Contract analysis

From: Kevin Ostrowski <kostrowski@calderwoodharkness.com> To: Meredith Tanaka <mtanaka@cascaderetail.com> Cc: Alan Burke <aburke@calderwoodharkness.com> Subject: PRIVILEGED AND CONFIDENTIAL — Comprehensive Gap-Analysis Report — US State Privacy Compliance Program [C&H Matter No. 1038-00010]

**PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT**

This email and the attached document constitute a privileged and confidential attorney-client communication and attorney work product prepared in connection with the provision of legal advice. This communication is intended solely for the named recipients and may not be forwarded, disclosed, copied, or distributed to any other person or entity without the prior written authorization of Calderwood & Harkness LLP. If y

I am pleased to transmit the attached Comprehensive Gap-Analysis Report — US State Privacy Compliance (dated August 15, 2025) (the "Report"), which constitutes the key Phase 1 deliverable targeted for today's date under Calderwood & Harkness's engagement for Cascade Retail Holdings' US state-privacy compliance program. The Report is attached as **gap-analysis-report.docx**.

The Report was prepared by Alan Burke and Sara Hendricks under my supervision. I have also copied Carolyn Marsden of Whitfield Greaves LLP, consistent with the common-interest agreement in place between our firms regarding the SEC-disclosure and board-governance aspects of the privacy program.

What follows is an executive-level summary of the Report's scope, principal findings, and the remediation roadmap. I would encourage you to review this email in its entirety before turning to the full Report, as it should provide useful framing for the detailed analysis.

The Report assesses Cascade Retail Holdings Inc. and each of its subsidiaries — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. — against all 19 state privacy statutes we have identified as applicable to Cascade's operations. These include the CCPA/CPRA, VCDPA, Colorado CPA, CTDPA, UCPA, ICDPA, INCDPA, TIPA, Montana MCDPA, TDPSA, OCPA, DPDPA, NJ

The analysis builds upon three prior workstreams: (1) the multi-state applicability matrix completed June 30, 2025; (2) Calderwood & Harkness's legal review of the Fieldhaven Consulting Group LLC data-mapping report dated May 19, 2025; and (3) findings from the Phase 1 kickoff and data-mapping workshop held June 16, 2025.

The scope encompasses the full breadth of Cascade's consumer-facing operations, including:

- Direct-to-consumer retail operations across 186 retail locations in 31 states; - The e-commerce platform (cascade.com and associated mobile applications); - The third-party marketplace operated by Cascade Digital Marketplace LLC (approximately 3,800 active sellers); - The Cascade Rewards loyalty program (approximately 41.2 million registered members); - Peakview Analytics' advertising technology stack, which proces

**II. Executive Summary of Key Findings — Seven Identified Compliance Gaps**

The Report identifies seven high-priority compliance gaps. I summarize each below with its associated risk rating and near-term remediation target. The Report contains detailed statutory analysis, supporting documentation, and remediation recommendations for each gap.

**1. Outdated Privacy Policy — High Risk**

Cascade's current online privacy policy was last substantively updated in March 2022 and does not address 14 of the 19 applicable state privacy statutes. The policy omits required disclosures regarding categories of personal information sold or shared, consumer-rights mechanisms for multiple jurisdictions, and statutory notice requirements that have taken effect since the policy's last revision. Remediation target: r

**2. No Universal Opt-Out Mechanism — High Risk**

Cascade does not currently honor the Global Privacy Control (GPC) signal and does not provide a "Do Not Sell or Share My Personal Information" mechanism that satisfies the CCPA/CPRA or analogous requirements under other state statutes. This deficiency is of particular concern given that it was specifically flagged in the California Attorney General's February 2024 informal inquiry (discussed further below). Remediati

**3. Commingled Marketplace and First-Party Data — High Risk**

Third-party seller data on Cascade Digital Marketplace LLC is currently commingled with first-party customer data in a single data lake without adequate role-based access controls or logical separation. This commingling creates significant risk under multiple state statutes regarding purpose-limitation requirements, controller-processor distinctions, and unauthorized secondary use. Remediation will require implementa

**4. Missing Data Processing Agreements — High Risk**

Twenty-three of Cascade's 47 third-party advertising and analytics partners lack executed data-processing agreements. The absence of these agreements exposes Cascade to potential liability under the CCPA/CPRA's service-provider and contractor requirements, as well as analogous processor-agreement mandates in Virginia, Colorado, Connecticut, and other states. Vendor DPA templates (covering both service-provider and co

**5. Sensitive Personal Information Processing Without Required Consent — High Risk**

Precise geolocation data collected through the Cascade mobile application is being processed without the separate opt-in consent required under CCPA/CPRA Section 1798.121 and analogous provisions in other state statutes governing sensitive personal information. This gap requires implementation of a dedicated consent flow within the mobile application and related backend systems prior to the CMP deployment.

**6. No Documented Data-Retention Schedule — Medium-High Risk**

No documented data-retention schedule currently exists for customer-transaction data, loyalty-program data, or other categories of personal information maintained across Cascade's systems. Multiple state statutes require that retention periods be disclosed to consumers and that personal information not be retained beyond what is reasonably necessary for the disclosed purpose. A remediation deliverable addressing this

**7. DSR Portal Deficiencies — High Risk**

Cascade's current consumer-rights intake portal does not verify consumer identity to CCPA standards and lacks the appeal-process functionality required by Virginia, Colorado, Connecticut, and other state laws. Additionally, the current average response time of 27 calendar days exceeds the program's internal target of 15 business days or less and, in certain circumstances, may approach or exceed statutory deadlines. T

**III. Relevance of Prior Regulatory Interactions**

The Report contextualizes the identified gaps against Cascade's prior regulatory history. As you know, Cascade was the subject of an FTC Civil Investigative Demand (File No. 232-0147, issued September 14, 2023) regarding dark-pattern allegations in connection with the Cascade Rewards enrollment flow. That matter was closed with no action on April 3, 2024. Separately, the California Attorney General's office issued an

The California AG inquiry is particularly relevant here, as it highlighted deficiencies in the "Do Not Sell" link placement and the absence of conforming service-provider agreements — deficiencies that remain open and that the Report addresses at length in connection with Gaps 2 and 4 above. While neither regulatory interaction resulted in enforcement action, the persistence of these identified deficiencies represent

These matters are discussed in further detail in the privileged FTC/CA AG inquiry summary memorandum previously circulated to you and Diana on June 20, 2025.

**IV. Remediation Roadmap and Upcoming Milestones**

The Report maps each identified gap to specific remediation deliverables within the Phase 1 timeline. The key milestones are as follows:

| Deliverable / Milestone | Target Date | |---|---| | Privacy-policy suite (external notices) — drafts | September 12, 2025 | | Vendor DPA template finalized | September 30, 2025 | | Thornbridge Media Corp. data-sharing agreement restructured and executed | October 31, 2025 | | Privacy Governance Charter adopted by Board (November board meeting) | November 13, 2025 | | Consumer-rights workflow (DSR) go-live | Decembe

I want to flag the **Thornbridge Media Corp.** relationship as our highest-priority item on the vendor side. Given the volume of behavioral data exchanged between Peakview Analytics and Thornbridge and the FY2024 spend of $18.4 million, the current data-sharing arrangement requires significant restructuring to conform to applicable state-law requirements. We will need to initiate negotiations with Victor Sandoval of

On the technical implementation side, our team is coordinating closely with Marcus Ellerby at Fieldhaven Consulting Group on the data-mapping, CMP deployment, and DSR automation milestones under Fieldhaven's $3.15 million fixed-fee statement of work. Those workstreams appear to be tracking to schedule, though the Report identifies certain dependencies and potential bottlenecks that we should discuss.

I would like to propose scheduling a follow-up call during the **week of August 18** with you, Diana, and relevant internal stakeholders — specifically Gregory Farris (CISO), Priya Nandakumar (VP, Data & Analytics), and Jason Leclaire (VP, Marketing). The agenda would include:

- A detailed walkthrough of the Report's findings and the supporting analysis; - Alignment on remediation prioritization and internal resource allocation; - Discussion of the Thornbridge negotiation strategy and timeline; - Confirmation of the approach for the 23 ad-partner DPA rollout, including sequencing and escalation protocols; - Questions regarding the sensitive-PI consent flow implementation and its interactio

Diana, would you be able to coordinate calendars on your end and confirm availability? Once we have a confirmed time, Sara Hendricks will circulate a calendar invitation with dial-in details.

As a brief update, Calderwood & Harkness's Phase 1 fees are currently tracking within the $2,600,000 rate cap through December 31, 2025. I will provide a more detailed budget update, including a breakdown by workstream, during our follow-up call. Rachel Bernstein, our billing partner on this engagement, is copied on this email and is available to address any billing-related questions in the interim.

I want to express our appreciation for the Cascade team's collaboration throughout the assessment phase. The timely data access, stakeholder interviews, and responsiveness from your internal teams — particularly Gregory's and Priya's groups — were instrumental in enabling us to deliver this Report on schedule. We look forward to continuing this productive working relationship as we move into the remediation phase.

Please do not hesitate to reach out with any preliminary questions before our call. As a reminder, this communication and the attached Report are protected by attorney-client privilege and the work-product doctrine and should not be forwarded or disclosed without prior authorization from our office.

**Kevin Ostrowski** Partner, Privacy & Data Security Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022 Tel: (212) 554-7200 Email: kostrowski@calderwoodharkness.com

*CONFIDENTIALITY NOTICE: This email and any attachments are privileged and confidential, protected by the attorney-client privilege and/or the work-product doctrine, and are intended solely for the use of the individual(s) to whom they are addressed. Any unauthorized review, use, disclosure, copying, or distribution is strictly prohibited. If you have received this communication in error, please contact the sender im