Contract analysis

1. Introduction and Purpose This Notice is provided to members and prospective members of the Cascade Rewards loyalty program (the "Program" or "Cascade Rewards"), which is operated by Cascade Rewards Corp., a Delaware corporation (EIN: 86-3381729) and wholly owned subsidiary of Cascade Retail Holdings Inc., a Delaware corporation (Nasdaq: CSRD; EIN: 84-3192057) ("Cascade," "we," "us," or "our"). The purpose of this

2. Material Terms of the Cascade Rewards Program 2.1 Program Overview Cascade Rewards is a free-to-join loyalty program available to consumers who register with a valid name and email address. Providing a phone number and mailing address is optional at the time of enrollment, though certain Program benefits (such as direct-mail promotional offers and SMS notifications) may require the provision of this additional inf

3. Categories of Personal Information Collected Through the Program Cascade collects the following categories of personal information from and about Cascade Rewards members in connection with the administration and operation of the Program. These categories correspond to the categories enumerated in California Civil Code § 1798.140(v) and related statutory provisions: Identifiers. Full legal name, email address, tele

4. Purposes of Collection and Use of Personal Information Personal information collected from Cascade Rewards members is used for the following business and commercial purposes: Program Administration. Administering the Cascade Rewards program, including tracking Cascade Points accrual and balances, processing points redemptions, managing stored-value card balances and transactions, maintaining accurate member accoun

5. Financial Incentive Disclosure Under CCPA § 1798.125(b) 5.1 Nature of the Financial Incentive The Cascade Rewards program offers price and service differences — including member-only discounts, free or reduced-cost shipping, loyalty-points accrual and redemption, birthday and anniversary rewards, and access to personalized product recommendations and curated promotional offers — to consumers who enroll in the Prog

6. Data Sharing and Third-Party Relationships Cascade Rewards member data may be shared with the following categories of recipients in connection with the administration and operation of the Program and for the other purposes described in Section 4 of this Notice: Cascade Affiliates and Subsidiaries. Cascade may share Rewards member personal information with its affiliated entities and wholly owned subsidiaries, incl

7. Consumer Rights Regarding the Financial Incentive 7.1 Right to Opt In / Consent Participation in the Cascade Rewards program is entirely voluntary. By enrolling in the Program, consumers affirmatively opt in to the financial incentive offered by Cascade, thereby consenting to the collection, use, retention, sale, and sharing of their personal information as described in this Notice and the Omnibus Privacy Policy.

8. Non-Discrimination Cascade will not discriminate against any consumer who exercises their privacy rights under the CCPA/CPRA or any other applicable state privacy law. Specifically, Cascade will not engage in any of the following practices in response to a consumer's exercise of privacy rights: (a) Denying goods or services to the consumer; (b) Charging the consumer different prices or rates for goods or services,

9. Data Retention Personal information collected through the Cascade Rewards program is retained in accordance with the Cascade Retail Holdings Inc. Data Retention & Disposal Schedule (dated October 2025) (the "Retention Schedule"). The Retention Schedule establishes specific retention periods for each category of personal information collected through the Program and across Cascade's broader business operations, and

10. Sensitive Personal Information As described in Section 3 of this Notice, the Cascade Rewards program may involve the collection and processing of the following categories of sensitive personal information, as defined under CCPA/CPRA (California Civil Code § 1798.140(ae)): (a) Precise Geolocation Data. The Cascade App collects precise geolocation data from the member's mobile device when the member has enabled loc

11. Security of Rewards Member Data Cascade implements and maintains reasonable administrative, technical, and physical security measures designed to protect the personal information of Cascade Rewards members from unauthorized access, disclosure, alteration, destruction, and other forms of unauthorized processing. These security measures are proportionate to the nature and sensitivity of the personal information col

12. Updates to This Notice Cascade may update this Loyalty-Program Privacy Notice from time to time to reflect changes in the Cascade Rewards program, applicable law, regulatory guidance, Cascade's data practices, or Cascade's business operations. When Cascade makes material changes to this Notice, Cascade will provide notice to Cascade Rewards members through reasonable means, which may include posting the updated N

13. Contact Information For questions, comments, or concerns about this Notice or the privacy practices of the Cascade Rewards program, consumers may contact Cascade using the following information: Cascade Retail Holdings Inc. Attn: Privacy Team 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119 Interim Chief Privacy Officer: Diana Polk, Associate General Counsel (Cascade is actively recruiting a full-time Chief

14. Applicable State Laws This Notice is intended to satisfy the disclosure requirements of the following state privacy statutes as they relate to loyalty programs, financial-incentive programs, and the collection, use, sale, and sharing of consumer personal information, to the extent applicable to Cascade's operations and the Cascade Rewards program: As of the engagement opening date of June 2, 2025, Calderwood & Ha