Contract analysis

I. Executive Summary The purpose of this memorandum is to set forth a structured, phased strategy for deploying data processing agreements ("DPAs") to the twenty-three (23) of Cascade Retail Holdings Inc.'s ("Cascade" or the "Company") forty-seven (47) third-party advertising and analytics partners that currently lack executed data processing agreements or equivalent contractual data-protection provisions. This compl

II. Background A. Cascade's Third-Party Advertising and Analytics Ecosystem Cascade Retail Holdings Inc. operates one of the largest omnichannel retail platforms in the United States, and its advertising, analytics, and customer-engagement operations depend on a substantial ecosystem of third-party service providers and technology partners. As documented in the Fieldhaven Data-Mapping Report, Cascade currently shares

III. DPA Classification Framework A. Service Provider vs. Contractor Determination A threshold determination in the DPA rollout process is the proper classification of each of the twenty-three partners as a "service provider," "contractor," or "third party" under CCPA/CPRA, and the analogous classification as a "processor" or "third party" under the other applicable state privacy statutes. The classification determin

IV. DPA Templates and Vendor-Specific Schedules A. Master DPA Template — Service Providers The Master Data Processing Agreement Template — Service Providers was finalized on September 30, 2025, and is being delivered to Cascade under separate cover concurrently with this memorandum. The Service Provider DPA Template has been designed to serve as the standard form agreement for all vendor relationships classified unde

1. Limitations on Use, Retention, and Disclosure of Personal Information. The vendor is prohibited from selling or sharing the personal information; retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the agreement; retaining, using, or disclosing the personal information outside of the direct business relationship between the vendor and Cascade; an

2. Compliance with CCPA and Applicable State Privacy Statutes. The vendor is obligated to comply with all applicable provisions of CCPA/CPRA and each of the nineteen applicable state privacy statutes identified in the agreement, and to process personal information only in accordance with Cascade's documented instructions.

3. Compliance-Assistance Obligations. The vendor is required to assist Cascade in fulfilling its obligations under applicable privacy laws, including cooperation with consumer data subject requests ("DSRs") for access, deletion, correction, and opt-out; pass-through of opt-out preference signals, including the Global Privacy Control; and assistance with data-protection impact assessments and regulatory inquiries.

4. Audit Rights. Cascade retains the right to conduct audits or inspections, or to engage a qualified independent assessor to conduct audits, of the vendor's data-processing activities and compliance with the DPA, upon reasonable notice and subject to reasonable confidentiality protections.

5. Sub-Processor Restrictions and Flow-Down Requirements. The vendor may not engage sub-processors to process Cascade personal information without Cascade's prior written consent. All sub-processor engagements must be governed by written agreements imposing data-protection obligations no less restrictive than those set forth in the DPA, with the vendor remaining fully liable for the acts and omissions of its sub-proc

6. Deletion and Return Obligations Upon Termination. Upon termination or expiration of the service relationship, the vendor must, at Cascade's election, return or delete all personal information processed under the DPA, and certify in writing that it has done so, subject to limited exceptions for data required to be retained by applicable law.

7. Certification of Understanding. The vendor must certify that it understands the restrictions and prohibitions set forth in the DPA and will comply with them, in accordance with the certification requirements of CCPA Section 1798.100(d).

8. Data Breach and Incident Notification. The vendor must notify Cascade of any actual or reasonably suspected security incident or personal-data breach within seventy-two (72) hours of discovery, and must cooperate with Cascade's incident-response and notification activities.

9. Indemnification for Unauthorized Use. The vendor must indemnify, defend, and hold harmless Cascade and its affiliates from and against any losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees) arising from or related to the vendor's unauthorized use, disclosure, or processing of personal information in violation of the DPA. The Service Provider DPA Template is designed for multi-

1. Express Prohibition on Data Combination. The contractor is expressly prohibited from combining personal information received from or on behalf of Cascade with personal information that the contractor receives from or on behalf of another person or persons, or that the contractor collects from its own interaction with the consumer, except as expressly permitted by CCPA Section 1798.140(j)(1)(A)(iv) (i.e., to perfor

2. Annual Certification Requirement. The contractor must provide Cascade with an annual written certification, executed by a duly authorized officer or representative, confirming that the contractor understands its obligations under the DPA and under applicable law, that it has not engaged in any prohibited use, disclosure, or combination of Cascade personal information, and that it has implemented and maintained rea

3. Enhanced Compliance-Monitoring Provisions. The DPA includes provisions granting Cascade enhanced rights to monitor the contractor's compliance, including the right to request and review the contractor's data-processing records, conduct or commission compliance assessments on an annual basis, and require the contractor to implement additional safeguards if compliance deficiencies are identified. The Contractor DPA

V. Rollout Prioritization and Phasing A. Prioritization Criteria The twenty-three vendors lacking DPAs have been organized into three waves for purposes of outreach, negotiation, and execution. The wave assignments are based on a multi-factor prioritization analysis that considers the following criteria:

1. Data Volume. The volume of consumer personal information received or processed by the partner, measured by the number of records disclosed, the frequency of data transfers (e.g., real-time, daily batch, weekly), and the breadth of data categories involved. Partners receiving the largest volumes of personal information present the greatest compliance exposure and are prioritized accordingly.

2. Data Sensitivity. Whether the partner receives categories of personal information that are classified as "sensitive personal information" under CCPA/CPRA or as "sensitive data" under other applicable state statutes, including precise geolocation data, payment-card data, or data from which inferences about protected characteristics may be drawn. Partners receiving sensitive personal information without adequate con

3. Risk Classification. Whether the partner's current data-processing practices, absent a DPA, are likely to constitute a "sale" or "sharing" of personal information under CCPA or analogous state statutes. Partners whose data practices most closely resemble third-party data sharing—rather than service-provider or contractor processing—are prioritized to minimize the period of uncontracted exposure.

4. Regulatory Exposure. Whether the partner's data-processing activities were specifically identified or implicated in prior regulatory inquiries directed at Cascade, including the Federal Trade Commission Civil Investigative Demand (File No. 232-0147) and the California Attorney General's informal inquiry letter dated February 6, 2024. Partners whose data flows were the subject of regulatory scrutiny receive priorit

5. Revenue Significance. Cascade's annual spend with the partner and the business criticality of the partner's services to Cascade's advertising and analytics operations. Partners with significant annual spend represent both higher financial exposure in the event of a relationship disruption and greater leverage in negotiating DPA terms. These criteria were applied in consultation with Diana Polk and with input from

VI. Rollout Process and Workflow A. Step 1: Vendor Outreach and Data Confirmation The rollout process for each wave will commence with the transmittal of a formal vendor outreach letter and draft DPA to each vendor in the wave. Calderwood & Harkness will prepare the outreach letters on Cascade Retail Holdings Inc. letterhead, to be signed by Diana Polk in her capacity as Associate General Counsel and Interim Chief Pr

VII. Tracking and Reporting A. DPA Status Tracker Calderwood & Harkness will create and maintain a centralized DPA Status Tracker in spreadsheet format to provide real-time visibility into the status of each of the twenty-three vendor DPA engagements throughout the rollout process. The tracker will include the following fields for each vendor: Sara Hendricks will be primarily responsible for maintaining the tracker,

VIII. Coordination with Related Workstreams The DPA rollout does not exist in isolation. It is one component of the broader Cascade US State Privacy Compliance Program, and its success depends on effective coordination with several related workstreams. This section identifies the key coordination points and the interfaces between the DPA rollout and other program elements. A. Thornbridge Media Corp. — Separate Track