Contract analysis

1. Unified Governance Framework. To create a single, comprehensive set of privacy policies, procedures, and operational standards that apply consistently across all Cascade entities and business functions, replacing the patchwork of informal practices and ad hoc guidance that previously governed data handling within the organization.

2. Statutory Compliance. To ensure that Cascade and each of its subsidiaries comply with all nineteen (19) applicable United States state privacy statutes, including without limitation: (a) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100 et seq.; (b) the Virginia Consumer Data Protection Act ("VCDPA"), Va. Code Ann. §§ 59.1-575 et seq.; (c

3. Remediation of Identified Deficiencies. To address and remediate the specific compliance deficiencies identified in the Comprehensive Gap-Analysis Report dated August 15, 2025 (the "Gap-Analysis Report"), prepared by Calderwood & Harkness LLP as part of its engagement under the Engagement Letter dated June 2, 2025. The Gap-Analysis Report identified multiple areas requiring immediate and near-term remediation, inc

4. Board Governance Support. To support and implement the Privacy Governance Charter adopted by the Board of Directors of Cascade Retail Holdings Inc. on November 13, 2025 (the "Privacy Governance Charter"), which establishes the board-level oversight framework for the Company's privacy program and designates the Audit & Risk Committee of the Board as the primary oversight body for privacy and data-security matters.