Contract analysis

Section 1: Introduction and Scope Cascade Digital Marketplace LLC ("CDM," "we," "us," or "our"), EIN 85-4107638, is a Delaware limited liability company and wholly owned subsidiary of Cascade Retail Holdings Inc. (Nasdaq: CSRD), a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119. CDM operates the third-party seller marketplace located at cascade.com/marketplace (the "Marke

1. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100–1798.199.100;

2. The Virginia Consumer Data Protection Act ("VCDPA"), Va. Code §§ 59.1-575 through 59.1-585;

3. The Colorado Privacy Act ("CPA"), Colo. Rev. Stat. §§ 6-1-1301 through 6-1-1313;

4. The Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 through 42-525;

5. The Utah Consumer Privacy Act ("UCPA"), Utah Code §§ 13-61-101 through 13-61-404;

6. The Iowa Consumer Data Protection Act ("ICDPA"), Iowa Code ch. 715D;

7. The Indiana Consumer Data Protection Act ("INCDPA"), Ind. Code §§ 24-15-1-1 through 24-15-9-1;

8. The Tennessee Information Protection Act ("TIPA"), Tenn. Code §§ 47-18-3601 through 47-18-3614;

9. The Montana Consumer Data Privacy Act ("MCDPA"), Mont. Code §§ 30-14-2801 through 30-14-2817;

10. The Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code ch. 541;

11. The Oregon Consumer Privacy Act ("OCPA"), Or. Rev. Stat. §§ 646A.570 through 646A.604;

12. The Delaware Personal Data Privacy Act ("DPDPA"), Del. Code tit. 6, ch. 12D;

13. The New Jersey Data Privacy Act ("NJDPA"), N.J. Stat. §§ 56:8-166 through 56:8-189;

14. The New Hampshire Data Privacy Act ("NHDPA"), N.H. Rev. Stat. ch. 507-H;

15. The Nebraska Data Privacy Act ("NDPA"), Neb. Rev. Stat. §§ 87-1101 through 87-1116;

16. The Minnesota Consumer Data Privacy Act, Minn. Stat. ch. 325O;

17. The Maryland Online Data Privacy Act ("MODPA"), Md. Code Com. Law §§ 14-4601 through 14-4614;

18. The Kentucky Data Privacy Act ("KYDPA"), Ky. Rev. Stat. ch. 367; and

19. Additional state statutes effective or enacted through 2025–2026 that impose obligations on CDM with respect to the processing of seller personal information. Cascade operates 186 retail locations across 31 states and ships e-commerce orders to all 50 states and the District of Columbia. Because Sellers may be located in any state across the country, and because Cascade's operations touch numerous jurisdictions,

Section 2: Personal Information We Collect About Sellers 2.1 Categories of Personal Information CDM collects the following categories of personal information from or about Sellers in connection with the operation of the Marketplace. The specific pieces of information collected may vary depending on the nature of the seller's business, the products or services offered, and the seller's interactions with the Platform.

Section 3: Purposes of Processing CDM processes seller personal information for the following specific business and commercial purposes: Marketplace Platform Operation. CDM uses seller personal information to create and maintain seller accounts on the Marketplace, to enable the listing of products and services, to process and facilitate transactions between sellers and buyers, and to manage seller storefronts. This i

Section 4: How We Share Seller Personal Information 4.1 Categories of Recipients CDM may disclose seller personal information to the following categories of recipients for the purposes described in this Notice: Cascade Affiliates. CDM may share seller personal information with its parent company, Cascade Retail Holdings Inc., and with the following Cascade subsidiaries and affiliates, as necessary to support the Mark

Section 5: Data Retention CDM retains seller personal information for the period reasonably necessary to fulfill the purposes described in this Notice, or as otherwise required or permitted by applicable law. The applicable retention period for any particular category of personal information depends on the nature of the information, the purposes for which it was collected, and any legal, regulatory, or contractual re

Section 6: Seller Rights Under Applicable State Privacy Laws 6.1 Overview of Rights Sellers who are natural persons (including individual sellers, sole proprietors, and authorized representatives of seller entities) may have certain rights with respect to their personal information under applicable state privacy laws. Where applicable, these rights may also be exercised by an authorized agent acting on the seller's b

Section 7: How to Submit a Privacy Request Sellers who wish to exercise any of the privacy rights described in Section 6 of this Notice may submit a request using any of the following methods: • Online DSR Portal: Submit a request through CDM's online data subject request portal at cascade.com/privacy-requests. The portal provides a guided process for submitting access, deletion, correction, and opt-out requests. • E

Section 8: Data Security CDM takes the security of seller personal information seriously and implements reasonable administrative, technical, and physical safeguards designed to protect seller personal information against unauthorized access, use, disclosure, alteration, or destruction. These safeguards are intended to be commensurate with the sensitivity of the information collected and the nature and scope of CDM's

Section 9: Children's Privacy The Cascade Digital Marketplace is a business-to-business platform intended for use by adults who are engaged in commercial activities as sellers of products and services. The Marketplace is not directed at, and is not intended for use by, children under the age of thirteen (13), or under the age of sixteen (16) where applicable under certain state privacy laws. CDM does not knowingly co

Section 10: Changes to This Notice CDM may update this Notice from time to time to reflect changes in CDM's data practices, changes in applicable legal requirements, or changes in CDM's business operations. When CDM makes material changes to this Notice, CDM will notify affected sellers through one or more of the following means: • A prominent notification posted on the seller portal at cascade.com/marketplace; • An

Section 11: Contact Information If You have any questions, concerns, or requests regarding this Notice, CDM's privacy practices, or Your privacy rights, please contact the Privacy Office using the following information: Privacy Inquiries: Diana Polk Associate General Counsel (Interim Chief Privacy Officer) Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119 Email: privacy@cascade.com M

Section 12: Additional Disclosures for California Sellers Pursuant to the requirements of the CCPA/CPRA, this Section 12 provides additional disclosures for sellers who are California residents. The following table sets forth the categories of personal information CDM has collected from sellers in the preceding twelve (12) months, mapped to the CCPA/CPRA statutory categories, along with the business or commercial pur

I. Professional or Employment-Related Information | Business licenses, permits, certifications, professional credentials | Seller qualification, marketplace operations, compliance | Cascade affiliates, professional advisors S. Sensitive Personal Information | SSN, driver's license/state ID number, bank account and routing numbers, account login credentials | Tax compliance, identity verification, payment processing,