Contract analysis

Section 1: Purpose and Objectives 1.1 Purpose. This document establishes the Privacy Impact Assessment ("PIA") Framework and reusable PIA Template for Cascade Retail Holdings Inc. ("Cascade" or the "Company") and all of its direct and indirect subsidiaries, including Cascade Digital Marketplace LLC ("CDM"), Ridgeline Fulfillment Services Inc. ("Ridgeline"), Peakview Analytics Inc. ("Peakview"), and Cascade Rewards Co

Section 2: Scope and Applicability 2.1 Covered Entities This PIA Framework applies to all of the following entities (collectively, the "Covered Entities"): Each Covered Entity is responsible for complying with this Framework with respect to data-processing activities within its operational scope. Where a processing activity spans multiple Covered Entities (for example, where CDM collects consumer data that is subsequ

Section 3: Roles and Responsibilities The effective operation of this PIA Framework depends on the clear assignment of roles and responsibilities across the organization. The following individuals and groups bear specific responsibilities under this Framework: 3.1 Chief Privacy Officer (or Interim CPO) Diana Polk, Associate General Counsel, currently serving as Interim Chief Privacy Officer, is responsible for overal

Section 4: PIA Process — Step-by-Step Methodology This Section describes the eight-step methodology for conducting a Privacy Impact Assessment under this Framework. Each step is designed to build upon the prior step, producing a comprehensive, documented assessment that satisfies the requirements of all applicable state privacy statutes and supports Cascade's internal governance objectives. 4.1 Step 1: Threshold Scre

Section 5: PIA Register and Recordkeeping 5.1 Central PIA Register The PIA Coordinator maintains a central PIA Register that serves as the master record of all PIA activity across the Covered Entities. The Register is maintained in a secure, access-controlled electronic format and contains the following fields for each entry: 5.2 Retention Requirements Completed PIAs, including all supporting documentation, data-flow

Section 6: Integration with Related Compliance Program Elements The PIA Framework does not operate in isolation. It is designed to function as an integrated component of Cascade's comprehensive US State Privacy Compliance Program. This Section identifies the key cross-references between the PIA Framework and other elements of the Program. Internal Privacy Policy & Procedures Manual. The PIA Framework is referenced in

Section 7: Regulatory Considerations and Guidance 7.1 Summary of Key State-Law Assessment Mandates As described in Section 2.3 above, multiple state privacy statutes impose affirmative obligations on controllers to conduct data protection assessments for certain categories of processing. The following table provides a summary of the key provisions, with statutory citations: 7.2 Unified Assessment Approach PIAs comple