Contract analysis

I. Executive Summary The purpose of this memorandum is to provide the Audit & Risk Committee of the Board of Directors of Cascade Retail Holdings Inc. ("Cascade" or the "Company") with a comprehensive status update on the Company's US State Privacy Compliance Program (the "Program") as of early November 2025, in advance of the regularly scheduled Board meeting on November 13, 2025. This memorandum summarizes the work

II. Background and Engagement Overview A. Cascade's Data Processing Profile Cascade Retail Holdings Inc. is a Delaware corporation (Nasdaq: CSRD; EIN: 84-3192057), headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Cascade is an omnichannel retailer with FY2024 revenue of approximately $3.87 billion and approximately 22,500 employees across its retail, e-commerce, fulfillment, analytics

1. California — California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)

2. Virginia — Virginia Consumer Data Protection Act (VCDPA)

3. Colorado — Colorado Privacy Act (CPA)

4. Connecticut — Connecticut Data Privacy Act (CTDPA)

5. Utah — Utah Consumer Privacy Act (UCPA)

6. Iowa — Iowa Consumer Data Protection Act (ICDPA)

7. Indiana — Indiana Consumer Data Protection Act (INCDPA)

8. Tennessee — Tennessee Information Protection Act (TIPA)

9. Montana — Montana Consumer Data Privacy Act (MCDPA)

10. Texas — Texas Data Privacy and Security Act (TDPSA)

11. Oregon — Oregon Consumer Privacy Act (OCPA)

12. Delaware — Delaware Personal Data Privacy Act (DPDPA)

13. New Jersey — New Jersey Data Privacy Act (NJDPA)

14. New Hampshire — New Hampshire Data Privacy Act (NHDPA)

15. Nebraska — Nebraska Data Privacy Act (NDPA)

16. Minnesota — Minnesota Consumer Data Privacy Act (MCDPA)

17. Maryland — Maryland Online Data Privacy Act (MODPA)

18. Kentucky — Kentucky Consumer Data Privacy Act (KYDPA)

19. Additional enacted statutes with effective dates falling within the Program period The Program is designed to be scalable so that additional state privacy statutes—several of which are pending in state legislatures or have been enacted with future effective dates—can be incorporated into the compliance framework as they take effect, without requiring fundamental restructuring. In addition to the breadth of the st

III. Phase 1 Milestone Status A. Milestone Tracker The following table summarizes the current status of all Phase 1 milestones as of the date of this memorandum. A more detailed milestone tracker is attached as Attachment B. B. Key Deliverables Completed to Date As of the date of this memorandum, C&H has completed and delivered the following work product in connection with Phase 1 of the Program. All deliverables lis

1. Multi-State Privacy Law Applicability Matrix — Comprehensive mapping of all 19 applicable state privacy statutes against Cascade's operations, identifying threshold applicability, consumer-rights obligations, opt-out-mechanism requirements, data-processing-agreement mandates, and enforcement and penalty provisions for each statute.

2. Data-Mapping Review Memorandum — Legal review and analysis of Fieldhaven Consulting Group LLC's data-mapping report dated May 19, 2025, evaluating data flows, processing purposes, and third-party sharing relationships against statutory requirements.

3. Comprehensive Gap-Analysis Report — Identification and analysis of seven major compliance gaps across all 19 statutes, with prioritized remediation recommendations. Delivered August 15, 2025.

4. Sensitive-PI Analysis Memorandum — Detailed analysis of Cascade's processing of sensitive personal information (precise geolocation, payment-card data, and account credentials) under CCPA/CPRA requirements and analogous provisions of other state statutes.

5. Third-Party Data-Sharing Risk Assessment — Classification and risk-ranking of all 47 advertising and analytics partners identified in the data-mapping report, with identification of 23 partners lacking required data-processing agreements.

6. FTC & CA AG Inquiry Summary Memorandum — Summary analysis of the FTC Civil Investigative Demand (File No. 232-0147) and the California Attorney General informal inquiry, with assessment of ongoing compliance implications and recommended remedial measures.

7. Children's Privacy / Age-Gating Analysis Memorandum — Analysis of Cascade's obligations under COPPA and state-level children's-privacy provisions, with recommendations regarding age-gating mechanisms and parental-consent requirements for the e-commerce platform and mobile application. Consumer-Facing Privacy Notices:

8. Omnibus Privacy Policy — Comprehensive privacy notice for cascade.com and the mobile application, drafted to comply with all 19 applicable state privacy statutes.

9. California-Specific Addendum — Supplemental disclosures required by CCPA/CPRA, including categories of PI collected, disclosed, and sold/shared; CCPA consumer-rights notices; and financial-incentive disclosures for the Cascade Rewards program.

10. State-Specific Rights Supplement — Jurisdiction-specific disclosures of consumer rights and opt-out mechanisms for Virginia, Colorado, Connecticut, Texas, Oregon, and other applicable states.

11. Cookie & Tracking-Technology Notice — Detailed disclosure of the 12 categories of cookies and tracking technologies deployed on cascade.com, with descriptions of purpose, data collected, and retention periods.

12. Employee & Job-Applicant Privacy Notice — Privacy notice covering personal information collected from employees and job applicants, as required by CCPA/CPRA and other applicable state statutes.

13. Cascade Rewards Loyalty-Program Privacy Notice — Program-specific notice addressing the collection, use, and sharing of loyalty-member data, including financial-incentive disclosures required by CCPA/CPRA.

14. Marketplace Seller Privacy Notice — Privacy notice for third-party sellers on Cascade Digital Marketplace LLC, addressing the processing of seller personal information. Contractual Documents:

15. Vendor DPA Templates — Service-provider and contractor data-processing agreement templates compliant with CCPA/CPRA sections 1798.100(d) and 1798.140(ag), and analogous requirements under other state statutes. Finalized September 30, 2025.

16. OnPoint DPA Rider/Amendment — Data-processing addendum to the OnPoint Data Solutions Inc. SaaS agreement, classifying OnPoint as a CCPA "service provider" and imposing required contractual obligations. Executed September 25, 2025.

17. Marketplace Seller Data-Use Terms Addendum — Contractual addendum to Cascade Digital Marketplace seller terms establishing data-segregation obligations and limiting seller access to first-party customer data.

18. Fieldhaven Data-Protection Terms Review Memorandum — Legal review of data-protection provisions in Fieldhaven's consulting engagement agreement.

19. Vendor DPA Rollout Plan Memorandum — Phased deployment plan for executing DPAs with all 23 identified partners lacking required agreements, prioritized by data volume and risk level.

20. Thornbridge Negotiation Issues List & Redline Commentary — Internal attorney work-product memorandum analyzing key negotiation issues in the Thornbridge Media Corp. data-sharing agreement restructuring. Internal Policies and Procedures:

21. Internal Privacy Policy & Procedures Manual (draft) — Comprehensive internal policy document establishing enterprise-wide privacy standards, roles and responsibilities, and operational procedures.

22. Data Retention & Disposal Schedule (draft) — Category-specific retention periods and disposal protocols for all categories of personal information processed by Cascade and its subsidiaries.

23. DSR Standard Operating Procedures (draft, pre-go-live) — Step-by-step procedures for intake, identity verification, processing, appeal, and documentation of data-subject requests under all applicable state statutes.

24. Privacy Impact Assessment Framework & Template — Methodology and standardized template for conducting privacy impact assessments on new and modified data-processing activities.

25. Employee Privacy Training Program Materials — Training curriculum and presentation materials for enterprise-wide privacy-awareness training, with role-specific modules for customer-service, marketing, IT, and legal personnel.

IV. Compliance Gap Remediation Status The Gap-Analysis Report delivered on August 15, 2025 identified seven major compliance gaps across Cascade's operations when measured against the requirements of all 19 applicable state privacy statutes. The following provides the current remediation status for each gap. Gap 1: Outdated Online Privacy Policy Finding: Cascade's online privacy policy, as published on cascade.com, w

V. Thornbridge Media Corp. Data-Sharing Agreement Restructuring Thornbridge Media Corp. ("Thornbridge") is a Nevada corporation (CEO: Robert Shin; General Counsel: Leah Voss) that serves as Cascade's primary programmatic-advertising and audience-targeting partner. In FY2024, Cascade's advertising spend with Thornbridge totaled approximately $18.4 million, making it Cascade's largest single advertising-partner relatio

1. Combined-Data Rights. Thornbridge has requested the right to retain and use "combined data" — i.e., data that combines Cascade consumer data with data from Thornbridge's other sources — for Thornbridge's independent business purposes, including providing services to other Thornbridge clients. C&H has recommended a firm position against this request, as permitting combined-data rights would make it significantly mo

2. Real-Time GPC Signal Pass-Through. Thornbridge has expressed resistance to implementing real-time pass-through of GPC signals, asserting that its systems are not currently configured to process opt-out signals on a real-time, per-request basis and that a batch-processing approach (with daily synchronization) would be commercially reasonable. C&H has recommended a firm position requiring real-time or near-real-time

3. Audit-Rights Frequency. Thornbridge has proposed limiting Cascade's audit rights to once per calendar year, with 60 days' advance written notice. C&H has identified a potential compromise position on this issue: acceptance of an annual audit cadence under normal circumstances, with the right to conduct additional audits (a) upon reasonable suspicion of non-compliance, (b) following a data breach or security incide

4. Indemnification Scope for Regulatory Fines. Thornbridge has resisted full indemnification for regulatory fines and penalties attributable to Thornbridge's breach of the agreement's data-protection provisions, proposing instead a mutual-indemnification structure with a cap equal to twelve months of fees paid under the advertising services agreement. C&H has identified a potential compromise position: acceptance of

VI. Budget and Financial Update A. Calderwood & Harkness LLP Fees The fee arrangement for Phase 1 of the engagement (June 2, 2025 through December 31, 2025) provides for blended hourly rates as follows: • Partner: $1,175 per hour • Senior Associate: $785 per hour • Associate: $625 per hour Phase 1 fees are subject to a rate cap of $2,600,000, which represents the maximum fees C&H will charge for Phase 1 deliverables

VII. Regulatory Risk Landscape A. Enforcement Trends The state privacy-law enforcement landscape continues to evolve rapidly, and several trends are particularly relevant to Cascade's compliance posture: State Attorney General Enforcement. State attorneys general have significantly increased their enforcement activity under both the CCPA/CPRA and newer state privacy statutes. California Attorney General enforcement a

VIII. CPO Hiring Update Cascade's management has determined that the appointment of a full-time Chief Privacy Officer ("CPO") is essential to the long-term success and sustainability of the privacy-compliance program. C&H has advised management on the following aspects of the CPO role: Scope of Responsibilities. The CPO will have enterprise-wide accountability for data-privacy compliance across Cascade and all subsid

IX. Coordination with Whitfield Greaves LLP Carolyn J. Marsden, Partner, Corporate & Securities, Whitfield Greaves LLP (1999 K Street NW, Suite 700, Washington, D.C. 20006), serves as Cascade's securities and corporate governance counsel and is advising on the SEC-disclosure implications of the privacy-compliance program and the proposed Privacy Governance Charter. A Common-Interest Agreement between Calderwood & Har

X. Lakemont Audit Partners LLP Coordination Sheila Brogan, Engagement Partner, Lakemont Audit Partners LLP (233 South Wacker Drive, Suite 5600, Chicago, IL 60606), serves as Cascade's independent auditor for FY2024 and FY2025. C&H has consulted with Ms. Brogan and her team regarding the intersection of the privacy-compliance program with Lakemont's audit responsibilities, specifically: • SOC 2 / Privacy-Controls Over