Contract analysis

I. Executive Summary This memorandum sets forth the results of our review of the data-handling, confidentiality, and data-protection provisions contained in the existing Statement of Work ("SOW") between Cascade Retail Holdings Inc. ("Cascade" or "CRH") and Fieldhaven Consulting Group LLC ("Fieldhaven") for the privacy-program technical implementation engagement. The purpose of this review is to identify gaps in the

1. Enterprise data mapping and inventory — a comprehensive identification and cataloging of all personal information collected, processed, stored, and shared by Cascade across its retail, e-commerce, mobile, loyalty-program, marketplace, and advertising operations;

2. Deployment of the OnPoint Data Solutions Inc. consent-management platform ("CMP") — implementation and configuration of a centralized platform for obtaining, managing, and documenting consumer consent and opt-out preferences across Cascade's digital properties; and

3. Data-subject-request ("DSR") workflow automation — design, build, and deployment of automated workflows to receive, route, verify, fulfill, and document consumer privacy-rights requests across all applicable jurisdictions. The total fixed-fee value of the Fieldhaven SOW is $3,150,000, payable in three milestone-based installments: Summary Conclusion. The current Fieldhaven SOW contains general confidentiality lang

II. Background and Context A. The Fieldhaven Engagement Cascade retained Fieldhaven to serve as the primary technical implementer for its comprehensive US state-privacy compliance program. Fieldhaven's scope of work encompasses the three workstreams described above — enterprise data mapping and inventory, CMP deployment, and DSR workflow automation — each of which requires Fieldhaven personnel to access, process, ana

1. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — Cal. Civ. Code §§ 1798.100–1798.199.100

2. Virginia Consumer Data Protection Act (VCDPA) — Va. Code §§ 59.1-575–59.1-585

3. Colorado Privacy Act (CPA) — Colo. Rev. Stat. §§ 6-1-1301–6-1-1313

4. Connecticut Data Privacy Act (CTDPA) — Conn. Gen. Stat. §§ 42-515–42-525

5. Utah Consumer Privacy Act (UCPA) — Utah Code §§ 13-61-101–13-61-404

6. Iowa Consumer Data Protection Act (ICDPA) — Iowa Code §§ 715D.1–715D.8

7. Indiana Consumer Data Protection Act (INCDPA) — Ind. Code §§ 24-15-1-1–24-15-9-2

8. Tennessee Information Protection Act (TIPA) — Tenn. Code §§ 47-18-3201–47-18-3213

9. Montana Consumer Data Privacy Act (MCDPA) — Mont. Code §§ 30-14-2801–30-14-2817

10. Texas Data Privacy and Security Act (TDPSA) — Tex. Bus. & Com. Code §§ 541.001–541.205

11. Oregon Consumer Privacy Act (OCPA) — Or. Rev. Stat. §§ 646A.570–646A.590

12. Delaware Personal Data Privacy Act (DPDPA) — Del. Code tit. 6, §§ 12D-101–12D-115

13. New Jersey Data Privacy Act (NJDPA) — N.J. Stat. §§ 56:8-166–56:8-187

14. New Hampshire Data Privacy Act (NHDPA) — N.H. Rev. Stat. §§ 507-H:1–507-H:18

15. Nebraska Data Privacy Act (NDPA) — Neb. Rev. Stat. §§ 87-1101–87-1116

16. Minnesota Consumer Data Privacy Act (MN MCDPA) — Minn. Stat. §§ 325O.01–325O.22

17. Maryland Online Data Privacy Act (MODPA) — Md. Code Com. Law §§ 14-4601–14-4618

18. Kentucky Consumer Data Protection Act (KYDPA) — Ky. Rev. Stat. §§ 367.400–367.460

19. Additional statutes becoming effective through 2025–2026 as identified in the Calderwood & Harkness Multi-State Privacy Law Applicability Matrix Each of these statutes imposes contractual requirements on entities that process personal information on behalf of a business or controller. While the specific requirements vary from state to state, they generally require that businesses enter into written agreements wit

III. Scope of Review This memorandum is based on our review of the following documents and materials:

1. Fieldhaven Consulting Group LLC Statement of Work — the undated, pre-engagement version provided to Calderwood & Harkness by Diana Polk via email on June 5, 2025. The SOW is the operative agreement between Cascade and Fieldhaven governing the privacy-program technical implementation engagement and is the primary subject of this review.

2. Fieldhaven Standard Terms and Conditions — a set of general terms and conditions incorporated by reference in the SOW (referenced at Section 1.2 of the SOW as "Fieldhaven's Standard Terms and Conditions, Version 4.3, available at https://www.fieldhaven.com/legal/terms"). These terms contain additional provisions relating to limitation of liability, indemnification, intellectual-property ownership, and general cont

3. Fieldhaven Data-Mapping Report dated May 19, 2025 — the enterprise data-mapping report delivered by Fieldhaven as the primary deliverable under Milestone 1. This report was reviewed not for the purpose of assessing its substantive adequacy, but rather to understand the scope and categories of personal information to which Fieldhaven has had access in performing the SOW. The report confirms that Fieldhaven accessed

4. Calderwood & Harkness Multi-State Privacy Law Applicability Matrix (working draft, last updated June 30, 2025) — a matrix identifying the applicability of each of the 19 state privacy statutes to Cascade's operations and summarizing the contractual requirements imposed by each statute on service-provider and processor relationships. This matrix was used as the reference framework for evaluating the SOW's complianc

5. Calderwood & Harkness Draft Master DPA Template — Service Providers (in progress, target finalization September 30, 2025) — the firm's draft form of Data Processing Agreement for service providers, which is being developed as part of the broader Cascade privacy-compliance engagement. The DPA template reflects best-practices provisions drawn from all 19 applicable state statutes and will serve as the baseline for t

IV. Analysis of Current SOW Data-Protection Provisions A. Existing Confidentiality Clause (Section 8 of SOW) The SOW contains a general mutual confidentiality provision at Section 8, titled "Confidentiality." This provision defines "Confidential Information" broadly to include "all non-public information disclosed by either party to the other party in connection with this Statement of Work, whether disclosed orally,

Section 9 of the SOW, titled "Data Handling," contains a brief paragraph — approximately four sentences in length — requiring Fieldhaven to "use commercially reasonable security measures to protect Client data in its possession or control" and to "handle Client data in accordance with applicable laws." The provision further states that Fieldhaven "will not use Client data for any purpose other than performing the ser

V. Recommended Amendments Based on the analysis set forth in Section IV, we recommend the following seven categories of amendments to the Fieldhaven SOW. These recommendations are designed to bring the SOW into compliance with the CCPA/CPRA and the other 18 applicable state privacy statutes, to align with industry best practices for service-provider and processor agreements, and to be consistent with the Calderwood &

VI. Interaction with Other Engagement Workstreams The recommended amendments to the Fieldhaven SOW interact with several other workstreams within the broader Cascade US state-privacy compliance program. This section identifies the key coordination points. A. Coordination with Master DPA Templates Calderwood & Harkness is currently developing Master DPA Templates for use across Cascade's vendor relationships, includin

VII. Risk Assessment The absence of adequate data-protection terms in the Fieldhaven SOW exposes Cascade to risk across multiple dimensions. We summarize the principal risk categories below. Regulatory Risk. Without CCPA-compliant service-provider agreements, Fieldhaven's receipt and processing of Cascade personal information could be classified as a "sale" of personal information under CCPA Section 1798.140(ad), or