Contract analysis

Section 1.1 — Defined Terms As used in this Agreement, the following capitalized terms shall have the meanings set forth below: (a) "Applicable Privacy Laws" means the CCPA/CPRA (Cal. Civ. Code §§ 1798.100–1798.199.100) and all other U.S. state comprehensive privacy statutes applicable to either party's processing activities under or in connection with this Agreement, including without limitation: the Virginia Consum

Section 1.2 — Interpretation (a) All references in this Agreement to statutory sections, subsections, or provisions shall include all amendments, implementing regulations, formal guidance, and advisory opinions effective as of the date of the relevant obligation. Where an Applicable Privacy Law is enacted or amended after the Effective Date and imposes new or modified obligations relevant to the subject matter of thi

ARTICLE 2: CLASSIFICATION OF DATA-SHARING RELATIONSHIP

Section 2.1 — CCPA/CPRA Classification The parties acknowledge and agree that the transfer of Consumer Personal Information from Cascade to Thornbridge for programmatic advertising and audience targeting constitutes "sharing" for cross-context behavioral advertising within the meaning of California Civil Code Section 1798.140(ah). The parties further acknowledge that such transfer may constitute a "sale" within the m

Section 2.2 — Classification Under Other State Laws Under the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and analogous comprehensive state privacy statutes enumerated in the definition of Applicable Privacy Laws, both Cascade and Thornbridge operate as independent "controllers" with respect to Consumer Personal Information shared under this Agreement. Each party

Section 2.3 — No Joint Controller Relationship Nothing in this Agreement shall be construed to create a joint controller, joint venture, partnership, or agency relationship between Cascade and Thornbridge. Each party shall be solely responsible for its own compliance with Applicable Privacy Laws in its capacity as an independent controller. Neither party shall have the authority to bind the other or to make represent

ARTICLE 3: SCOPE OF DATA SHARING

Section 3.1 — Categories of Consumer Personal Information Shared Cascade shall share with Thornbridge the following categories of Consumer Personal Information, as further described in Exhibit A (Description of Data Sharing): (a) Identifiers. Hashed email addresses, device identifiers (including mobile advertising identifiers such as IDFAs and GAIDs), cookie identifiers, advertising IDs, IP addresses (truncated to th

Section 3.2 — Exclusion of Sensitive Personal Information Cascade shall not share Sensitive Personal Information with Thornbridge under this Agreement. Without limiting the generality of the foregoing, the following categories of data are expressly excluded from the scope of data sharing under this Agreement: (a) Precise geolocation data collected via the Cascade mobile application or any other Cascade system or serv

Section 3.3 — Sources of Consumer Personal Information Consumer Personal Information shared under this Agreement is collected by Cascade through the following sources: (a) cascade.com — Cascade's primary e-commerce website, including all subdomains and microsites; (b) Cascade Mobile Application — The Cascade mobile shopping and loyalty-program application available on iOS and Android platforms; (c) In-Store Point-of-

Section 3.4 — Volume and Method of Transmission Consumer Personal Information shall be transmitted from Cascade to Thornbridge via secure, encrypted API integration or encrypted Secure File Transfer Protocol ("SFTP"), as specified in Exhibit B (Technical Specifications). The parties acknowledge that the volumes of Consumer Personal Information shared under this Agreement are substantial, reflecting Cascade's approxim

ARTICLE 4: PERMITTED PURPOSES AND USE LIMITATIONS

Section 4.1 — Permitted Purposes Thornbridge may process Consumer Personal Information received from Cascade solely for the following limited and specified purposes (collectively, the "Permitted Purposes"): (a) Programmatic-Advertising Campaign Delivery. The delivery of programmatic-advertising campaigns on behalf of Cascade across Thornbridge's network of demand-side platforms, supply-side platforms, ad exchanges, a

Section 4.2 — Prohibited Uses Thornbridge shall not, under any circumstances: (a) Sell Consumer Personal Information. Sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Consumer Personal Information to any other person or entity for monetary or other valuable consideration; (b) Share for Unrelated Cross-Context Behavioral Advertising. Share Consumer Personal Information for

Section 4.3 — Data Minimization Thornbridge shall adhere to the principle of data minimization in all processing of Consumer Personal Information under this Agreement. Specifically, Thornbridge shall process only the minimum categories and volume of Consumer Personal Information that are reasonably necessary to accomplish the Permitted Purposes. Thornbridge shall not request or collect additional categories of Consum

ARTICLE 5: OPT-OUT OF SALE/SHARING COMPLIANCE

Section 5.1 — Obligation to Honor Opt-Out signals Cascade shall transmit Consumer Opt-Out signals to Thornbridge in real time, or as near to real time as is technically practicable given the parties' system architectures and integration protocols, but in no event later than twenty-four (24) hours after Cascade's receipt or detection of such Opt-Out Signal, via the mechanism specified in Exhibit B (Technical Specifica

Section 5.2 — Global Privacy Control (GPC) Signal Honoring Thornbridge shall honor GPC signals forwarded by Cascade as valid opt-out requests under the CCPA/CPRA and all other Applicable Privacy Laws that recognize the Global Privacy Control or universal opt-out mechanisms as legally binding consumer opt-out preferences. Thornbridge shall implement and maintain technical capabilities sufficient to process GPC signal

Section 5.3 — "Do Not Sell or Share" Suppression-List Maintenance Thornbridge shall maintain a comprehensive suppression list of all Consumers who have exercised their right to opt out of the sale or sharing of their Consumer Personal Information (the "Suppression List"). The Suppression List shall be synchronized with Cascade's opt-out records in accordance with the synchronization protocol specified in Exhibit B. T

Section 5.4 — Re-Opt-In Requirements If a Consumer revokes their prior opt-out and affirmatively opts back in to the sale or sharing of their Consumer Personal Information through Cascade's consumer-facing opt-in mechanism, Cascade shall notify Thornbridge in writing (which may include electronic notification via the API integration or other agreed-upon mechanism) of such re-opt-in, including the relevant Consumer id

ARTICLE 6: CONSUMER-RIGHTS ASSISTANCE

Section 6.1 — Cooperation on Consumer Requests If Cascade receives a Data Subject Request from a Consumer under any Applicable Privacy Law — including without limitation requests for access, deletion, correction, portability, or the exercise of any other right — that requires action by Thornbridge in order for Cascade to fully respond to the request, Cascade shall promptly forward such request to Thornbridge, togethe

Section 6.2 — Deletion Requests Upon receipt of a verified deletion request forwarded by Cascade, Thornbridge shall delete all Consumer Personal Information relating to the requesting Consumer from Thornbridge's systems, including all active databases, backup systems, disaster-recovery environments, and archives, within thirty (30) calendar days of receipt of the forwarded request. Thornbridge shall confirm the compl

Section 6.3 — Access and Portability Requests Upon receipt of a verified access or data-portability request forwarded by Cascade, Thornbridge shall provide to Cascade, in a structured, commonly used, and machine-readable format (such as CSV or JSON), the Consumer Personal Information that Thornbridge holds regarding the requesting Consumer, within the timeline specified in Section 6.1. Thornbridge shall ensure that t

Section 6.4 — Appeal-Process Cooperation Thornbridge shall cooperate with Cascade in connection with any Consumer appeal of a denied Data Subject Request, as required under the VCDPA, CPA, CTDPA, and other Applicable Privacy Laws that provide Consumers with a right to appeal the denial of a DSR. Such cooperation shall include providing Cascade with any additional information or documentation necessary for Cascade to

Section 6.5 — No Direct Consumer Interaction Thornbridge shall not respond directly to any Consumer requests regarding Consumer Personal Information that Thornbridge received from Cascade under this Agreement, unless Cascade provides prior written authorization for Thornbridge to do so in a specific instance. If Thornbridge receives any such request directly from a Consumer, whether by email, telephone, postal mail,

Section 7.1 — Security Obligations Thornbridge shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards to protect Consumer Personal Information against unauthorized access, use, disclosure, alteration, destruction, or loss, consistent with industry standards for entities processing comparable types and volumes of consumer data, and no less protective than the safegua

Section 7.2 — Encryption Requirements All Consumer Personal Information transmitted between Cascade and Thornbridge must be encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher. All Consumer Personal Information stored by Thornbridge must be encrypted at rest using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256) or an equivalent encryption standard approve

Section 7.3 — Access Controls Thornbridge shall restrict access to Consumer Personal Information to authorized personnel who have a legitimate, documented need-to-know in connection with the Permitted Purposes. Thornbridge shall implement and maintain role-based access controls, multi-factor authentication for access to systems containing Consumer Personal Information, and logging of all access events. Thornbridge sh

ARTICLE 8: SUB-PROCESSORS AND ONWARD TRANSFERS

Section 8.1 — Restrictions on Onward Transfers Thornbridge shall not disclose, transfer, or make available Consumer Personal Information to any sub-processor, subcontractor, affiliate, or other third party without the prior written consent of Cascade. Any request for approval of a sub-processor shall include the identity of the proposed sub-processor, a description of the processing activities to be performed, the lo

Section 8.2 — List of Approved Sub-Processors Thornbridge shall provide Cascade with a complete and current list of all sub-processors used to process Consumer Personal Information prior to the Effective Date, as set forth in Exhibit E (Approved Sub-Processors). Thornbridge shall update Exhibit E and provide written notice to Cascade at least thirty (30) calendar days before engaging any new sub-processor or making a

Section 8.3 — Liability for Sub-Processors Thornbridge shall remain fully liable to Cascade for the acts, omissions, errors, and failures of its sub-processors with respect to Consumer Personal Information as if such acts, omissions, errors, and failures were those of Thornbridge itself. Thornbridge's engagement of an approved sub-processor shall not relieve Thornbridge of any obligation under this Agreement, and Tho

ARTICLE 9: BREACH NOTIFICATION

Section 9.1 — Notification Obligation Thornbridge shall notify Cascade in writing of any confirmed or reasonably suspected Security Incident without unreasonable delay and in no event later than forty-eight (48) hours after Thornbridge's discovery of such Security Incident. Discovery shall be deemed to occur at the time at which Thornbridge becomes aware of facts sufficient to constitute a reasonable belief that a Se

Section 9.2 — Content of Notification The initial notification provided under Section 9.1 shall include, to the extent known or reasonably determinable at the time of notification: (a) The nature and scope of the Security Incident, including a description of the circumstances leading to the incident; (b) The categories and approximate number of affected Consumers; (c) The categories and approximate volume of Consumer

Section 9.3 — Cooperation Thornbridge shall cooperate fully with Cascade's investigation and response to any Security Incident, including providing information, documentation, system logs, forensic analysis results, and access to Thornbridge's systems, facilities, and personnel as reasonably requested by Cascade or its counsel, including Calderwood & Harkness LLP. Thornbridge shall coordinate with Cascade before maki

Section 9.4 — Remediation Thornbridge shall promptly take all reasonable steps to contain, investigate, and remediate any Security Incident, to mitigate the effects of the Security Incident on affected Consumers and on Cascade, and to prevent recurrence of similar incidents. Thornbridge shall, within thirty (30) calendar days of the conclusion of its investigation, provide Cascade with a written root-cause analysis a

Section 10.1 — Cascade Audit Right Cascade, or a qualified independent third-party auditor designated by Cascade and subject to appropriate confidentiality obligations, shall have the right to audit Thornbridge's compliance with this Agreement no more than two (2) times per calendar year, upon at least thirty (30) calendar days' prior written notice to Thornbridge. Audits may include inspection of Thornbridge's proce

Section 10.2 — Costs Each party shall bear its own costs and expenses incurred in connection with an audit conducted under this Article 10. Provided, however, that if an audit reveals a material breach of this Agreement by Thornbridge, including without limitation a failure to comply with the use restrictions set forth in Article 4, the opt-out compliance requirements set forth in Article 5, or the security obligatio

Section 10.3 — Confidentiality of Audit Results The findings, reports, and results of any audit conducted under this Article 10 shall be treated as Confidential Information of both parties and shall be subject to the confidentiality obligations set forth in Article 16. Audit results shall not be disclosed to any third party except (a) as required by law, regulation, or valid legal process, (b) to the auditing party's

Section 10.4 — Regulatory Audit Cooperation Thornbridge shall cooperate fully with any audit, investigation, examination, or inquiry by a governmental authority, including without limitation the Federal Trade Commission, the California Attorney General, or any state attorney general, relating to Consumer Personal Information shared under this Agreement or to Thornbridge's processing of such data. Thornbridge shall pr

ARTICLE 11: DATA RETENTION AND RETURN/DELETION

Section 11.1 — Retention Limitations Thornbridge shall retain Consumer Personal Information only for as long as reasonably necessary to accomplish the Permitted Purposes specified in Section 4.1 and in accordance with the specific retention periods set forth in Exhibit C (Data Retention Schedule). In no event shall Thornbridge retain Consumer Personal Information for longer than eighteen (18) months from the date of

Section 11.2 — Return or Deletion Upon Termination Upon termination or expiration of this Agreement for any reason, Thornbridge shall, at Cascade's election (to be communicated in writing within fifteen (15) calendar days of the date of termination or expiration), either (a) return all Consumer Personal Information in Thornbridge's possession or control to Cascade in a structured, commonly used, and machine-readable

Section 11.3 — Survival of Deletion Obligations Thornbridge's obligations under this Article 11 and the Consumer's deletion rights facilitated under Section 6.2 shall survive the termination or expiration of this Agreement and shall continue in full force and effect until all Consumer Personal Information in Thornbridge's possession or control has been returned to Cascade or securely deleted in accordance with this A

ARTICLE 12: PRIVACY NOTICES AND DISCLOSURES

Section 12.1 — Cascade's Notice Obligations Cascade shall be responsible for providing Consumers with all notices and disclosures required by Applicable Privacy Laws in connection with the data-sharing activities contemplated by this Agreement. Without limiting the generality of the foregoing, Cascade shall ensure that its consumer-facing privacy notices include disclosure that Consumer Personal Information may be "s

Section 12.2 — Thornbridge's Notice Obligations Thornbridge shall maintain its own privacy policy that accurately describes Thornbridge's processing of Consumer Personal Information received from third parties, including Cascade, and shall comply with all transparency requirements under Applicable Privacy Laws applicable to Thornbridge in its capacity as an independent controller. Thornbridge's privacy policy shall,

ARTICLE 13: REPRESENTATIONS AND WARRANTIES

Section 13.1 — Mutual Representations Each party represents and warrants to the other party that, as of the Effective Date and throughout the term of this Agreement: (a) It is duly organized, validly existing, and in good standing under the laws of its jurisdiction of incorporation (Cascade: the State of Delaware; Thornbridge: the State of Nevada); (b) It has full corporate power and authority to enter into and perfo

Section 13.2 — Cascade Representations Cascade further represents and warrants to Thornbridge that: (a) All Consumer Personal Information shared with Thornbridge under this Agreement has been collected in compliance with Applicable Privacy Laws, including the provision of all required at-collection notices, privacy-policy disclosures, and, where required, the obtaining of consent; (b) Cascade has a lawful basis under

Section 13.3 — Thornbridge Representations Thornbridge further represents and warrants to Cascade that: (a) Thornbridge has implemented and maintains commercially reasonable privacy and security programs, including written information-security policies, employee training, incident-response procedures, and data-protection assessments, appropriate to the nature and volume of Consumer Personal Information it processes;

Section 14.1 — Thornbridge Indemnification Thornbridge shall indemnify, defend, and hold harmless Cascade and its subsidiaries, including without limitation Cascade Digital Marketplace LLC, Peakview Analytics Inc., Cascade Rewards Corp., and Ridgeline Fulfillment Services Inc., and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Cascade Indemnitees"), from and agai