Contract analysis

1. INTRODUCTION AND PURPOSE Cascade Retail Holdings Inc. ("Cascade," "we," "us," or "our"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD, together with its wholly owned subsidiaries — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. (collectively, the "Cascade Group" or the "Company") — issues thi

2. SCOPE AND APPLICABILITY 2.1 Covered Individuals This Notice applies to the following categories of individuals (collectively, "Covered Individuals"): • Current employees of Cascade Retail Holdings Inc. and each of its subsidiaries, including full-time, part-time, and seasonal employees, regardless of work location, job title, or level within the organization; • Former employees of Cascade Retail Holdings Inc. and

3. CATEGORIES OF PERSONAL INFORMATION COLLECTED The following sections describe the categories of personal information that Cascade collects about employees and job applicants. Not all categories of personal information are collected about every individual; the specific information collected depends on the individual's role, location, employment status, and the circumstances of the collection. 3.1 Identifiers. Cascad

4. SOURCES OF PERSONAL INFORMATION Cascade collects personal information about employees and job applicants from the following categories of sources: Directly from the individual. The primary source of employee and applicant personal information is the individual. Information is collected directly from you when you submit a job application, complete onboarding forms and new-hire paperwork, enroll in or make changes t

5. PURPOSES FOR COLLECTION, USE, AND DISCLOSURE 5.1 Business Purposes Cascade collects, uses, and discloses employee and applicant personal information for the following business purposes: Recruitment and Hiring. Cascade uses personal information to evaluate job applications, identify and assess qualified candidates, conduct interviews and skills assessments, perform background checks and reference checks (in complia

6. CATEGORIES OF RECIPIENTS / DISCLOSURE OF PERSONAL INFORMATION Cascade may disclose employee and applicant personal information to the following categories of recipients for the purposes described in Section 5: Cascade Subsidiaries. Personal information may be disclosed among the Covered Entities — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Cor

7. RETENTION OF EMPLOYEE AND APPLICANT PERSONAL INFORMATION Cascade retains employee and applicant personal information for the duration of the employment relationship (or, in the case of applicants, the duration of the recruitment process) and for a period thereafter as required by applicable law, regulation, contractual obligation, or legitimate business need. The Company's approach to data retention is guided by t

8. SECURITY OF PERSONAL INFORMATION Cascade is committed to protecting the confidentiality, integrity, and availability of employee and applicant personal information. The Company implements and maintains reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, destruction, and other forms of unlawful or unauthorized

9. YOUR RIGHTS UNDER APPLICABLE STATE PRIVACY LAWS Depending on your state of residence and the laws applicable to you, you may have certain rights with respect to the personal information that Cascade collects and maintains about you. This section summarizes the rights available under major state privacy statutes and explains how to exercise those rights. 9.1 California Employees and Applicants — CCPA/CPRA Rights If

10. STATE-SPECIFIC SUPPLEMENTAL DISCLOSURES 10.1 California. This Notice constitutes the notice at collection required under CCPA/CPRA Section 1798.100(b) for employee and job-applicant personal information. As required by the CCPA/CPRA, this Notice identifies the categories of personal information collected (Section 3), the purposes for which each category is collected and used (Section 5), and the categories of sen

11. BIOMETRIC DATA DISCLOSURE At certain retail store and fulfillment center locations, Cascade collects biometric information in the form of fingerprint scans or hand-geometry scans for time-clock (timekeeping) purposes. This section provides supplemental information regarding the Company's biometric-data practices. Purpose of Collection. Biometric data is collected solely for the purpose of verifying employee ident

12. WORKPLACE MONITORING DISCLOSURE Cascade monitors Company-owned systems, devices, networks, and premises for purposes of security, legal compliance, operational efficiency, and protection of Company assets and personnel. This section describes the types of monitoring activities that may affect employees and provides the disclosures required under applicable state and local law. Types of Monitoring. The Company's m