Contract analysis

I. Executive Summary and Purpose This memorandum certifies the completion of Phase 1 of the comprehensive US state privacy compliance program engagement opened by Calderwood & Harkness LLP on behalf of Cascade Retail Holdings Inc. ("Cascade" or the "Company") on June 2, 2025 (the "Engagement"). The Phase 1 period encompasses all work performed from the Engagement opening date through December 31, 2025. The scope of P

II. Engagement Overview and Scope A. Engagement Parameters The Engagement was opened on June 2, 2025, following execution of the engagement letter between Calderwood & Harkness LLP and Cascade Retail Holdings Inc. Phase 1 of the Engagement ran from June 2, 2025 through December 31, 2025, a period of approximately seven months encompassing all assessment, design, drafting, negotiation, and implementation oversight wor

1. California — California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Cal. Civ. Code §§ 1798.100–1798.199.100

2. Virginia — Virginia Consumer Data Protection Act (VCDPA), Va. Code Ann. §§ 59.1-575 to 59.1-585

3. Colorado — Colorado Privacy Act (CPA), Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313

4. Connecticut — Connecticut Data Privacy Act (CTDPA), Conn. Gen. Stat. §§ 42-515 to 42-525

5. Utah — Utah Consumer Privacy Act (UCPA), Utah Code Ann. §§ 13-61-101 to 13-61-404

6. Iowa — Iowa Consumer Data Protection Act (ICDPA), Iowa Code §§ 715D.1 to 715D.9

7. Indiana — Indiana Consumer Data Protection Act (INCDPA), Ind. Code §§ 24-15-1-1 to 24-15-9-1

8. Tennessee — Tennessee Information Protection Act (TIPA), Tenn. Code Ann. §§ 47-18-3201 to 47-18-3213

9. Montana — Montana Consumer Data Privacy Act (MCDPA), Mont. Code Ann. §§ 30-14-2801 to 30-14-2817

10. Texas — Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code §§ 541.001 to 541.205

11. Oregon — Oregon Consumer Privacy Act (OCPA), Or. Rev. Stat. §§ 646A.570 to 646A.589

12. Delaware — Delaware Personal Data Privacy Act (DPDPA), Del. Code Ann. tit. 6, §§ 12D-101 to 12D-115

13. New Jersey — New Jersey Data Privacy Act (NJDPA), N.J. Stat. Ann. §§ 56:8-166 to 56:8-181

14. New Hampshire — New Hampshire Data Privacy Act (NHDPA), N.H. Rev. Stat. Ann. §§ 507-H:1 to 507-H:15

15. Nebraska — Nebraska Data Privacy Act (NDPA), Neb. Rev. Stat. §§ 87-1101 to 87-1116

16. Minnesota — Minnesota Consumer Data Privacy Act (MCDPA), Minn. Stat. §§ 325O.01 to 325O.20

17. Maryland — Maryland Online Data Privacy Act (MODPA), Md. Code Ann., Com. Law §§ 14-4601 to 14-4616

18. Kentucky — Kentucky Consumer Data Protection Act (KYDPA), Ky. Rev. Stat. Ann. §§ 367.400 to 367.475

19. Additional statutes enacted or becoming effective during the 2025–2026 legislative cycle, as identified in ongoing monitoring The applicability of these statutes to Cascade's operations is driven by the Company's operational footprint: Cascade operates 186 retail locations in 31 US states and ships e-commerce orders to consumers in all 50 states plus the District of Columbia. Given Cascade's annual revenue of app

III. Phase 1 Milestone Completion Summary The following table presents a comprehensive summary of all Phase 1 milestones, including target dates, actual completion dates, and current status. We are pleased to report that every milestone was achieved on or before the applicable target date. The on-time completion of all Phase 1 milestones reflects the collaborative effort of the Calderwood & Harkness engagement team,

IV. Deliverable-by-Deliverable Certification This section provides a detailed description and certification of each Phase 1 deliverable, organized by functional category. Each deliverable is identified by its Deliverable Index reference number (as set forth in Appendix A), and its completion date and current status are confirmed. A. Assessment and Gap Analysis Deliverables

1. Multi-State Privacy Law Applicability Matrix (Deliverable 1A-01). The Multi-State Privacy Law Applicability Matrix was completed on June 30, 2025 by Sara Hendricks and Alan Burke. This document constitutes the foundational legal analysis for the entire compliance program and maps all nineteen (19) applicable state privacy statutes against Cascade's specific operations, data-processing activities, and corporate str

2. Data-Mapping Review Memorandum (Deliverable 1A-02). The Data-Mapping Review Memorandum was completed on July 14, 2025. This memorandum presents Calderwood & Harkness's legal review and analysis of the comprehensive data-mapping report prepared by Fieldhaven Consulting Group LLC (dated May 19, 2025), which was delivered to Cascade as part of Fieldhaven's Milestone 1 deliverables. Fieldhaven's data-mapping report ca

3. Comprehensive Gap-Analysis Report (Deliverable 1A-03). The Comprehensive Gap-Analysis Report was delivered on August 15, 2025 to Meredith Tanaka and Diana Polk. This report represents the core diagnostic document of the Phase 1 engagement and identified compliance deficiencies across all nineteen (19) applicable state privacy statutes, organized by functional area and assigned risk ratings (High, Medium, or Low) b

4. Sensitive Personal Information Analysis Memorandum (Deliverable 1A-04). The Sensitive Personal Information Analysis Memorandum was completed on July 28, 2025. This memorandum provided a detailed legal analysis of Cascade's processing of categories of personal information that qualify as "sensitive personal information" or "sensitive data" under applicable state privacy statutes. The analysis focused on three categ

5. Third-Party Data-Sharing Risk Assessment Memorandum (Deliverable 1A-05). The Third-Party Data-Sharing Risk Assessment Memorandum was completed on August 4, 2025. This memorandum presented a comprehensive risk assessment of Cascade's data-sharing relationships with its forty-seven (47) third-party advertising and analytics partners. For each of the 47 partners, the memorandum analyzed the nature and scope of data e

6. FTC & California AG Inquiry Summary Memorandum (Deliverable 1A-06). The FTC & California AG Inquiry Summary Memorandum was completed on June 20, 2025. This memorandum was prepared to ensure that the compliance program was designed with full awareness of Cascade's prior regulatory interactions. The memorandum summarized two prior regulatory matters: (a) FTC Civil Investigative Demand (File No. 232-0147). On Septemb

7. Children's Privacy & Age-Gating Analysis Memorandum (Deliverable 1A-07). The Children's Privacy & Age-Gating Analysis Memorandum was completed on July 21, 2025. This memorandum assessed Cascade's obligations under the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501–6506, and state-law age-gating requirements, including California's Age-Appropriate Design Code Act ("AADC"), Cal. Civ. Code §§ 1

1. Omnibus Privacy Policy — Consumer-Facing (Deliverable 1B-01). The Omnibus Privacy Policy was delivered in draft form on September 12, 2025, was subsequently reviewed by Ms. Tanaka and Ms. Polk with input from business-unit stakeholders, and was finalized and deployed on cascade.com, the Cascade mobile application, and in-store kiosks prior to the consent-management platform go-live on December 15, 2025. This compr

2. California-Specific Privacy Disclosures Addendum (Deliverable 1B-02). The California-Specific Privacy Disclosures Addendum was delivered on September 12, 2025. This addendum supplements the Omnibus Privacy Policy with disclosures specifically required by the CCPA/CPRA, including: • Categories of personal information collected in the preceding 12 months • Categories of personal information sold or shared in the pre

3. State-Specific Consumer Rights Supplement (Deliverable 1B-03). The State-Specific Consumer Rights Supplement was delivered on September 12, 2025. This supplement provides state-by-state descriptions of consumer rights for residents of Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, Kentucky, and any other s

4. Cookie & Tracking-Technology Notice (Deliverable 1B-04). The Cookie & Tracking-Technology Notice was delivered on September 12, 2025. This notice describes all twelve (12) categories of cookies and tracking technologies deployed on cascade.com and the Cascade mobile application, including their purposes, data collected, duration, and the opt-out or opt-in mechanisms available to consumers. The notice was integrate

5. Employee & Job-Applicant Privacy Notice (Deliverable 1B-05). The Employee & Job-Applicant Privacy Notice was delivered on September 12, 2025. This notice addresses Cascade's collection, use, and disclosure of personal information of the Company's approximately 22,500 employees and job applicants across all states in which Cascade operates. The notice was drafted to comply with the CCPA/CPRA's requirements applicab

6. Cascade Rewards Loyalty-Program Privacy Notice (Deliverable 1B-06). The Cascade Rewards Loyalty-Program Privacy Notice was delivered on September 12, 2025. This supplemental notice addresses the privacy practices specific to Cascade's Rewards loyalty program, which serves approximately 41.2 million registered members. The notice was drafted to satisfy the financial-incentive and loyalty-program disclosure requirem

7. Third-Party Marketplace Seller Privacy Notice (Deliverable 1B-07). The Third-Party Marketplace Seller Privacy Notice was delivered on September 12, 2025. This notice is directed to the approximately 3,800 third-party sellers operating on the Cascade Digital Marketplace LLC platform and addresses Cascade's processing of seller personal information, including seller account information, transaction data, payment inf

1. Master DPA Template — Service Providers (Deliverable 1C-01). The Master Data Processing Agreement Template for Service Providers was finalized on September 30, 2025. This template is designed for use with vendors that qualify as "service providers" under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ag)) and equivalent roles under other state statutes (e.g., "processor" under the VCDPA, Colorado CPA, CTDPA, and other s

2. Master DPA Template — Contractors (Deliverable 1C-02). The Master Data Processing Agreement Template for Contractors was finalized on September 30, 2025. This template is designed for use with vendors that qualify as "contractors" under the CCPA/CPRA (Cal. Civ. Code § 1798.140(j)), a classification that carries heightened restrictions compared to the service-provider classification. In addition to the provisions i

3. Thornbridge Media Corp. Data-Sharing Agreement (Deliverable 1C-03). The restructured data-sharing agreement between Cascade Retail Holdings Inc. and Thornbridge Media Corp. ("Thornbridge") was executed on October 31, 2025, on target with the Phase 1 milestone schedule. This agreement governs the data-sharing relationship between Cascade and Thornbridge in connection with Cascade's programmatic advertising program

4. OnPoint Data Solutions — DPA Rider / Amendment (Deliverable 1C-04). The Data Processing Addendum to Cascade's existing SaaS agreement with OnPoint Data Solutions ("OnPoint") for the consent-management platform was completed on September 25, 2025. The DPA rider was negotiated and executed as an amendment to the OnPoint master services agreement and governs OnPoint's processing of personal information in connection

5. Fieldhaven Consulting — Data-Protection Terms Review (Deliverable 1C-05). Calderwood & Harkness completed its review of the data-protection provisions in Fieldhaven Consulting Group LLC's Statement of Work on July 8, 2025. Our review identified several areas in which the SOW's data-handling provisions required amendment to comply with the CCPA/CPRA and other applicable state privacy statutes. We recommended, and C

6. Third-Party Vendor DPA Rollout Plan (Deliverable 1C-06). The Third-Party Vendor DPA Rollout Plan was delivered on September 30, 2025. This plan establishes the strategy and timeline for deploying data-processing agreements to the twenty-three (23) of forty-seven (47) advertising and analytics partners that lacked executed DPAs as of the Engagement opening. The rollout plan prioritized the 23 non-compliant partners

7. Marketplace Seller Data-Use Terms Addendum (Deliverable 1C-07). The Marketplace Seller Data-Use Terms Addendum was completed in October 2025. This addendum to the Cascade Digital Marketplace LLC terms of service governs the processing, use, and restrictions applicable to seller personal information and consumer data in the marketplace context. The addendum addresses the following key issues: • Data-segregation req