecosystem, including: • Click-stream data from cascade.com browsing sessions; • Product-view event

2. CCPA Classification Peakview is a wholly owned subsidiary of Cascade Retail Holdings Inc. For CCPA purposes, the relevant question is whether Peakview's receipt and processing of consumer personal information from Cascade constitutes a disclosure to a "third party" or, alternatively, falls within the intra-business-family treatment. Under CCPA/CPRA Section 1798.140(c), "business" includes an entity that controls o

3. Recommendations. (a) Confirm and document that Peakview's data processing falls within the "common branding" business-family exception under CCPA/CPRA Section 1798.140(c), and maintain records sufficient to demonstrate common branding and common ownership/control. This documentation should be included in Cascade's record-of-processing-activities. (b) Ensure that Peakview's downstream transmissions to third parties

1. Overview. The Fieldhaven Report identifies a total of forty-seven (47) third-party advertising and analytics partners to whom Cascade discloses consumer personal information. These partners span a range of functional categories, including demand-side platforms, data-management platforms, social-media advertising platforms, programmatic-advertising exchanges, retargeting/remarketing service providers, attribution a

2. CCPA Classification of Data Flows The CCPA/CPRA provides four principal categories under which a disclosure of personal information to an external party may be classified: sale, sharing, service-provider processing, and contractor processing. The classification of each of the 47 partner relationships determines the applicable consumer rights and business obligations. "Sharing" (Cross-Context Behavioral Advertising

3. DPA Coverage Gap The DPA coverage gap is among the most significant compliance deficiencies identified through the data map. Twenty-three (23) of the 47 third-party advertising and analytics partners lack executed data-processing agreements with Cascade. Without DPAs containing the contractual provisions required by CCPA/CPRA Sections 1798.140(ag) and (j), disclosures to these partners cannot qualify as service-pr

1. Factual Findings Thornbridge Media Corp. ("Thornbridge"), a Nevada corporation headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117, is Cascade's primary programmatic-advertising and audience-targeting partner. The Thornbridge relationship is the single largest external data-sharing arrangement identified in the Fieldhaven Report, both in terms of data volume and financial magnitude. Casca

2. Current Contractual Framework The existing Cascade-Thornbridge agreement was executed prior to the effective date of the CPRA amendments and does not contain CCPA/CPRA-compliant data-processing terms. Specifically, the existing agreement: (a) Does not include the contractual restrictions required for service-provider or contractor classification under CCPA/CPRA (including prohibition on selling/sharing, use-limita

3. CCPA Classification The Thornbridge relationship involves both "sale" and "sharing" under CCPA/CPRA, as follows: Sale. Cascade receives advertising services, technology platform access, and a revenue-share arrangement in exchange for the disclosure of consumer personal information to Thornbridge. The advertising services and revenue-share constitute "monetary or other valuable consideration" under Section 1798.140

4. Risk Assessment The Thornbridge relationship is the highest-risk third-party data relationship identified in the data map. The combination of (i) the volume and sensitivity of data shared, (ii) the absence of CCPA-compliant contractual terms, (iii) the dual sale/sharing classification, (iv) the financial magnitude of the relationship, and (v) the involvement of precise geolocation data (a category of sensitive per

5. Counterparty Information Thornbridge is represented by Kellner Park & Associates LLP, with lead attorney Victor Sandoval located at 555 Mission Street, 32nd Floor, San Francisco, California 94105. Thornbridge's General Counsel is Leah Voss, and its Chief Executive Officer is Robert Shin. Calderwood & Harkness should expect that Thornbridge will be represented by experienced privacy counsel and that the restructuri

6. Recommendation. The Thornbridge data-sharing agreement must be restructured as a matter of the highest priority. We recommend the following approach: (a) Negotiate and execute a restructured Cascade-Thornbridge data-sharing agreement that addresses CCPA sale/sharing classification, includes appropriate data-use limitations, and incorporates the contractual provisions required for any data flows that are to be trea

1. Factual Findings CDM hosts approximately 3,800 third-party sellers on cascade.com/marketplace. The marketplace platform enables third-party sellers to list products, process transactions with consumers, and access fulfillment and logistics services through Ridgeline. The Fieldhaven Report reveals a significant architectural concern: seller-originated data — including seller account information, seller transaction

2. Legal Concerns The data-commingling issue raises several interconnected legal concerns: Cross-Contamination Risk. If seller data includes personal information collected under different privacy notices or with different consumer consents than Cascade's first-party data, commingling creates unauthorized secondary uses. For example, a consumer who purchases a product from a third-party seller on cascade.com/marketpla

3. Recommendation. (a) Implement data segregation — either logical or physical — between marketplace seller/consumer data and Cascade first-party customer data. Logical segregation (through tagging, access controls, and data-classification metadata) may be sufficient if properly implemented and enforced, and is likely more cost-effective than physical segregation. (b) Establish role-based access controls restricting

1. Factual Findings Cascade Rewards Corp. manages the Cascade Rewards loyalty program, which currently has approximately 41.2 million registered members across all fifty US states and the District of Columbia. The program is one of the largest consumer-data repositories in the Cascade ecosystem. Personal information collected through the loyalty program includes: member name, email address, mailing address, phone num

2. CCPA Financial Incentive Analysis The Cascade Rewards program constitutes a "financial incentive" program under CCPA/CPRA Section 1798.125(b). A "financial incentive" includes a program that provides the consumer with a price or service difference in exchange for the consumer's provision of personal information. The Cascade Rewards program offers members points-based rewards, exclusive discounts, early access to s

3. Data Sharing Concerns The sharing of loyalty-program data with Peakview for analytics and audience segmentation is an intra-entity transfer within the Cascade business family and does not independently trigger sale/sharing classification. However, the subsequent use of loyalty-program-derived audience segments and targeting profiles for third-party advertising — including disclosure to external partners — does tri

4. Data Retention The Fieldhaven Report confirms that no documented retention schedule currently exists for loyalty-program data. Member records, including those of inactive members who have not engaged with the program for multiple years, are retained indefinitely. This practice is inconsistent with data-minimization requirements under CCPA/CPRA and multiple other state statutes and must be addressed as part of the

1. Factual Findings Ridgeline Fulfillment Services Inc., a Washington corporation (EIN: 91-1647823), operates warehousing and logistics services for Cascade's retail and e-commerce operations. Ridgeline processes the following categories of personal information in connection with order fulfillment: shipping addresses, order data (product and quantity information), and in some cases consumer phone numbers for delivery

2. Legal Classification As a wholly owned subsidiary of Cascade Retail Holdings sharing common branding under the "Cascade" name, Ridgeline's receipt and processing of consumer personal information from other Cascade entities is an intra-business transfer that does not trigger sale or sharing classification under CCPA/CPRA. Ridgeline's external data sharing is limited. The Fieldhaven Report confirms that Ridgeline sh

3. Risk Assessment The Ridgeline data flows present a lower risk profile compared to the other data flows analyzed in this memorandum. The categories of personal information processed are limited, the purposes of processing are well-defined and aligned with consumer expectations, and external sharing is confined to common-carrier relationships with established service-provider terms. No immediate remediation priority

VI. Cookies and Tracking Technologies A. Inventory Fieldhaven's automated scanning of cascade.com and the Cascade mobile application identified twelve (12) categories of cookies and tracking technologies currently deployed on Cascade's consumer-facing digital properties. The categories, as catalogued by Fieldhaven, are as follows:

1. Strictly Necessary / Essential Cookies — Cookies required for basic site functionality, including session management, shopping-cart persistence, authentication, and security.

2. Performance / Analytics Cookies — Cookies used to collect data about how consumers interact with cascade.com, including page-load times, error rates, and aggregated usage patterns, primarily for site-performance optimization.

3. Functionality Cookies — Cookies that enable enhanced functionality and personalization, such as language preferences, region selection, and previously viewed products.

4. First-Party Advertising Cookies — Cookies set by Cascade (or Peakview on Cascade's behalf) for first-party advertising purposes, including on-site ad targeting and product recommendations.

5. Third-Party Advertising Cookies — Cookies set by third-party advertising partners for cross-context behavioral advertising, including programmatic-ad targeting and frequency capping across third-party publisher inventory.

6. Social-Media Plug-in Cookies — Cookies associated with social-media sharing buttons and embedded social-media content on cascade.com, which may transmit consumer data to social-media platforms.

7. Retargeting / Remarketing Pixels — Pixel tags and tracking beacons deployed by retargeting/remarketing service providers that track consumer interactions on cascade.com for the