Contract analysis

1. Introduction and Scope Cascade Retail Holdings Inc. ("Cascade," "we," "us," or "our") is a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD. Cascade is the data controller responsible for the personal information described in this Privacy Policy. The executive sponsor of Cascade's priva

2. Categories of Personal Information We Collect Cascade collects personal information from and about consumers in connection with our website, mobile application, physical retail locations, and the Cascade Digital Marketplace. The categories of personal information we collect are described below. 2.1 Identifiers. We collect personal identifiers that allow us to identify, contact, or communicate with consumers. These

3. Sources of Personal Information Cascade collects personal information from the following categories of sources: 3.1 Directly from Consumers We collect personal information directly from consumers when they interact with us, including through the following activities: • Creating a Cascade account on cascade.com or the Cascade mobile application; • Making purchases online through cascade.com, the Cascade Digital Mar

4. Purposes of Processing / Use of Personal Information Cascade collects, uses, and processes personal information for the purposes described below. We will not collect additional categories of personal information or use the personal information we have collected for materially different, unrelated, or incompatible purposes without providing consumers with notice. 4.1 Business and Operational Purposes Cascade uses p

5. Disclosure and Sharing of Personal Information Cascade discloses and shares personal information with the categories of recipients described below, for the purposes identified in Section 4 of this Privacy Policy. 5.1 Categories of Recipients Service Providers. Cascade discloses personal information to vendors and service providers that process personal information on Cascade's behalf, under written contractual agr

6. Data Retention Cascade retains personal information for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, and as required or permitted by applicable law. Cascade is implementing a comprehensive Data Retention & Disposal Schedule, which is expected to become effective in October 2025. The Data Retention & Disposal Schedule will establish specific retention

7. Your Privacy Rights Cascade respects and supports the privacy rights of consumers under applicable U.S. state privacy statutes. This Section 7 describes the privacy rights available to consumers and how to exercise those rights. Because Cascade operates in 31 U.S. states and is subject to 19 state privacy statutes, the specific rights available to a consumer may vary depending on the consumer's state of residence.

8. How to Exercise Your Rights (Data Subject Requests) 8.1 Submitting a Request Consumers may submit requests to exercise their privacy rights using any of the following methods: • Online: Submit a request through the consumer-rights request portal at cascade.com/privacy-rights; • Phone: Call Cascade's toll-free privacy-rights line at the number posted on cascade.com/privacy-rights (toll-free number to be inserted pr

9. Cookies and Tracking Technologies Cascade uses cookies and other tracking technologies on cascade.com and in the Cascade mobile application to collect information about consumers' interactions with our digital services, to enable certain features and functionality, and to support advertising, analytics, and personalization. Cascade deploys twelve (12) categories of cookies and tracking technologies across its digi

10. Children's Privacy Cascade's website, mobile application, and services are not directed to children under the age of thirteen (13). Cascade does not knowingly collect personal information from children under the age of 13. If Cascade becomes aware that it has collected personal information from a child under the age of 13 without verifiable parental consent, Cascade will take prompt steps to delete that informati

11. Security of Personal Information Cascade maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. These safeguards include, but are not limited to, encryption of data in transit and at rest, network-security controls, access-control measures, vulnerability-management and penetration-t

12. Financial Incentive / Loyalty Program Notice Cascade operates the Cascade Rewards loyalty program through its subsidiary Cascade Rewards Corp. The Cascade Rewards program currently has approximately 41.2 million registered members and offers consumers the opportunity to earn points on qualifying purchases, redeem points for discounts and rewards, and receive exclusive promotions and offers. Under CCPA § 1798.125,

13. Third-Party Marketplace Cascade Digital Marketplace LLC ("CDM") operates an online marketplace at cascade.com/marketplace that enables approximately 3,800 third-party sellers to list and sell products to consumers through the Cascade platform. When a consumer purchases a product from a third-party seller on the Cascade Digital Marketplace, Cascade shares limited personal information with the applicable seller as