1038-00005 · Calderwood & Harkness LLP · Transaction Documents/Committee Charters

technology-cybersecurity-committee-charter-new.docx DOCUMENT M&A / Corporate

10 / 12 ← → ✕

CHARTER OF THE TECHNOLOGY & CYBERSECURITY COMMITTEE OF THE BOARD OF DIRECTORS OF CASCADE RETAIL HOLDINGS INC.

Adopted by the Board of Directors on March 11, 2024

This Charter supersedes and replaces the ad hoc Technology & Innovation Committee established by board resolution dated September 15, 2022, which is hereby dissolved and absorbed into this standing committee.

Prepared by Calderwood & Harkness LLP, 999 Third Avenue, Suite 4200, Seattle, WA 98104 (C&H Matter No. 1038-00005)

Right-click to update Table of Contents

I. PURPOSE

The Board of Directors (the "Board") of Cascade Retail Holdings Inc., a Delaware corporation listed on the Nasdaq Stock Market LLC ("Nasdaq") under the ticker symbol "CRHI," with its principal executive office located at 4800 Lakeview Blvd, Suite 1100, Bellevue, WA 98004 (together with its subsidiaries, the "Company"), hereby establishes the Technology & Cybersecurity Committee (the "Committee") as a standing committee of the Board pursuant to the authority vested in the Board under the Company's Amended and Restated Bylaws and the Delaware General Corporation Law, Title 8, Chapter 1 of the Delaware Code (the "DGCL").

The purpose of the Committee is to assist the Board in fulfilling its oversight responsibilities with respect to the following areas:

(a) the Company's information technology strategy, architecture, and investments, including the alignment of technology initiatives with the Company's overall business strategy;

(b) the Company's cybersecurity programs, policies, risk management frameworks, and incident response capabilities;

(c) data privacy and data protection compliance, including compliance with applicable federal, state, and international data privacy laws and regulations;

(d) artificial intelligence governance and responsible AI practices, including the ethical development, deployment, and use of artificial intelligence and machine learning technologies across the Company's operations; and

(e) technology-related innovation and digital transformation initiatives, including the evaluation and adoption of emerging technologies relevant to the Company's multi-channel retail operations.

The establishment of this standing committee reflects the Board's recognition of evolving corporate governance best practices and the increasingly central role that technology, cybersecurity, and data management play in the Company's operations and strategic positioning. In particular, the Board has considered the following factors in determining that a dedicated standing committee is warranted:

Heightened Regulatory Expectations. The U.S. Securities and Exchange Commission (the "SEC") adopted final rules regarding cybersecurity risk management, strategy, governance, and incident disclosure in July 2023 (the "SEC Cybersecurity Disclosure Rules"), which impose new obligations on public companies, including the Company, to disclose material cybersecurity incidents on Form 8-K and to provide annual disclosure of cybersecurity risk management, strategy, and governance in the Company's Annual Report on Form 10-K. These rules underscore the importance of board-level oversight of cybersecurity risk and the need for formalized governance structures.

Proxy Advisory Firm Standards. Leading proxy advisory firms, including Cobalt Ridge Solutions ("ISS") and Northpoint Systems ("Tarrant Partners LLC"), have increasingly emphasized the importance of board-level technology and cybersecurity expertise and oversight as components of good corporate governance, and institutional investors have incorporated technology governance considerations into their voting policies and engagement priorities.

Governance Assessment Findings. On December 5, 2023, Glassman & Torrey LLP delivered its independent governance assessment of the Company (the "Glassman & Torrey Assessment"), which scored the Company at 58 out of 100 points against a peer median score of 67 out of 100 among a peer group of eighteen (18) publicly traded retail companies. The Glassman & Torrey Assessment identified the absence of a standing board committee dedicated to technology and cybersecurity oversight as a material governance gap and recommended the formalization of such a committee with a comprehensive written charter.

Heightened Caremark Duties. The Board has considered the heightened oversight duty standards articulated in recent decisions of the Delaware Court of Chancery, including In re McDonald's Corp. Stockholder Derivative Litigation, C.A. No. 2021-0324-JTL (Del. Ch. Jan. 25, 2023), and In re Harborview & Co. Derivative Litigation, C.A. No. 2019-0907-MTZ (Del. Ch. Sept. 7, 2021), which underscore the fiduciary obligation of directors to establish and monitor reasonable information and reporting systems to identify and address critical compliance and risk areas. The Board recognizes that technology and cybersecurity risks constitute mission-critical areas warranting dedicated board-level oversight, and the establishment of this Committee is intended to ensure that the Board satisfies its obligations under In re Caremark International Inc. Derivative Litigation, 698 A.2d 959 (Del. Ch. 1996), and its progeny.

This Committee replaces and absorbs the ad hoc Technology & Innovation Committee (the "Ad Hoc Committee"), which was formed by board resolution on September 15, 2022. The Ad Hoc Committee operated without a formal written charter and without defined authority, reporting structure, or membership qualifications. The Board has determined that formalizing technology and cybersecurity oversight through a standing committee with a comprehensive charter will provide greater structure, accountability, and transparency in the Board's governance of these critical risk areas.

The Committee shall serve as the primary board-level body for oversight of technology and cybersecurity risks. The Committee's oversight responsibilities are intended to complement, and not to duplicate or supplant, the risk oversight functions of the Audit Committee of the Board (the "Audit Committee") or any other committee of the Board. The respective roles and coordination mechanisms among the Committee, the Audit Committee, and other Board committees are described in greater detail in Article VI of this Charter.

Nothing in this Charter is intended to alter or impair the rights, duties, or responsibilities of the Board or any other committee of the Board, except as expressly provided herein.

II. COMPOSITION AND MEMBERSHIP

A. Number of Members

The Committee shall consist of a minimum of three (3) members of the Board of Directors. All members of the Committee shall be "independent directors" as such term is defined under the applicable Nasdaq listing standards (including Nasdaq Listing Rule 5605(a)(2)) and the rules and regulations of the SEC. For the avoidance of doubt, no individual who serves as an officer or employee of the Company, including the Chief Executive Officer, shall be eligible to serve as a member of the Committee. The Board may, from time to time, increase the size of the Committee beyond the three-member minimum as it deems appropriate.

B. Appointment and Removal

Members of the Committee shall be appointed by the Board of Directors upon the recommendation of the Nominating & Corporate Governance Committee of the Board (the "Nominating & Corporate Governance Committee"), currently chaired by Margaret "Meg" Holliday, Lead Independent Director. The Nominating & Corporate Governance Committee shall consider the qualifications set forth in Section II.E of this Charter, along with such other factors as it deems relevant, in formulating its recommendations to the Board regarding Committee membership.

Members of the Committee shall serve at the pleasure of the Board and may be removed by the Board at any time, with or without cause, by the affirmative vote of a majority of the directors then in office. A member of the Committee shall automatically cease to be a member upon ceasing to be a member of the Board. Vacancies on the Committee, whether arising from resignation, removal, death, incapacity, or an increase in the size of the Committee, shall be filled by the Board upon the recommendation of the Nominating & Corporate Governance Committee. Pending the filling of any vacancy, the remaining members of the Committee shall have full authority to act, provided that a quorum (as defined in Section V.B) is present.

C. Chairperson. The Board shall designate one member of the Committee as the Chairperson of the Committee (the "Chairperson"). If the Board does not designate a Chairperson, the members of the Committee shall elect a Chairperson from among themselves by majority vote of the full Committee membership. The Chairperson shall preside at all meetings of the Committee, establish the agenda for each meeting in consultation with the other Committee members and appropriate members of management, and report regularly to the full Board on the activities, findings, and recommendations of the Committee. In the absence of the Chairperson at any meeting, the Committee members present shall elect a temporary chairperson from among themselves to preside at such meeting.

D. Initial Members

Dr. Anwar Farouk is hereby designated as an initial member of the Committee. Dr. Farouk previously served on the Ad Hoc Committee and brings continuity of knowledge regarding the Company's technology landscape, ongoing technology initiatives, and the historical context of the Board's technology oversight efforts. The Board shall appoint additional members to satisfy the minimum three-member requirement set forth in Section II.A promptly following the adoption of this Charter, and in any event no later than the next regularly scheduled meeting of the Board following the date of adoption.

E. Qualifications. At least one (1) member of the Committee should possess expertise or professional experience in one or more of the following disciplines: information technology, cybersecurity, data privacy, digital commerce, software engineering, data analytics, artificial intelligence, cloud computing, or a related technology discipline. Such expertise or experience may be demonstrated through prior employment in a senior technology or cybersecurity role, service on the board of a technology company, academic credentials in a relevant field, relevant industry certifications (such as CISSP, CISM, or CIPP), or other equivalent qualifications as determined by the Board.

The Nominating & Corporate Governance Committee shall incorporate technology and cybersecurity expertise as a defined competency area within the board skills matrix and shall consider the availability and depth of such expertise on the Committee and the Board as a whole when evaluating director candidates and recommending Committee appointments. The Board recognizes that technology and cybersecurity expertise is a dynamic field and encourages Committee members to pursue continuing education and professional development in relevant areas. The absence of a member with specific technology or cybersecurity expertise shall not invalidate any action taken by the Committee.

III. AUTHORITY

A. General Authority

The Committee shall have the authority to carry out the purposes and responsibilities set forth in this Charter and to take such actions as it deems necessary or appropriate in the discharge of its oversight functions. The Committee is empowered to investigate any matter brought to its attention within the scope of its responsibilities, with full and unrestricted access to all books, records, documents, systems, facilities, and personnel of the Company. All officers and employees of the Company are directed to cooperate fully with the Committee and to provide such information, access, and assistance as the Committee may reasonably request in the performance of its duties.

B. Delegation. The Committee may, in its discretion, delegate any of its authority and responsibilities to one or more subcommittees consisting of one or more members of the Committee, or to individual members of the Committee, as it deems appropriate. Any such delegation shall be consistent with the provisions of the Company's Amended and Restated Bylaws (as adopted on March 11, 2024), the Restated Certificate of Incorporation of the Company (as filed with the Delaware Secretary of State on October 3, 2016), and the applicable provisions of the DGCL, including Section 141(c) thereof. Any subcommittee to which authority is delegated shall report its activities, findings, and recommendations to the full Committee on a regular basis. Delegation of authority to a subcommittee or individual member shall not relieve the Committee of its responsibility to oversee the delegated function or to report to the Board thereon.

C. Advisors and Consultants

The Committee shall have the sole authority to retain and terminate independent outside advisors, including without limitation technology consultants, cybersecurity experts and assessors, data privacy counsel, AI ethics consultants, forensic investigators, and other specialists, as it deems necessary or appropriate to fulfill its responsibilities under this Charter. The Committee shall have the sole authority to approve the fees, engagement terms, and scope of work of any such advisors, and the Committee's selection and retention of advisors shall not require the prior approval of the Board or management.

The Company shall provide appropriate funding, as determined by the Committee in its sole discretion, for:

(i) the payment of compensation to any advisors retained by the Committee pursuant to this Section III.C;

(ii) the payment of ordinary administrative expenses of the Committee that are necessary or appropriate in carrying out its duties; and

(iii) the costs associated with continuing education and professional development for Committee members in areas relevant to the Committee's mandate.

D. Access to Management

The Committee shall have direct and unrestricted access to the following officers and personnel of the Company, who may be requested to attend Committee meetings or to provide information, reports, or briefings to the Committee at any time:

(a) the Company's Chief Information Officer (or the functional equivalent thereof);

(b) the Company's Chief Information Security Officer (or the functional equivalent thereof);

(d) the Company's Data Privacy Officer (or the functional equivalent thereof);

(e) any other officers or employees of the Company with responsibilities relating to information technology, cybersecurity, data privacy, artificial intelligence, or related areas; and

(f) any independent auditors, outside counsel, or other advisors engaged by the Company whose work relates to matters within the scope of the Committee's responsibilities.

The Committee may request the attendance of any Company officer, employee, or outside advisor at any meeting of the Committee, and such individuals shall be available to attend as requested. The Committee's access to management shall not be subject to prior approval by the Chief Executive Officer or any other member of management.

IV. RESPONSIBILITIES AND DUTIES

The following sets forth the principal recurring responsibilities and duties of the Committee. These responsibilities and duties are intended as a guide and are not exhaustive. The Committee may undertake such additional activities within the scope of its purpose as it deems necessary or appropriate in light of evolving business conditions, regulatory requirements, industry practices, and the Company's specific circumstances. The Committee's oversight responsibilities do not relieve management of its primary responsibility for the design, implementation, and day-to-day management of the Company's technology, cybersecurity, data privacy, and AI programs.

A. Information Technology Strategy

1. Overall IT Strategy. The Committee shall review and discuss with management the Company's overall information technology strategy, including digital transformation initiatives, technology infrastructure investments, and the alignment of the Company's technology strategy with its business objectives in multi-channel retail and e-commerce across the Company's specialty apparel, home goods, and outdoor lifestyle business segments.

2. Significant Technology Investments. The Committee shall review significant technology investments, capital expenditures, and major vendor relationships and contracts, including those involving cloud infrastructure, enterprise resource planning systems, point-of-sale systems, and e-commerce platforms. For purposes of this subsection, a "significant" technology investment or expenditure is one that (a) involves total committed spending in excess of $5 million over the life of the investment, (b) represents a material change to the Company's technology architecture, or (c) is otherwise identified by management or the Committee as warranting Committee-level review.

3. Competitive Positioning. The Committee shall monitor the Company's technology competitive positioning relative to industry peers and shall periodically receive benchmarking reports and assessments comparing the Company's technology capabilities, maturity, and spending levels against comparable publicly traded retail companies.

4. Emerging Technologies. The Committee shall oversee management's evaluation and adoption of emerging technologies relevant to the Company's operations, including but not limited to cloud computing and multi-cloud strategies, e-commerce platforms and capabilities, supply chain and logistics technology, data analytics and business intelligence platforms, Internet of Things (IoT) applications in retail operations, and augmented or virtual reality technologies in the customer experience.

B. Cybersecurity Programs and Risk Management

1. Oversight of Cybersecurity Programs. The Committee shall oversee the Company's cybersecurity programs, policies, and procedures, including the Company's information security risk management framework (e.g., frameworks based on the National Institute of Standards and Technology Cybersecurity Framework ("NIST CSF"), the Center for Internet Security ("CIS") Controls, or comparable industry-standard frameworks).

2. Risk Management Strategy. The Committee shall review and assess the adequacy and effectiveness of the Company's cybersecurity risk management strategy, including threat identification and intelligence capabilities, vulnerability management and remediation processes, incident prevention, detection, and response capabilities, identity and access management controls, network security architecture and monitoring, endpoint protection and mobile device management, and security awareness training programs for employees and contractors.

3. CISO Reports. The Committee shall receive and review periodic reports from the Chief Information Security Officer (or the functional equivalent thereof) regarding the state of the Company's cybersecurity posture. Such reports shall include, at a minimum, an overview of material cybersecurity incidents and near-miss events, a threat landscape assessment highlighting emerging threats relevant to the Company's industry and operations, a summary of vulnerability assessments and penetration testing results, the status of remediation efforts for previously identified vulnerabilities and deficiencies, key cybersecurity metrics and performance indicators, and updates on cybersecurity staffing and resource adequacy. The Chief Information Security Officer (or equivalent) shall provide such reports to the Committee no less frequently than quarterly, and shall promptly notify the Chairperson of the Committee of any material cybersecurity incident or development that, in the judgment of the Chief Information Security Officer, warrants immediate attention.

4. SEC Cybersecurity Disclosure Compliance. The Committee shall oversee management's compliance with the SEC Cybersecurity Disclosure Rules adopted in July 2023, including without limitation (a) the Company's processes for determining the materiality of cybersecurity incidents and the Company's obligations to file a Current Report on Form 8-K (Item 1.05) disclosing material cybersecurity incidents within four (4) business days of a materiality determination, (b) the Company's annual disclosure of its cybersecurity risk management program, strategy, and governance in its Annual Report on Form 10-K (Regulation S-K Item 106), and (c) the Company's procedures and internal controls for ensuring the accuracy, completeness, and timeliness of cybersecurity-related disclosures.

5. Coordination with Audit Committee. The Committee shall coordinate with the Audit Committee, currently chaired by Sandra Chen-Watkins, on cybersecurity risk matters that overlap with financial reporting, internal controls over financial reporting (as defined under the Sarbanes-Oxley Act of 2002, as amended), and enterprise risk management. The respective committee chairs shall communicate regularly to ensure that cybersecurity risks with potential financial statement or disclosure implications are appropriately addressed by both committees and that there are no gaps or unnecessary duplication in oversight responsibilities.

6. Incident Response Planning. The Committee shall review the Company's cybersecurity incident response plan (the "IRP") at least annually and shall oversee the conduct of tabletop exercises, simulations, and other testing activities designed to evaluate the effectiveness of the IRP and the Company's readiness to respond to cybersecurity incidents. The Committee shall receive a report on the results of each tabletop exercise or simulation, including lessons learned and recommended improvements.

7. Third-Party and Supply Chain Risks. The Committee shall review third-party and supply chain cybersecurity risks, including risks associated with key technology vendors, service providers, and business partners. The Committee shall oversee management's processes for assessing the cybersecurity posture of critical third parties, including the use of vendor risk assessment questionnaires, contractual cybersecurity requirements, and ongoing monitoring of third-party risk.

C. Data Privacy and Data Protection

1. Privacy Programs. The Committee shall oversee the Company's data privacy and data protection programs, policies, and compliance efforts, including the Company's privacy impact assessment processes and privacy-by-design principles.

2. Legal and Regulatory Compliance. The Committee shall monitor the Company's compliance with applicable data privacy laws and regulations, including without limitation the Washington Privacy Act (RCW 19.373, et seq.), the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and any other state consumer privacy laws applicable to the Company's operations (including those of Colorado, Connecticut, Virginia, and other states that have enacted or may enact comprehensive consumer privacy legislation), as well as any applicable international data protection regulations (including the European Union General Data Protection Regulation, Regulation (EU) 2016/679, to the extent applicable to the Company's operations).

3. Data Governance. The Committee shall review the Company's data governance framework, including data classification standards, data retention and disposal policies, data minimization practices, and data inventory and mapping processes.

4. Data Subject Rights and Breach Notification. The Committee shall oversee management's handling of data subject access requests, deletion requests, opt-out requests, and other rights requests under applicable privacy laws, as well as the Company's data breach notification obligations under applicable federal and state laws.

D. Artificial intelligence Governance

1. AI Development and Deployment. The Committee shall oversee the Company's development, deployment, and use of artificial intelligence and machine learning technologies across its operations, including the procurement and integration of third-party AI tools and platforms.

2. AI Governance Framework. The Committee shall review and approve, or recommend to the Board for approval, the Company's AI governance framework, including the Company's ethical AI principles, bias monitoring and mitigation procedures, transparency and explainability standards, human oversight and accountability mechanisms, and processes for ongoing monitoring and auditing of AI systems.

3. Regulatory Developments. The Committee shall monitor legislative and regulatory developments related to AI governance at the federal, state, and international levels, and shall assess the potential impact of such developments on the Company's operations, compliance obligations, and strategic plans.

4. Significant AI Initiatives. The Committee shall review significant AI initiatives and use cases undertaken or proposed by the Company, including customer-facing AI applications (such as chatbots, personalized recommendations, and virtual try-on tools), algorithmic decision-making in supply chain management, demand forecasting, and inventory optimization, employee-facing AI tools (such as workforce scheduling and talent management applications), and any AI applications that involve automated decision-making with significant legal or similarly significant effects on individuals.

E. Innovation and Digital Transformation

1. Digital Transformation Roadmap. The Committee shall oversee management's development and execution of the Company's digital transformation roadmap, including progress against milestones, key performance indicators, and return-on-investment metrics for significant digital transformation initiatives.

2. Partnerships and Acquisitions. The Committee shall review significant technology partnerships, joint ventures, and strategic technology acquisitions or investments, including any proposed transactions that involve material technology assets, intellectual property, or technology-related synergies.

3. intellectual Property. The Committee shall monitor technology-related intellectual property matters, including the Company's portfolio of patents, trademarks, trade secrets, and proprietary technology assets, in coordination with the General Counsel, Priya Sundaram, Executive Vice President, General Counsel & Corporate Secretary.

F. Insurance and Risk Transfer

In coordination with the Audit Committee, the Committee shall review the adequacy of the Company's insurance coverage related to cybersecurity and technology risks, including cyber liability insurance, technology errors and omissions insurance, and any other risk transfer mechanisms relevant to the Company's technology and cybersecurity risk profile. The Committee shall receive periodic reports from management and the Company's insurance broker(s) regarding the scope, limits, exclusions, and material terms of such coverage, and shall assess whether the Company's insurance program is commensurate with its risk profile and consistent with industry standards and peer practices.

G. Regulatory and Compliance Oversight

1. Regulatory Monitoring. The Committee shall monitor regulatory developments in technology, cybersecurity, data privacy, and artificial intelligence at the federal, state, and international levels that may affect the Company's operations, compliance obligations, risk profile, or strategic plans.

2. Compliance Oversight. The Committee shall oversee management's compliance with applicable technology and cybersecurity-related laws, regulations, and listing standards, and shall receive reports from management on the results of compliance assessments, regulatory examinations, and external audits relating to technology and cybersecurity matters.

3. Information and Reporting Systems. Consistent with the Board's heightened Caremark oversight duties, the Committee shall ensure that appropriate information and reporting systems exist to provide the Committee and the Board with timely and accurate information regarding technology and cybersecurity risks. The Committee shall periodically assess whether the Company's reporting systems are adequate to enable the Board to satisfy its fiduciary duties with respect to technology and cybersecurity oversight and shall recommend improvements as necessary.

H. Reporting to the Board

The Chairperson of the Committee shall report to the full Board of Directors at each regularly scheduled meeting of the Board on the activities, findings, and recommendations of the Committee since the last such report. Such reports shall include a summary of the matters discussed at recent Committee meetings, significant developments or risks identified, and any recommendations for Board-level action or approval. The Committee shall make recommendations to the Board regarding technology and cybersecurity matters requiring Board-level action or approval, including the approval of policies, strategic initiatives, or expenditures that exceed the Committee's delegated authority or that the Committee otherwise determines should be presented to the full Board.

V. MEETINGS

A. Frequency. The Committee shall meet at least four (4) times per year, approximately quarterly, or more frequently as circumstances require. The Chairperson of the Committee, or any two (2) members of the Committee, may call special meetings of the Committee at any time upon reasonable notice to all Committee members. Meetings may be held in person, by telephone conference, by video conference, or by any other means of communication by which all participants can hear each other simultaneously, to the extent permitted by the Company's Amended and Restated Bylaws and the DGCL.

B. Quorum and Voting

A majority of the members of the Committee then serving shall constitute a quorum for the transaction of business at any meeting of the Committee. The Committee shall act by the affirmative vote of a majority of the members present at a meeting at which a quorum is present. Each member of the Committee shall have one vote. The Chairperson shall not have a casting or tie-breaking vote. The Committee may act by unanimous written consent in lieu of a meeting to the extent permitted by Section 141(f) of the DGCL and the Company's Amended and Restated Bylaws.

C. Attendance. The Committee may invite members of management, including the Chief Information Officer, Chief Information Security Officer, Chief Technology Officer, and Data Privacy Officer, as well as external advisors, independent auditors, or other directors, to attend all or any portion of any Committee meeting as it deems appropriate. Notwithstanding the foregoing, the Committee shall meet in executive session (without any members of management present) at least once per year, and more frequently as the Committee deems advisable, to discuss matters that the Committee determines are appropriate for consideration without management participation. The Committee may also meet in executive session with individual members of management or advisors as it deems appropriate.

D. Minutes. The Committee shall maintain written minutes of its meetings, which shall be filed with the minutes and records of the Board of Directors. The minutes shall document the matters discussed, the actions taken, and the recommendations made at each meeting. The Corporate Secretary, Priya Sundaram, or a designee of the Corporate Secretary, shall serve as secretary to the Committee and shall be responsible for the preparation and distribution of meeting minutes. Draft minutes shall be circulated to Committee members for review and approval at or prior to the next regular meeting of the Committee.

E. Agenda. The Chairperson shall establish the agenda for each Committee meeting in consultation with the other Committee members and appropriate members of management, including the Chief Information Officer, Chief Information Security Officer, and General Counsel. The agenda and supporting materials shall be distributed to Committee members in advance of each meeting, to the extent practicable and consistent with the Company's policies regarding the distribution of board and committee materials. Committee members may suggest items for inclusion on the agenda at any time by communicating with the Chairperson or the Corporate Secretary.

VI. COORDINATION WITH OTHER COMMITTEES

The Board recognizes that certain matters within the scope of the Committee's responsibilities may overlap with or relate to the responsibilities of other standing committees of the Board. To ensure comprehensive and coordinated oversight without gaps or unnecessary duplication, the Committee shall coordinate with the other committees of the Board as follows:

Audit Committee. The Committee shall coordinate with the Audit Committee on matters of cybersecurity risk that overlap with financial reporting, internal controls over financial reporting, and enterprise risk management. Such matters include, without limitation, the oversight of the SEC Cybersecurity Disclosure Rules, the assessment of cybersecurity risks that may have a material impact on the Company's financial statements or disclosures, and the review of the Company's enterprise risk management framework to the extent it encompasses technology and cybersecurity risks. The Chairperson of the Committee and the Chair of the Audit Committee (Sandra Chen-Watkins) shall communicate regularly to coordinate their respective committees' oversight activities.

Nominating & Corporate Governance Committee. The Committee shall coordinate with the Nominating & Corporate Governance Committee on matters related to the board skills matrix (particularly the identification and assessment of technology and cybersecurity expertise among current and prospective directors), environmental, social, and governance ("ESG") considerations relating to data privacy, responsible technology use, and responsible AI practices, and the annual board and committee self-evaluation process (including the Committee's annual self-evaluation described in Article VII). The Chairperson of the Committee and the Chair of the Nominating & Corporate Governance Committee (Margaret "Meg" Holliday) shall communicate as appropriate to coordinate on these matters.

Compensation & Human Capital Committee. The Committee shall coordinate with the Compensation & Human Capital Committee on matters relating to the attraction, retention, and compensation of technology and cybersecurity talent, including the Company's competitiveness in recruiting senior technology and cybersecurity leaders and the adequacy of the Company's human capital strategies to address technology and cybersecurity workforce needs. The Committee may also provide input to the Compensation & Human Capital Committee regarding the inclusion of technology and cybersecurity performance metrics in executive compensation programs.

The respective committee chairs shall communicate as needed, and may hold joint meetings or sessions when appropriate, to ensure that oversight responsibilities across committees are well-coordinated, that there are no material gaps in the Board's oversight of technology and cybersecurity risks, and that unnecessary overlap is avoided.

VII. ANNUAL PERFORMANCE EVALUATION

The Committee shall conduct an annual evaluation of its own performance, effectiveness, and the adequacy of this Charter. The evaluation shall assess, among other things, whether the Committee has fulfilled its responsibilities as set forth in this Charter, whether the Committee's composition and expertise are adequate, whether the Committee's meeting frequency and processes are sufficient, and whether this Charter should be amended to reflect evolving best practices, regulatory requirements, or changes in the Company's business or risk profile.

The annual evaluation shall be coordinated with the Nominating & Corporate Governance Committee's annual board and committee self-evaluation process to ensure consistency and comprehensiveness across all Board committees. The evaluation may include self-assessment questionnaires completed by Committee members, interviews or discussions facilitated by the Corporate Secretary or an outside governance consultant, and benchmarking against the practices of peer company technology and cybersecurity committees.

The results of the annual evaluation shall be reported to the full Board of Directors. Based on the results of the evaluation, the Committee shall recommend any changes to this Charter, or to the Committee's composition, processes, or responsibilities, that the Committee deems necessary or advisable to enhance the effectiveness of the Board's technology and cybersecurity oversight.

VIII. AMENDMENT

This Charter may be amended, restated, or otherwise modified by the Board of Directors at any time by the affirmative vote of a majority of the directors then in office. The Committee shall review this Charter at least annually to determine whether amendments are warranted in light of changes in law, regulation, listing standards, governance best practices, or the Company's business operations. The Committee shall recommend any proposed changes to this Charter to the Board for approval. No amendment to this Charter shall be effective until approved by the Board.

IX. DISSOLUTION OF AD HOC TECHNOLOGY & INNOVATION COMMITTEE

The ad hoc Technology & Innovation Committee, established by resolution of the Board of Directors on September 15, 2022, is hereby dissolved effective as of the date of adoption of this Charter on March 11, 2024. The Ad Hoc Committee, having served the Company in a transitional capacity without a formal written charter, defined authority, or structured reporting relationship to the Board, is no longer necessary in light of the establishment of this standing Committee.

All responsibilities, authorities, and pending matters of the Ad Hoc Committee, including any open action items, ongoing projects, and unresolved recommendations, are hereby transferred to and assumed by this standing Technology & Cybersecurity Committee. Members of the Ad Hoc Committee who are not appointed to this Committee shall have no continuing responsibility with respect to the matters formerly overseen by the Ad Hoc Committee, except as otherwise directed by the Board.

All records, minutes, reports, and other documents of the Ad Hoc Committee shall be preserved and maintained by the Corporate Secretary as part of the Company's permanent corporate records and shall be made available to the Committee upon request.

X. GOVERNING LAW

This Charter shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to the conflict of laws principles thereof. This Charter is adopted in furtherance of the authority vested in the Board under the DGCL, the Company's Restated Certificate of Incorporation, filed with the Delaware Secretary of State on October 3, 2016, and the Company's Amended and Restated Bylaws, adopted on March 11, 2024. In the event of any conflict between the provisions of this Charter and the Company's Restated Certificate of Incorporation or Amended and Restated Bylaws, the Restated Certificate of Incorporation and Amended and Restated Bylaws shall control. In the event of any conflict between the provisions of this Charter and applicable law, applicable law shall control.

XI. EFFECTIVE DATE

This Charter is effective as of March 11, 2024, the date of its adoption by the Board of Directors of Cascade Retail Holdings Inc.

ATTESTATION AND CERTIFICATION

This Charter of the Technology & Cybersecurity Committee of the Board of Directors of Cascade Retail Holdings Inc. was duly adopted by the Board of Directors at a duly convened meeting of the Board held on March 11, 2024, at which a quorum was present and acting throughout, with Thomas R. Kinsley presiding as Chairman of the Board.

The undersigned hereby certifies that this Charter is a true and correct copy of the charter as adopted by the Board of Directors on the date set forth above.

ATTESTED AND CERTIFIED:

By: ________

Name: Priya Sundaram

Title: Executive Vice President, General Counsel & Corporate Secretary

Date: March 11, 2024

ACKNOWLEDGED ON BEHALF OF THE BOARD OF DIRECTORS:

By: ________

Name: Thomas R. Kinsley

Title: Chairman of the Board