Contract analysis

ARTICLE 1 — DEFINITIONS 1.1 "Consumer Personal Information" or "Consumer PI" means personal information (as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(v), and equivalent definitions under other Applicable Privacy Laws) relating to consumers who interact with the Marketplace, including but not limited to: identifiers (e.g., name, mailing address, email address, telephone number, unique personal identifier, onl

ARTICLE 2 — SCOPE AND APPLICABILITY 2.1 Scope. This Addendum applies to all Consumer PI and Seller Data processed by either Party, or by any sub-processor or agent of either Party, in connection with the Marketplace, including but not limited to Consumer PI and Seller Data collected, generated, transmitted, stored, used, disclosed, or otherwise processed through the Marketplace platform, the Seller portal, Marketplac

ARTICLE 3 — DATA SEGREGATION REQUIREMENTS 3.1 Obligation to Segregate. CDM shall implement and maintain technical and organizational measures designed to segregate Marketplace Transaction Data and Seller Data from First-Party Customer Data. These measures shall include, at a minimum, the following: (a) Logical Separation. CDM shall implement logical separation of Marketplace Transaction Data from First-Party Customer

ARTICLE 4 — PERMITTED USES AND PURPOSE LIMITATIONS 4.1 Seller's Permitted Uses of Consumer PI. Seller may process Marketplace Transaction Data solely for the following purposes (each a "Permitted Purpose"), and for no other purpose: (a) Order Fulfillment. Processing Consumer PI as necessary to fulfill consumer orders placed through the Marketplace, including picking, packing, shipping, delivery, and delivery confirma

ARTICLE 5 — SELLER OBLIGATIONS REGARDING CONSUMER PI 5.1 Privacy Notice. Seller shall maintain a consumer-facing privacy notice (a "Seller Privacy Notice") that is publicly accessible, written in clear and plain language, and that accurately and completely describes Seller's collection, use, disclosure, and retention of Consumer PI, consistent with the requirements of all Applicable Privacy Laws. The Seller Privacy N

ARTICLE 6 — DATA SUBJECT REQUEST COOPERATION 6.1 Notification by Seller. If Seller receives a DSR directly from a consumer (whether submitted by email, mail, telephone, or any other means) and such DSR relates to Consumer PI processed through the Marketplace, Seller shall notify CDM of the DSR within three (3) business days of receipt. Such notification shall be submitted through the CDM DSR coordination portal (curr

ARTICLE 7 — DATA RETENTION AND DISPOSAL 7.1 Retention Periods. Seller shall retain Marketplace Transaction Data containing Consumer PI only for so long as reasonably necessary to fulfill the Permitted Purposes set forth in Article 4 and to comply with applicable legal obligations (including, without limitation, tax record-keeping requirements, product-safety obligations, and litigation holds). Unless a longer retenti

ARTICLE 8 — SUB-PROCESSORS AND ONWARD TRANSFERS 8.1 Restrictions on Disclosure. Seller shall not disclose, transfer, make available, or otherwise provide Consumer PI obtained through the Marketplace to any sub-processor, agent, contractor, affiliate, or other third party (each, a "Downstream Recipient") without CDM's prior written consent. Requests for consent shall be submitted through the Marketplace Seller portal

ARTICLE 9 — SECURITY INCIDENTS AND BREACH NOTIFICATION 9.1 Notification Obligation. If Seller becomes aware of any unauthorized access to, acquisition of, use of, or disclosure of Consumer PI obtained through the Marketplace, or any other event that compromises the security, confidentiality, or integrity of such Consumer PI (each, a "Security Incident"), Seller shall notify CDM of the Security Incident within forty-e

ARTICLE 10 — COMPLIANCE AND AUDIT RIGHTS 10.1 Compliance Representations. Seller represents and warrants that, as of the Effective Date and on an ongoing basis throughout the term of this Addendum, Seller is and will remain in compliance with the obligations set forth in this Addendum and with all Applicable Privacy Laws with respect to Seller's processing of Consumer PI and Seller Data in connection with the Marketp

ARTICLE 11 — REGULATORY INQUIRIES AND COOPERATION 11.1 Notification of Regulatory Inquiries. Seller shall promptly notify CDM (and in no event later than five (5) business days after receipt) if Seller receives any regulatory inquiry, Civil Investigative Demand, subpoena, demand letter, notice of investigation, notice of enforcement action, or other communication from any governmental authority (including, without li

ARTICLE 12 — INDEMNIFICATION 12.1 Seller Indemnification. Seller shall indemnify, defend, and hold harmless CDM, Cascade Retail Holdings Inc., Cascade Rewards Corp., Peakview Analytics Inc., and their respective affiliates, subsidiaries, parent companies, officers, directors, employees, agents, successors, and assigns (collectively, the "CDM Indemnified Parties") from and against any and all claims, demands, actions,

ARTICLE 13 — TERM AND TERMINATION 13.1 Term. This Addendum is effective as of October 31, 2025 and shall remain in full force and effect for so long as Seller maintains an active account on the Cascade Digital Marketplace, unless earlier terminated in accordance with this Article 13. Upon the termination or expiration of the Seller Terms of Service for any reason, this Addendum shall terminate concurrently, subject t