Contract analysis

Section 1: Introduction and Purpose Cascade Retail Holdings Inc. and its subsidiaries — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. (collectively, "Cascade," "we," "us," or "our") — are committed to protecting the privacy and personal data of consumers across every United States jurisdiction in which we operate. We believe that transparency

Section 2: How to Exercise Your Rights and Verification 2.1 Methods for Submitting Consumer-Rights Requests Cascade provides multiple convenient methods for consumers to submit consumer-rights requests (also referred to as "data subject requests" or "DSRs"). These methods are designed to be accessible to all consumers, regardless of their preferred mode of communication or their proximity to a Cascade retail location

Section 3: Virginia — Virginia Consumer Data Protection Act (VCDPA) 3.1 Applicability. The Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq. ("VCDPA"), became effective on January 1, 2023, making Virginia the second state in the nation to enact a comprehensive consumer privacy statute. The VCDPA applies to persons that conduct business in the Commonwealth of Virginia or that produce products or

Section 4: Colorado — Colorado Privacy Act (CPA) 4.1 Applicability. The Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq. ("CPA"), became effective on July 1, 2023. The CPA applies to controllers that conduct business in the State of Colorado or that produce or deliver commercial products or services that are intentionally targeted to residents of Colorado and that satisfy one of the following thresholds: (a)

Section 5: Connecticut — Connecticut Data Privacy Act (CTDPA) 5.1 Applicability. The Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq. ("CTDPA"), became effective on July 1, 2023. The CTDPA applies to persons that conduct business in the State of Connecticut or that produce products or services that are targeted to residents of Connecticut and that, during the preceding calendar year: (a) controlled or

Section 6: Utah — Utah Consumer Privacy Act (UCPA) 6.1 Applicability. The Utah Consumer Privacy Act, Utah Code Ann. § 13-61-101 et seq. ("UCPA"), became effective on December 31, 2023. The UCPA applies to controllers that conduct business in the State of Utah or that produce products or services that are targeted to consumers who are residents of Utah, that have annual revenue of twenty-five million dollars ($25,000,

Section 7: Iowa — Iowa Consumer Data Protection Act (ICDPA) 7.1 Applicability. The Iowa Consumer Data Protection Act, Iowa Code § 715D.1 et seq. ("ICDPA"), became effective on January 1, 2025. The ICDPA applies to persons that conduct business in the State of Iowa or that produce products or services that are targeted to consumers who are residents of Iowa and that, during a calendar year: (a) control or process the

Section 8: Indiana — Indiana Consumer Data Protection Act (INCDPA) 8.1 Applicability. The Indiana Consumer Data Protection Act, Ind. Code § 24-15-1-1 et seq. ("INCDPA"), becomes effective on January 1, 2026. The INCDPA applies to persons that conduct business in the State of Indiana or that produce products or services that are targeted to residents of Indiana and that, during a calendar year: (a) control or process

Section 9: Tennessee — Tennessee Information Protection Act (TIPA) 9.1 Applicability. The Tennessee Information Protection Act, Tenn. Code Ann. § 47-18-3601 et seq. ("TIPA"), became effective on July 1, 2025. TIPA applies to persons that conduct business in the State of Tennessee or that produce products or services that are targeted to residents of Tennessee and that: (a) exceed twenty-five million dollars ($25,000,

Section 10: Montana — Montana Consumer Data Privacy Act (MCDPA) 10.1 Applicability. The Montana Consumer Data Privacy Act, Mont. Code Ann. § 30-14-2801 et seq. ("MCDPA"), became effective on October 1, 2024. The MCDPA applies to persons that conduct business in the State of Montana or that produce products or services that are targeted to residents of Montana and that, during a calendar year: (a) control or process t

Section 11: Texas — Texas Data Privacy and Security Act (TDPSA) 11.1 Applicability. The Texas Data Privacy and Security Act, Tex. Bus. & Com. Code § 541.001 et seq. ("TDPSA"), became effective on July 1, 2024. The TDPSA applies to persons that conduct business in the State of Texas or that produce products or services consumed by residents of Texas, that process or engage in the sale of personal data, and that are no

Section 12: Oregon — Oregon Consumer Privacy Act (OCPA) 12.1 Applicability. The Oregon Consumer Privacy Act, Or. Rev. Stat. § 646A.570 et seq. ("OCPA"), became effective on July 1, 2024. The OCPA applies to persons that conduct business in the State of Oregon or that provide products or services to residents of Oregon and that, during a calendar year: (a) control or process the personal data of at least 100,000 Orego

Section 13: Delaware — Delaware Personal Data Privacy Act (DPDPA) 13.1 Applicability. The Delaware Personal Data Privacy Act, 6 Del. C. ch. 12C ("DPDPA"), became effective on January 1, 2025. The DPDPA applies to persons that conduct business in the State of Delaware or that produce products or services that are targeted to residents of Delaware and that, during the preceding calendar year: (a) controlled or processe

Section 14: New Jersey — New Jersey Data Privacy Act (NJDPA) 14.1 Applicability. The New Jersey Data Privacy Act, N.J. Stat. Ann. § 56:8-166 et seq. ("NJDPA"), became effective on January 15, 2025. The NJDPA applies to controllers that conduct business in the State of New Jersey or that produce products or services that are targeted to residents of New Jersey and that, during a calendar year: (a) control or process t