Contract analysis

I. Executive Summary This memorandum presents the results of our assessment of the compliance posture of Cascade Retail Holdings Inc. ("Cascade" or the "Company") with respect to its data-sharing relationships with the forty-seven (47) third-party advertising and analytics partners identified in the data-mapping report delivered by Fieldhaven Consulting Group LLC ("Fieldhaven") on May 19, 2025 (the "Data-Mapping Repo

1. Classification of each partner under each Applicable State Statute as a service provider/processor, contractor, or third party, and identification of each data transfer that constitutes a "sale," "sharing," or "targeted advertising" requiring consumer opt-out rights;

2. Prioritized DPA rollout to all thirty-five (35) partners lacking compliant agreements, using standardized service-provider and contractor DPA templates with partner-specific schedules, on the timeline set forth in Section VIII below;

3. Immediate restructuring of the Thornbridge arrangement, including negotiation of a bespoke data-sharing agreement with appropriate CCPA/CPRA compliance provisions, with a target execution date of October 31, 2025; and

4. Implementation of opt-out-of-sale/sharing mechanisms, including real-time honoring of Global Privacy Control ("GPC") signals and propagation of opt-out signals to all forty-seven (47) partners, in coordination with the OnPoint Data Solutions Inc. ("OnPoint") consent-management platform ("CMP") deployment targeted for December 15, 2025. This memorandum should be read in conjunction with the Comprehensive Gap-Analys

II. Background A. Cascade's Data-Sharing Ecosystem Cascade Retail Holdings Inc. is a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol "CSRD," with its principal executive offices located at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Cascade is an omnichannel retailer with FY2024 revenues of approximately $3.87 billion. The Company operates one hundred eight

III. Legal Framework: "Sale," "Sharing," and Partner Classification This section sets forth the legal framework for classifying Cascade's data-sharing relationships under the CCPA/CPRA and the other Applicable State Statutes. The classification of each partner—as a service provider, contractor, or third party—determines the legal obligations that attach to the data transfer, including whether the transfer constitutes

IV. Partner Classification Analysis A. Methodology Each of the forty-seven (47) partners identified in the Fieldhaven Data-Mapping Report was evaluated against the following criteria: (a) Nature of Data Received: The categories of personal information transmitted to the partner, classified according to the CCPA/CPRA's enumerated categories (identifiers, commercial information, internet/network activity, geolocation,

V. Thornbridge Media Corp. — Detailed Risk Assessment A. Relationship Overview Thornbridge Media Corp. ("Thornbridge") is a Nevada corporation headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117. The company is led by Chief Executive Officer Robert Shin, and its General Counsel is Leah Voss. Thornbridge's outside counsel for privacy and data-governance matters is the firm of Kellner Park & A

1. Immediately initiate negotiation of a restructured data-sharing agreement with Thornbridge. Alan Burke and Sara Hendricks (Calderwood & Harkness) should contact Victor Sandoval at Kellner Park & Associates LLP and Leah Voss at Thornbridge to schedule an initial meeting and transmit a term sheet for the proposed restructured arrangement. Given the nature and scale of the relationship, the Thornbridge agreement shou

2. Target execution date: October 31, 2025. This target reflects both the urgency of the compliance exposure and the anticipated complexity of the negotiation. Thornbridge has significant commercial leverage as Cascade's largest advertising partner, and we anticipate that certain provisions—particularly the restrictions on data commingling and the requirement to honor opt-out signals in real time—will be subject to e

3. Key terms to negotiate: (a) Sale/Sharing Acknowledgment: The agreement should include an express acknowledgment that the data sharing constitutes a "sale" and "sharing" of personal information under the CCPA/CPRA, triggering the corresponding consumer opt-out rights. (b) Opt-Out signal compliance: Thornbridge must agree to honor consumer opt-out-of-sale/sharing signals, including GPC, in real time. This requires T

4. Privacy Policy and Opt-Out Updates. In parallel with the Thornbridge negotiation, Cascade should update its privacy policy and consumer-facing opt-out mechanisms to disclose the Thornbridge sharing arrangement and provide effective opt-out functionality. The target date for these updates is December 31, 2025, though we recommend completing them as soon as the CMP deployment permits.

5. Immediate Cessation of Geolocation Sharing. We recommend that Cascade immediately cease transmitting precise geolocation data to Thornbridge until a separate opt-in consent mechanism is implemented. This recommendation is consistent with the sensitive-PI workstream addressed in the memorandum dated July 28, 2025.

VI. Risk Assessment of Remaining Partners A. Tier 1 Partners (High Priority — Excluding Thornbridge) In addition to Thornbridge, seven (7) other partners have been classified as Tier 1 (High Priority). These seven partners are identified by coded reference in the complete classification table (Appendix A) and share the following common characteristics: Each of the seven Tier 1 partners receives consumer behavioral da