Contract analysis

I. EXECUTIVE SUMMARY The purpose of this memorandum is to set forth the comprehensive work plan, milestone schedule, staffing allocations, and budget framework for Phase 1 of the United States state-privacy compliance program for Cascade Retail Holdings Inc. ("Cascade" or "CRH"), a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and publicly traded on the Nasdaq

II. CLIENT & MATTER OVERVIEW A. Client Profile Corporate Information. The client is Cascade Retail Holdings Inc., a corporation organized and existing under the laws of the State of Delaware. Cascade is publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD. Its principal executive offices are located at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Key Personnel. The following ind

1. Cascade Digital Marketplace LLC ("CDM") — CDM operates a third-party seller marketplace with approximately 3,800 active sellers. CDM's operations implicate controller-processor distinctions under multiple state privacy statutes, as third-party sellers both contribute and access consumer data through the marketplace platform.

2. Ridgeline Fulfillment Services Inc. ("Ridgeline") — Ridgeline provides warehousing and logistics services for both Cascade's first-party e-commerce operations and CDM sellers. Ridgeline processes consumer shipping addresses, order details, and related logistics data.

3. Peakview Analytics Inc. ("Peakview") — Peakview is Cascade's advertising technology and customer analytics subsidiary. Peakview processes approximately 2.1 billion consumer-event data records per month, including browsing behavior, purchase history, and advertising-attribution data. Peakview's data-processing activities are among the highest-risk elements of the compliance program due to the volume and sensitivity

4. Cascade Rewards Corp. — Cascade Rewards Corp. administers the Cascade Rewards loyalty program and stored-value card programs. The loyalty program's 41.2 million members generate detailed purchase-history, preference, and behavioral data that is used across Cascade's marketing and analytics functions. B. Regulatory Landscape As of the date this engagement was opened, Cascade's operations are subject to nineteen (19

1. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)

2. Virginia Consumer Data Protection Act (VCDPA)

3. Colorado Privacy Act (CPA)

4. Connecticut Data Privacy Act (CTDPA)

5. Utah Consumer Privacy Act (UCPA)

6. Iowa Consumer Data Protection Act (ICDPA)

7. Indiana Consumer Data Protection Act (INCDPA)

8. Tennessee Information Protection Act (TIPA)

9. Montana Consumer Data Privacy Act (MCDPA)

10. Texas Data Privacy and Security Act (TDPSA)

11. Oregon Consumer Privacy Act (OCPA)

12. Delaware Personal Data Privacy Act (DPDPA)

13. New Jersey Data Privacy Act (NJDPA)

14. New Hampshire Data Privacy Act (NHDPA)

15. Nebraska Data Privacy Act (NDPA)

16. Minnesota Consumer Data Privacy Act (Minnesota MCDPA)

17. Maryland Online Data Privacy Act (MODPA)

18. Kentucky Data Privacy Act (KYDPA)

19. Additional statutes enacted or becoming effective through 2025–2026 It bears emphasis that Cascade ships e-commerce orders to consumers in all 50 states plus the District of Columbia. While not all states have enacted comprehensive privacy statutes, Cascade's nationwide e-commerce footprint means that additional state laws may become applicable during the Phase 1 period as new legislation is enacted or existing l

III. ENGAGEMENT TEAM & STAFFING ALLOCATIONS A. Calderwood & Harkness LLP Team The following table sets forth the C&H engagement team, together with each team member's role, hourly rate, estimated Phase 1 hours, and estimated Phase 1 fees. All rates are as set forth in the engagement letter dated June 2, 2025. The estimated total of approximately $2,236,000 provides a buffer of approximately $364,000 against the Phase

IV. PHASE 1 MILESTONE SCHEDULE A. Master Timeline The following table sets forth the complete Phase 1 milestone schedule, including target dates, deliverables, lead personnel, and key dependencies. Milestones marked in bold represent critical-path deliverables that gate subsequent workstreams or represent major engagement checkpoints. B. Workstream Decomposition The Phase 1 work plan is organized into five workstream

V. BUDGET MANAGEMENT A. Phase 1 Fee Cap Analysis The total Phase 1 fee cap, as established in the engagement letter dated June 2, 2025, is $2,600,000. The estimated fee allocation by workstream is set forth in the following table: The fee allocation reflects the relative complexity and scope of each workstream. Workstream 1 (Assessment & Gap Analysis) and Workstream 3 (Contracts & Vendor Management) are the two most

VI. COORDINATION WITH FIELDHAVEN CONSULTING GROUP LLC A. Role & Scope Fieldhaven Consulting Group LLC ("Fieldhaven") has been retained by Cascade as a technology consultant to perform the technical implementation work necessary to support the privacy compliance program. Fieldhaven's engagement lead is Marcus Ellerby, based at Fieldhaven's San Francisco office at 350 Sansome Street, Suite 400, San Francisco, Californi

VII. COORDINATION WITH WHITFIELD GREAVES LLP A. Role & Scope Whitfield Greaves LLP ("Whitfield Greaves") serves as Cascade's longstanding securities and corporate governance counsel. The lead partner on the Cascade relationship is Carolyn J. Marsden, based at Whitfield Greaves' Washington, D.C. office at 1999 K Street NW, Suite 700, Washington, D.C. 20006. Whitfield Greaves' role in connection with the privacy compli

VIII. RISK FACTORS & CONTINGENCIES A. Schedule Risks The following schedule risks have been identified and should be monitored throughout Phase 1: Thornbridge Negotiation Complexity. The restructured data-sharing agreement with Thornbridge Media Corp. represents the single largest contractual-restructuring effort within Phase 1. Thornbridge is Cascade's largest advertising and media partner, with an annual spend of $

IX. REPORTING & COMMUNICATION PROTOCOLS A. Internal C&H Reporting The following internal reporting protocols will be maintained throughout Phase 1: • Weekly Team Meeting. Kevin Ostrowski, Rachel Bernstein, Alan Burke, and Sara Hendricks will hold a weekly team meeting (anticipated for Monday mornings) to review engagement status, discuss open issues, identify risks, and address budget matters. Alan Burke will prepare

X. APPROVAL This Phase 1 Work Plan & Staffing Memorandum has been prepared by the undersigned for review and approval by Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP. Upon approval, this memorandum will serve as the governing work plan for Phase 1 of the Cascade Retail Holdings Inc. US state-privacy compliance program engagement. The approved memorandum will be distributed to the C&H e