Contract analysis

I. Executive Summary This memorandum provides a comprehensive analysis of Cascade Retail Holdings Inc.'s ("Cascade" or the "Company") current processing activities involving sensitive personal information ("Sensitive PI") across the full breadth of its retail, e-commerce, mobile-application, loyalty-program, and advertising-technology operations. The purpose of this analysis is to identify areas where Cascade's data-

1. Precise geolocation data collected via the Cascade mobile application (iOS and Android), which captures latitude and longitude coordinates within a radius of 1,750 feet or less when location services are enabled by the user;

2. Payment-card data, including credit and debit card numbers, card verification values ("CVVs"), expiration dates, and cardholder names, processed across approximately 94 million annual online transactions conducted through cascade.com and the Cascade mobile app, as well as point-of-sale transactions at 186 retail locations in 31 states; and

3. Account login credentials, specifically email address and password combinations, maintained for approximately 41.2 million registered Cascade Rewards loyalty-program members. Each of these categories falls squarely within the statutory definition of "sensitive personal information" under CCPA/CPRA (Cal. Civ. Code § 1798.140(ae)), and precise geolocation data further qualifies as "sensitive data" under the VCDPA, C

II. Scope and Purpose A. Engagement Context Calderwood & Harkness LLP was formally engaged by Cascade Retail Holdings Inc. on June 2, 2025, pursuant to an engagement letter executed by Kevin Ostrowski (Calderwood & Harkness) and Diana Polk (Associate General Counsel and Interim Chief Privacy Officer, Cascade), to design and implement a comprehensive United States state-privacy compliance program. The engagement encom

III. Factual Background — Cascade's Sensitive PI Processing Activities This section describes Cascade's current processing activities for each identified category of Sensitive PI. The factual basis for these descriptions is drawn from the Fieldhaven Report dated May 19, 2025, Calderwood & Harkness's Data-Mapping Review Memorandum dated July 14, 2025, and our interviews with Cascade stakeholders conducted between June

1. Collection Mechanism The Cascade mobile application, available on both iOS and Android platforms, collects precise geolocation data when the device's location services are enabled by the user. As documented in the Fieldhaven Report, the application utilizes the GPS, Wi-Fi, and cellular-triangulation capabilities of the user's device to determine the user's latitude and longitude coordinates with a precision of app

2. Purposes of Use Cascade utilizes the precise geolocation data collected through the mobile application for three principal purposes: (i) In-store navigation and product finding. When a user is located within or near one of Cascade's 186 retail locations, the application provides in-store navigation features, including aisle-level product location, store maps, and wayfinding to specific product categories. This fun

3. Third-Party Sharing The Fieldhaven Report identified 47 third-party advertising and analytics partners with whom Cascade shares consumer data. Of these 47 partners, the Fieldhaven Report determined that at least 14 receive precise geolocation data from Cascade, either directly through API integrations or indirectly through the advertising-technology ecosystem (including real-time bidding platforms and data-managem

4. Current Consent and Disclosure Practices This is the area of most significant concern. As of the date of this memorandum: • No separate opt-in consent mechanism exists for the collection of precise geolocation data beyond the device-level operating-system permissions prompt. The Cascade mobile application does not present its own consent dialog, does not identify Cascade by name in connection with geolocation data

1. Collection and Processing Cascade processes payment-card data — specifically, credit and debit card numbers, card verification values (CVVs), expiration dates, and cardholder names — in connection with consumer purchases. The Company processes approximately 94 million online transactions per year through cascade.com and the Cascade mobile application, in addition to point-of-sale transactions at its 186 retail loc

2. Security Controls Payment-card data is handled in compliance with Payment Card Industry Data Security Standard ("PCI-DSS") requirements under the oversight of CISO Gregory Farris. Farris confirmed in our June 25, 2025 interview that Cascade maintains PCI-DSS Level 1 compliance, validated through annual audits conducted by its Qualified Security Assessor. Tokenization is employed for all stored card-on-file data: w

3. Limited Sharing and Use Critically, payment-card data is not shared with advertising or analytics partners. Based on our review of the Fieldhaven Report and confirmation from Gregory Farris, payment-card data processing is limited to the following purposes: (i) Transaction authorization and settlement with Cascade's payment processor; (ii) Fraud prevention and detection, including integration with third-party frau

4. Cascade Rewards Stored Payment Instruments Cascade Rewards Corp. (EIN: 86-3381729) maintains tokenized payment instruments for the approximately 41.2 million loyalty-program members who have opted to save a payment method to their account. As noted above, these stored instruments are tokenized; the actual card numbers are not stored in Cascade Rewards Corp.'s databases. The tokens are used to facilitate one-click

1. Collection and Storage Cascade maintains approximately 41.2 million registered Cascade Rewards loyalty-program accounts. Each account is established with email-based login credentials consisting of an email address and a user-created password. Passwords are stored using bcrypt hashing with a work factor of 12, a practice that Gregory Farris confirmed during our June 25, 2025 interview is consistent with current in

2. Purposes of Use Account login credentials are used solely for the following purposes: (i) Consumer account authentication (login to cascade.com and the Cascade mobile application); (ii) Security purposes, including account-recovery processes, suspicious-activity detection, and brute-force login-attempt prevention; and (iii) Communications related to account security (e.g., password-reset requests, security alerts)

3. Multi-Factor Authentication Multi-factor authentication ("MFA") is available to consumers as an optional security feature but is not currently mandatory for consumer accounts. CISO Gregory Farris has recommended that MFA be made mandatory for all Cascade Rewards accounts, and this recommendation is under consideration by the executive team. As of the date of this memorandum, approximately 6.8 million of the 41.2 m

1. Findings. Based on our review of the Fieldhaven Report and our interviews with Cascade stakeholders, we determined the following: • Cascade does not systematically collect racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, genetic data, or biometric data from consumers in the ordinary course of its retail, e-commerce, or loyalty-program operations

2. Employee and Applicant Data As noted above, Cascade collects various categories of Sensitive PI from employees and job applicants, including Social Security numbers, background-check information, and other categories that fall within Sensitive PI definitions under multiple state statutes. This processing is being addressed in the Employee & Job-Applicant Privacy Notice workstream, with a separate memorandum forthc

IV. Legal Analysis — CCPA/CPRA (Cal. Civ. Code § 1798.121) California's CCPA/CPRA framework represents the most comprehensive state-level Sensitive PI regulatory scheme and establishes the baseline for Cascade's compliance obligations. Cascade has substantial nexus with California: the Company operates 27 retail locations in the state, serves millions of California residents through cascade.com and the mobile applica

V. Legal Analysis — Virginia Consumer Data Protection Act (VCDPA) A. Definition of Sensitive Data Under VCDPA The Virginia Consumer Data Protection Act, codified at Va. Code § 59.1-575 et seq., defines "sensitive data" to include: (i) Personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; (ii) The processing of

VI. Legal Analysis — Colorado Privacy Act (CPA) A. Sensitive Data Definition The Colorado Privacy Act, codified at C.R.S. § 6-1-1303(24), defines "sensitive data" to include personal data that reveals: (i) Racial or ethnic origin; (ii) Religious beliefs; (iii) A mental or physical health condition or diagnosis; (iv) Sex life or sexual orientation; (v) Citizenship or immigration status; or (vi) Genetic or biometric da

VII. Legal Analysis — Connecticut Data Privacy Act (CTDPA) and Additional State Statutes A. Connecticut Data Privacy Act (CTDPA) The Connecticut Data Privacy Act, codified at Conn. Gen. Stat. § 42-515 et seq., defines "sensitive data" at § 42-515(28) in terms substantially similar to the VCDPA and Colorado CPA, including: (i) Personal data revealing racial or ethnic origin, religious beliefs, mental or physical healt

VIII. Current-State Assessment and Identified Gaps A. Gap Summary Based on the legal analysis set forth above and the factual findings from the Fieldhaven Report and Calderwood & Harkness's Data-Mapping Review Memorandum, we have identified the following compliance gaps related to Cascade's processing of Sensitive PI: Gap No. 1: No separate opt-in consent for precise geolocation. The Cascade mobile application relies