Contract analysis

Section 1: Purpose and Scope 1.1 Purpose These Data Subject Request Standard Operating Procedures (the "SOPs" or "Procedures") establish standardized, enterprise-wide procedures for receiving, verifying, processing, responding to, and tracking consumer data-subject requests ("DSRs") across all Cascade Retail Holdings Inc. ("Cascade" or the "Company") business units and subsidiaries. The SOPs are designed to provide a

1. Cascade Retail Holdings Inc. — The parent company and publicly traded entity (incorporated in the State of Delaware; Nasdaq ticker symbol: CSRD; corporate headquarters located at 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119). Cascade Retail Holdings Inc. operates direct-to-consumer retail and e-commerce operations, including the cascade.com website and the Cascade mobile application.

2. Cascade Digital Marketplace LLC ("CDM") — A wholly owned subsidiary operating the third-party seller marketplace accessible at cascade.com/marketplace. CDM facilitates transactions between approximately 3,800 third-party sellers and consumers. CDM processes personal information of both consumers who purchase through the marketplace and the third-party sellers themselves (to the extent such sellers are natural pers

3. Ridgeline Fulfillment Services Inc. ("Ridgeline") — A wholly owned subsidiary providing warehousing, order-fulfillment, and logistics services for Cascade's direct retail operations and, in certain cases, for CDM third-party sellers enrolled in the Fulfillment-by-Cascade program. Ridgeline processes personal information related to shipping addresses, delivery records, and fulfillment-related communications.

4. Peakview Analytics Inc. ("Peakview") — A wholly owned subsidiary providing advertising-technology services and customer-analytics capabilities to the Cascade enterprise. Peakview operates a centralized data lake that processes approximately 2.1 billion consumer-event data records per month, including browsing behavior, purchase history, geolocation data, and inferences derived from such data. Peakview's data-proce

5. Cascade Rewards Corp. ("Cascade Rewards") — A wholly owned subsidiary administering the Cascade Rewards loyalty and stored-value card programs. Cascade Rewards maintains a registered-member base of approximately 41.2 million members as of the date of these SOPs. The Cascade Rewards program collects and processes personal information including member names, contact information, purchase history, stored-value card b

Section 2: Definitions The following defined terms are used throughout these SOPs. Where a term is defined by reference to a specific statute, the definition is harmonized to the extent practicable across all nineteen (19) applicable state privacy statutes. In the event of a conflict between statutory definitions, the most protective or expansive definition applicable to the consumer's state of residence shall govern

Section 3: Roles and Responsibilities Effective DSR processing requires clearly defined roles and responsibilities across multiple functions within Cascade and among its external advisors and technology partners. This Section identifies the individuals and teams responsible for the key elements of the DSR program and delineates their respective authorities and obligations. 3.1 Interim Chief Privacy Officer — Diana Po

Section 4: DSR Intake Channels Cascade offers multiple channels through which consumers may submit data-subject requests, in accordance with the CCPA/CPRA and other applicable state privacy statutes. These channels are designed to be accessible, easy to use, and free of charge. All intake channels feed into the centralized DSR Automation Tool, which serves as the system of record for all DSR processing activities. 4.

Section 5: Identity Verification Procedures 5.1 Verification Standard All verifiable consumer requests for access to personal information, deletion of personal information, and correction of personal information must be verified to the standards established by the CCPA/CPRA implementing regulations (Cal. Code Regs. tit. 11, §§ 7060–7064). While the CCPA/CPRA regulations apply directly only to California residents, Ca

Section 6: Request Processing Procedures 6.1 General Processing Timeline The internal processing-time target for all data-subject requests is a maximum of fifteen (15) business days from the receipt of a verifiable consumer request. For requests that require post-intake identity verification, the fifteen (15) business-day clock begins on the date of successful identity verification (or, in the case of opt-out request

1. Verify the consumer's identity in accordance with the Standard Requests tier (Section 5.2.1; minimum two data points; reasonable degree of certainty).

2. Using the enterprise data map (as documented in the Fieldhaven data-mapping report dated May 19, 2025), identify the categories of personal information that Cascade has collected about the consumer during the preceding twelve (12) months.

3. Compile a response that includes (a) the categories of personal information collected, (b) the categories of sources from which the personal information was collected, (c) the business or commercial purposes for collecting, selling, or sharing the personal information, and (d)