Contract analysis

I. RECITALS WHEREAS, Cascade Retail Holdings Inc. ("Cascade" or the "Company"), a corporation duly organized and existing under the laws of the State of Delaware and publicly traded on the Nasdaq Global Select Market under the ticker symbol "CSRD," is an omnichannel retailer and e-commerce platform that reported approximately $3.87 billion in revenue for the fiscal year ended January 31, 2025 ("FY2024"), employs appr

II. DEFINITIONS For purposes of this Charter, the following terms shall have the meanings ascribed to them below. Capitalized terms used but not defined in this Section II shall have the meanings ascribed to them elsewhere in this Charter. "Applicable Privacy Laws" means all United States state privacy and data-protection statutes that are applicable to the Company's business operations, including the collection, use

III. ESTABLISHMENT AND APPOINTMENT OF THE CHIEF PRIVACY OFFICER A. Creation of the CPO Role The Board of Directors hereby formally establishes the position of Chief Privacy Officer as a senior leadership role within the Company. The CPO shall serve as the designated officer with enterprise-wide responsibility for the design, implementation, maintenance, and continuous improvement of the Privacy Program. The creation

IV. CPO DUTIES AND RESPONSIBILITIES The Chief Privacy Officer shall have the duties and responsibilities set forth in this Section IV. These duties are intended to be comprehensive but not exhaustive; the CPO shall also undertake such additional privacy-related duties as may be reasonably assigned by the General Counsel, the CEO, or the Audit & Risk Committee from time to time. A. Privacy Program Oversight The CPO sh

V. AUDIT & RISK COMMITTEE OVERSIGHT RESPONSIBILITIES A. Committee Role The Audit & Risk Committee of the Board of Directors, currently chaired by Director Ellen Marchetti, shall serve as the Board-level body with primary oversight responsibility for the Company's Privacy Program. The Audit & Risk Committee's oversight of the Privacy Program is an extension of the Committee's existing mandate to oversee the Company's

VI. BOARD-LEVEL OVERSIGHT AND GOVERNANCE PRINCIPLES A. Board Oversight The Board of Directors retains ultimate oversight responsibility for the Company's privacy and data-protection program as a component of the Company's enterprise risk management framework. The Board recognizes that privacy-related risks, including regulatory enforcement, litigation, reputational harm, and operational disruption, are among the mate

VII. CROSS-FUNCTIONAL COORDINATION The CPO shall establish and chair a cross-functional Privacy Steering Committee (the "Steering Committee") to facilitate coordination and communication across the Company's business units and functional areas on privacy and data-protection matters. The Steering Committee shall be composed of representatives from the following departments and entities: (i) Legal (General Counsel's of

VIII. RESOURCES, BUDGET, AND OUTSIDE ADVISORS A. Staffing and Budget The CPO shall be provided with adequate internal staffing and budget resources to fulfill the obligations set forth in this Charter. The Board of Directors acknowledges the importance of providing sufficient resources to the Privacy Program and recognizes that the scope of the Company's privacy compliance obligations, the complexity of the regulator

IX. CHARTER REVIEW AND AMENDMENT This Charter shall be reviewed at least annually by the Audit & Risk Committee, with the first such review to be conducted no later than November 2026. The annual review shall assess the continued adequacy and appropriateness of the Charter in light of changes in the Company's business operations, the regulatory landscape, industry best practices, and the maturity of the Privacy Progr

X. EFFECTIVE DATE This Charter shall become effective immediately upon adoption by the Board of Directors on November 13, 2025. All obligations, duties, and responsibilities established under this Charter shall be in effect as of such date, including the reporting and escalation obligations set forth in Sections IV, V, and VI.

XI. CERTIFICATION AND SIGNATURES The undersigned hereby certify the adoption of this Resolution and the Privacy Governance Charter attached hereto by the Board of Directors of Cascade Retail Holdings Inc. at a duly noticed and convened meeting of the Board held on November 13, 2025, at which a quorum was present and acting throughout. APPROVED AND ADOPTED: BOARD OF DIRECTORS OF CASCADE RETAIL HOLDINGS INC. By: ______