Contract analysis

I. Executive Summary The purpose of this memorandum is to analyze the counterproposal received on October 3, 2025 from Victor Sandoval of Kellner Park & Associates LLP ("KP&A"), located at 555 Mission Street, 32nd Floor, San Francisco, California 94105, on behalf of Thornbridge Media Corp. ("Thornbridge"), in response to the restructured Data-Sharing Agreement ("DSA") that Calderwood & Harkness LLP ("C&H") circulated

1. Combined-Data Rights (Section 4.2 of the Draft DSA) — Thornbridge's proposal to delete the combination prohibition and replace it with a permissive combination right, subject only to de-identification within 90 days.

2. Real-Time GPC Signal Pass-Through (Section 7.3 of the Draft DSA) — Thornbridge's proposal to substitute weekly batch processing for real-time Global Privacy Control signal suppression.

3. Audit Rights (Section 9.1 of the Draft DSA) — Thornbridge's proposal to reduce audit frequency, limit audit duration, require mutual agreement on auditor selection, and permit SOC 2 Type II report substitution.

4. Indemnification Scope for Regulatory Fines (Section 11.2 of the Draft DSA) — Thornbridge's proposal to exclude regulatory fines and penalties from indemnification, or alternatively to impose a trailing 12-month fee cap. In addition, this memorandum addresses five lower-priority redline issues raised by KP&A, for which C&H recommends compromise positions that do not materially affect Cascade's compliance posture. R

II. Background A. Relationship Overview Thornbridge Media Corp. is a programmatic-advertising and audience-targeting platform that processes consumer behavioral data received from Cascade. The Thornbridge relationship is one of Cascade's longest-standing advertising partnerships, predating many of the state privacy statutes that now govern the underlying data flows. Thornbridge provides Cascade with audience-modeling

III. Issue 1: Combined-Data Rights (Section 4.2 of Draft DSA) A. Cascade's Position in Draft

Section 4.2 of C&H's initial draft DSA prohibits Thornbridge from combining Cascade consumer personal information ("PI") with personal information that Thornbridge receives from or on behalf of any other person or entity, or that Thornbridge collects from its own direct interactions with consumers. This restriction is comprehensive in scope and applies to all forms of combination, including data matching, appending,

IV. Issue 2: Real-Time GPC Signal Pass-Through (Section 7.3 of Draft DSA) A. Cascade's Position in Draft

Section 7.3 of C&H's initial draft DSA requires Thornbridge to honor Global Privacy Control ("GPC") signals passed through by Cascade in real time — that is, at the time of each ad request or data transmission. Under this provision, when a consumer has enabled GPC in their browser or device settings, Cascade will include a GPC flag in its data transmissions to Thornbridge, and Thornbridge must suppress the sale and/o

V. Issue 3: Audit Rights (Section 9.1 of Draft DSA) A. Cascade's Position in Draft

Section 9.1 of C&H's initial draft DSA grants Cascade, or a third-party auditor designated by Cascade, the right to audit Thornbridge's data-processing practices, facilities, and records for compliance with the DSA. The audit right is exercisable upon 30 days' written notice and may be exercised up to two times per calendar year. The scope of the audit right, as drafted, encompasses the following: • Inspection of dat

VI. Issue 4: Indemnification Scope for Regulatory Fines (Section 11.2 of Draft DSA) A. Cascade's Position in Draft

Section 11.2 of C&H's initial draft DSA provides that Thornbridge will indemnify, defend, and hold harmless Cascade and its affiliates, officers, directors, employees, and agents from and against any and all losses, damages, liabilities, fines, penalties, enforcement costs, attorneys' fees, and expenses arising from or relating to: (a) Thornbridge's breach of any provision of the DSA; or (b) Thornbridge's violation o

VII. Additional Redline Issues (Lower Priority) In addition to the four principal issues analyzed above, KP&A's counterproposal includes redlines to several additional DSA provisions. C&H's analysis and recommended positions on these lower-priority issues are set forth below. None of these issues presents a compliance risk comparable to Issues 1 through 4, and each is amenable to a reasonable compromise. A. Definitio