Contract analysis

I. Executive Summary Calderwood & Harkness LLP ("C&H" or "Firm") submits this Comprehensive Gap-Analysis Report (the "Report") as the primary Phase 1A deliverable under the engagement letter dated June 2, 2025 (the "Engagement Letter") between the Firm and Cascade Retail Holdings Inc. ("Cascade" or the "Company"). The Report presents the Firm's assessment of Cascade's current compliance posture against each of the ni

II. Scope and Methodology A. Engagement Scope Pursuant to the Engagement Letter, C&H has been retained to design, build, and implement a comprehensive US state privacy-compliance program on behalf of Cascade. Phase 1 of the engagement, which runs from June 2, 2025 through December 31, 2025, encompasses gap analysis, program design, policy drafting, vendor-agreement remediation, DSR-workflow implementation, CMP deploy

1. Cascade Retail Holdings Inc., a Delaware corporation (Nasdaq: CSRD), EIN 84-3192057;

2. Cascade Digital Marketplace LLC, a Delaware limited liability company, EIN 85-4107638;

3. Ridgeline Fulfillment Services Inc., a Washington corporation, EIN 91-1647823;

4. Peakview Analytics Inc., a Delaware corporation, EIN 87-2250194; and

5. Cascade Rewards Corp., a Delaware corporation, EIN 86-3381729. The following individuals are the key business and legal stakeholders for the engagement: • Thomas R. Cavanaugh, Chief Executive Officer (executive sponsor); • Meredith Tanaka, General Counsel (primary client contact); • Diana Polk, Associate General Counsel and Interim Chief Privacy Officer (day-to-day engagement lead); • Gregory Farris, Chief Informa

1. California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA");

2. Virginia Consumer Data Protection Act ("VCDPA");

3. Colorado Privacy Act ("CPA");

4. Connecticut Data Privacy Act ("CTDPA");

5. Utah Consumer Privacy Act ("UCPA");

6. Iowa Consumer Data Protection Act ("ICDPA");

7. Indiana Consumer Data Protection Act ("INCDPA");

8. Tennessee Information Protection Act ("TIPA");

9. Montana Consumer Data Privacy Act ("MCDPA");

10. Texas Data Privacy and Security Act ("TDPSA");

11. Oregon Consumer Privacy Act ("OCPA");

12. Delaware Personal Data Privacy Act ("DPDPA");

13. New Jersey Data Privacy Act ("NJDPA");

14. New Hampshire Data Privacy Act ("NHDPA");

15. Nebraska Data Privacy Act ("NDPA");

16. Minnesota Consumer Data Privacy Act ("Minnesota CDPA");

17. Maryland Online Data Privacy Act ("MODPA");

18. Kentucky Consumer Data Protection Act ("KYDPA"); and

19. Additional statutes effective or enacted through the 2025–2026 legislative cycles, as further described in the Multi-State Privacy Law Applicability Matrix. A statute-by-statute analysis of applicability thresholds, effective dates, and substantive requirements is set forth in the Firm's Multi-State Privacy Law Applicability Matrix, prepared by Sara Hendricks and Alan Burke and dated June 30, 2025 (the "Applicabi

III. Company Profile and Data-Processing Overview A. Business Operations Cascade Retail Holdings Inc. is a publicly traded omnichannel retailer and e-commerce platform, listed on the Nasdaq Global Select Market under the ticker "CSRD." For fiscal year 2024, Cascade reported consolidated revenue of approximately $3.87 billion, and the Company employed approximately 22,500 individuals at year-end. Cascade operates 186

1. Identifiers — name, email address, postal address, telephone number, account credentials, customer identification number;

2. Commercial information — purchase history, transaction records, returns and exchanges, product preferences, wish lists, and gift-registry information;

3. Internet and network activity — browsing history on cascade.com, search queries, clickstream data, device identifiers, IP addresses, and referral sources;

4. Geolocation data — precise geolocation collected from the Cascade mobile application when the user grants operating-system-level location permission;

5. Inferences — consumer profiles, propensity scores, interest segments, and other inferences drawn from the categories above and used by Peakview Analytics for personalization and targeting; and

6. Sensitive personal information — payment-card data (subject to PCI-DSS controls), precise geolocation, and account login credentials. C. Data Volumes and Flows The Fieldhaven data map identifies the following volumes and flows, which the Firm has verified through independent stakeholder interviews to the extent practicable: • Peakview Analytics processes approximately 2.1 billion consumer-event records per month i

IV. Gap Analysis Findings Gap 1 — Privacy Policy: Outdated and Incomplete Disclosures A. Finding. Cascade's consumer-facing online privacy policy at cascade.com/privacy was last updated in March 2022. The policy substantially predates the operative effective dates of the CPRA amendments and each of the eighteen (18) non-California statutes now within scope. The policy does not address the specific consumer-rights and

1. Implement a data-segregation architecture, within Peakview's enterprise data lake, that logically and, to the extent practicable, physically separates marketplace seller data from first-party customer data.

2. Deploy role-based access controls restricting marketplace-seller access to aggregated, pseudonymized, or de-identified data only, and eliminate any reporting-dashboard construct that would expose first-party customer PI to marketplace sellers.

3. Coordinate with Fieldhaven (Marcus Ellerby) on technical implementation as part of the data-mapping tool and DSR-automation workstream; segregation will be a prerequisite to reliable DSR fulfillment.

4. Update the Cascade Digital Marketplace seller terms of service via a Marketplace Seller Data-Use Terms addendum that memorializes the revised data-handling regime and clarifies controller/processor allocations. Target completion: aligned with Fieldhaven Milestone 1 (data mapping complete), triggering the $945,000 milestone payment under the Fieldhaven statement of work. Gap 4 — Data-Processing Agreements: 23 of 47

1. Finalize C&H's master DPA templates, in service-provider and contractor variants respectively, together with a multi-state addendum, by September 30, 2025.

2. Prioritize restructuring of the Thornbridge Media Corp. data-sharing agreement; target execution by October 31, 2025.

3. Develop and execute a third-party vendor DPA rollout plan for the remaining 23 partners lacking executed DPAs, prioritized by data volume and risk tier; target completion by December 31, 2025.

4. Review and update the existing 24 partner agreements to align with current statutory requirements, incorporating amendment or replacement instruments as appropriate.

5. Finalize the OnPoint Data Solutions DPA rider/amendment to the CMP SaaS agreement in parallel with CMP deployment. Gap 5 — Sensitive Personal Information: Precise Geolocation Processed Without Required Opt-In Consent A. Finding. The Cascade mobile application collects precise geolocation data from users without obtaining a separate, affirmative opt-in consent for the processing of that data as sensitive personal i

1. Implement a separate consent flow within the Cascade mobile application for the collection of precise geolocation data, providing plain-language notice of purpose and a clear right to decline;

2. Deploy the "Limit the Use of My Sensitive Personal Information" link on cascade.com and the mobile application;

3. Coordinate with Fieldhaven and OnPoint on CMP configuration to manage sensitive-PI consent preferences persistently across sessions and devices; and

4. Review and, where appropriate, limit the downstream sharing of geolocation data with Peakview and third-party partners. Target implementation: aligned with CMP deployment on December 15, 2025. Gap 6 — No Documented Data-Retention Schedule A. Finding. Cascade has no documented, written data-retention schedule for any category of personal information. This is true for customer-transaction data, loyalty-program data,

1. Develop a comprehensive data-retention and disposal schedule covering all categories of PI, with retention periods justified by documented business need and legal requirements;

2. Define legal-hold triggers, secure-disposal methods (including cryptographic deletion, anonymization, and physical destruction where applicable), and responsible business units for each retention category;

3. Incorporate the resulting retention periods into the omnibus privacy policy and the California-specific disclosures addendum; and

4. Coordinate with Mr. Farris on the technical implementation of automated retention/disposal controls in the underlying data-warehouse and marketing-technology environments. Target completion: October 2025. Gap 7 — DSR Portal: Deficient Identity Verification and Missing Appeal-Process Functionality A. Finding. Cascade's existing consumer-rights intake portal (the "DSR portal") does not verify consumer identity to CC

1. Implement CCPA-compliant identity-verification procedures: two-step verification for access, correction, and deletion requests, together with a simplified process for opt-out requests (which under 11 CCR § 7060(b) may not be conditioned on the consumer's provision of additional identifying information beyond what is necessary to route the request);

2. Build an appeal-process workflow incorporating the required timelines (typically 45 to 60 days for appeal review under the applicable state statutes), together with template response letters and escalation procedures;

3. Deploy the Fieldhaven-developed DSR-automation tool integrated with a centralized tracking, reporting, and audit-log system;

4. Establish a 15-business-day internal response-time target with automatic escalation procedures at day 10; and

5. Staff, or contract for, additional resources to handle anticipated DSR-volume growth as additional states go live. Fieldhaven Milestone 3 (DSR automation live) is associated with a $1,102,500 milestone payment. DSR workflow go-live target: December 1, 2025.

V. Additional Observations and Secondary Findings Beyond the seven primary gaps discussed in Section IV, the Firm has identified the following additional matters warranting attention within the Phase 1 timeline. A. Cookie and Tracking-Technology Compliance Twelve categories of cookies and tracking technologies are deployed on cascade.com without adequate notice or opt-in/opt-out controls. The current cookie-consent b

VI. Consolidated Risk Matrix The following consolidated risk matrix summarizes the primary gaps identified in Section IV and cross-references the responsible parties and target completion dates.

VII. Remediation Roadmap and Phase 1 Milestone Alignment A. Milestone Summary Table B. Resource and Budget Considerations Calderwood & Harkness LLP. The Engagement Letter provides for a Phase 1 fee cap of $2,600,000 through December 31, 2025. Hourly rates for the current engagement year are: partner $1,175/hour; senior associate $785/hour; associate $625/hour. Fieldhaven Consulting Group LLC. The Fieldhaven statement

VIII. Regulatory Context and Enforcement Landscape A. Prior Regulatory Interactions FTC Civil Investigative Demand. The FTC issued a Civil Investigative Demand (File No. 232-0147) to Cascade on September 14, 2023, concerning alleged dark-pattern practices in the Cascade mobile-app unsubscribe flow. The matter was closed on April 3, 2024, with no enforcement action, after Cascade implemented voluntary remedial changes