1038-00006 · Calderwood & Harkness LLP · Settlement & Standstill/Exhibits

exhibit-b-data-destruction-protocol.docx DOCUMENT Finance & Banking

59 / 79 ← → ✕

EXHIBIT B

DATA RETURN AND DESTRUCTION PROTOCOL

This Data Return and Destruction Protocol (this "Protocol") is Exhibit B to the Standstill and Settlement Agreement dated as of April 14, 2025 (the "Agreement"), among Cascade Retail Holdings Inc., a Delaware corporation ("CRH"), Priya Rathore, Derek Linden, Sonia Kaczmarek, Amara Osei, Brent Halvorsen, Lucia Fernandez-Gill, Nathan Tsao, and Kira Johansson (collectively, the "Individual Defendants" or the "Rathore Group"), and Verdana Commerce Group, Inc., a Delaware corporation ("Verdana" or "VCG").

Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. In the event of a conflict between any defined term set forth in this Protocol and the corresponding term as defined in the Agreement, the definition set forth in the Agreement shall control unless this Protocol expressly provides otherwise.

ARTICLE I — DEFINITIONS

For purposes of this Protocol, the following terms shall have the meanings set forth below:

Section 1.1 — "CRH Data." "CRH Data" means all documents, files, records, data, information, and materials (in whatever form or medium, whether physical, electronic, or digital) that (a) were created, developed, stored, or maintained by or on behalf of CRH, (b) were accessed, obtained, copied, downloaded, transferred, or otherwise acquired by any Individual Defendant during his or her employment with CRH, and (c) constitute or contain Confidential Information or Trade Secrets (as those terms are defined in the applicable Employment Agreements entered into between CRH and each Individual Defendant, copies of which are annexed to the Agreement as Exhibit D). Without limiting the generality of the foregoing, "CRH Data" specifically includes:

(i) all Project Ridgeline materials, including presentations, strategic roadmaps, financial analyses, market assessments, competitive benchmarking studies, and all supporting data and work product related thereto;

(ii) vendor negotiation term sheets and playbooks, including any annotated vendor scorecards, pricing frameworks, rebate structures, markdown allowance schedules, and related negotiation strategies;

(iii) private-label cost models and sourcing strategies, including factory-level cost breakdowns, duty and logistics modeling, quality audit reports, and supplier diversification plans;

(iv) seasonal buying algorithms and category analytics, including open-to-buy models, demand forecasting algorithms, SKU-level performance analytics, assortment optimization frameworks, and inventory turn models;

(v) customer segmentation data, including loyalty program analytics, customer lifetime value models, demographic and psychographic profiles, purchase history databases, and personalization engine training data;

(vi) ecommerce assortment models, including digital merchandising planograms, conversion rate optimization data, A/B testing results, search algorithm tuning parameters, and marketplace channel strategies; and

(vii) any and all derivatives, extracts, summaries, compilations, notes, analyses, or copies of any of the foregoing, whether created by an Individual Defendant or by any other person using or incorporating such materials.

Section 1.2 — "Covered Systems." "Covered Systems" means all personal devices (including personal laptops, desktop computers, tablets, smartphones, and any other computing devices), personal email accounts (including accounts hosted by Northgate Software, Cascade Health IT, Ridgeline Technologies, Greaves Systems, or any other email service provider), personal cloud storage accounts (including, but not limited to, personal Hollowell Health IT, Larkspur Technologies, Meridian Systems, Severin Services Inc., box, Halcyon Services Inc., and any similar cloud storage or file synchronization services), USB drives, external hard drives, SD cards, portable storage devices, and any other storage media or platforms to which any CRH Data was transferred, downloaded, copied, or otherwise made accessible by any Individual Defendant, at any time.

Section 1.3 — "Verdana Systems." "Verdana Systems" means all devices, servers, networks, cloud environments (including, without limitation, Ridgeway Industries, Crestline Systems, Aldermere Technologies, and any private cloud infrastructure), email systems, collaboration platforms (including, without limitation, Meridian Solutions, Northgate Data Systems, Ashbury Data Systems, and similar platforms), shared drives, document management systems, databases, and any other information technology infrastructure owned, operated, leased, or controlled by Verdana or any of its affiliates. For the avoidance of doubt, "Verdana Systems" includes any systems operated by or on behalf of Greystone Capital Partners, LP or Greystone Capital Fund VII, LP that may have received, stored, or processed CRH Data, whether directly from an Individual Defendant or through Verdana.

Section 1.4 — "Exfiltrated Data." "Exfiltrated Data" means the approximately 14,327 files comprising approximately 2.8 gigabytes of data identified in the forensic report of Pinnacle Forensics LLC dated March 12, 2025 (the "Initial Forensic Report"), as having been downloaded from CRH's Aldermere Systems and Pinnacle Health IT environments to personal cloud storage accounts between January 10, 2025, and February 4, 2025. The Initial Forensic Report identifies the specific file names, hash values, file sizes, creation dates, modification dates, and download timestamps for each of the 14,327 files and constitutes the baseline inventory against which compliance with this Protocol shall be measured.

Section 1.5 — "Forensic Auditor." "Forensic Auditor" means Pinnacle Forensics LLC, located at 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910, engagement lead Dr. Rajiv Anand, or such other qualified forensic firm as the parties may mutually agree upon in writing or as the Court may appoint.

Section 1.6 — "Effective Date." "Effective Date" means the date of execution of the Agreement, which the parties have targeted to be April 14, 2025.

Section 1.7 — "Data Return/Destruction Deadline." "Data Return/Destruction Deadline" means the date that is ten (10) business days following the Effective Date.

Section 1.8 — "Certification Deadline." "Certification Deadline" means the date that is twelve (12) business days following the Effective Date (i.e., two (2) business days after the Data Return/Destruction Deadline).

ARTICLE II — OBLIGATIONS OF INDIVIDUAL DEFENDANTS

Section 2.1 — Identification of CRH Data. Within three (3) business days of the Effective Date, each Individual Defendant shall provide to CRH's counsel, Calderwood & Harkness LLP, 1301 K Street NW, Suite 1200, Washington, DC 20005, Attention: Bernard Crawford and James Underwood, a sworn written inventory (the "Individual Inventory"), executed under penalty of perjury, identifying the following:

(a) All Covered Systems on which CRH Data resides or has at any time resided since January 1, 2025, including for each such Covered System a description sufficient to identify the device or account (e.g., device make, model, and serial number; email account address; cloud storage account URL and provider; external media type and capacity);

(b) A description of the categories and approximate volume (in terms of number of files and total data size) of CRH Data on each such Covered System, organized by reference to the categories set forth in Section 1.1 above to the extent practicable;

(c) Whether any CRH Data was forwarded, shared, transmitted, or otherwise made available to any third party, including, without limitation, Verdana, any officer, director, employee, consultant, or agent of Verdana, any representative of Greystone Capital Partners, LP or Greystone Capital Fund VII, LP, or any other person or entity, and if so, the identity of each such recipient, the date(s) of transmission, the method of transmission, and a description of the CRH Data so transmitted; and

(d) Any CRH Data that has already been deleted, destroyed, or otherwise disposed of by such Individual Defendant prior to the Effective Date, including the date and method of each such deletion or destruction and, to the extent known, whether such deletion was permanent or recoverable.

Each Individual Inventory shall be accompanied by a declaration confirming its completeness and accuracy, and each Individual Defendant acknowledges that any material omission from or misstatement in the Individual Inventory may constitute a breach of this Protocol and a violation of the Consent Order.

Section 2.2 — Return of CRH Data. Each Individual Defendant shall, on or before the Data Return/Destruction Deadline:

(a) Return to CRH all physical documents, media, and tangible items containing or constituting CRH Data. All such physical materials shall be delivered to Calderwood & Harkness LLP at the address set forth in Section 2.1 above, via hand delivery, overnight courier (with tracking and signature confirmation), or such other method as CRH's counsel may approve in writing. Each delivery shall be accompanied by a transmittal letter identifying the contents of the delivery by category and approximate volume.

(b) Transfer all electronic CRH Data to a secure encrypted file transfer system designated by CRH's counsel or the Forensic Auditor. The Forensic Auditor shall provide each Individual Defendant with access credentials and instructions for the designated transfer system within two (2) business days of the Effective Date. Each Individual Defendant shall use the designated transfer system exclusively for this purpose and shall not transmit CRH Data by any other electronic means (including email, messaging applications, or consumer file-sharing services) unless expressly authorized in writing by CRH's counsel.

Section 2.3 — Destruction of CRH Data. Following confirmed receipt of returned data by CRH (or upon CRH's written direction to destroy in lieu of return, which CRH may issue in its sole discretion), each Individual Defendant shall, on or before the Data Return/Destruction Deadline:

(a) Permanently delete all CRH Data from all Covered Systems using deletion and sanitization methods that meet or exceed the standards set forth in the National Institute of Standards and Technology Special Publication 800-88, Revision 1 ("NIST SP 800-88"), "Guidelines for Media Sanitization," or equivalent standards as approved by the Forensic Auditor. For electronic media, acceptable methods include, without limitation, cryptographic erasure, secure overwrite (minimum three-pass), degaussing (for magnetic media), and physical destruction (shredding, disintegration, or incineration) where appropriate.

(b) Empty all recycle bins, trash folders, "recently deleted" folders, and similar temporary deletion repositories on all Covered Systems, and clear any cached, temporary, or thumbnail copies of CRH Data from all Covered Systems.

(c) Deauthorize and unlink any CRH cloud accounts, VPN tokens, single sign-on credentials, multi-factor authentication tokens, or other access credentials associated with CRH systems that remain active or accessible to such Individual Defendant, and provide written confirmation of such deauthorization to CRH's counsel.

(d) If any Covered System cannot be wiped of CRH Data without destruction of the entire device or without rendering the device inoperable for purposes unrelated to CRH Data, such Individual Defendant shall promptly notify CRH's counsel and the Forensic Auditor and shall make the device available for forensic imaging and targeted deletion by the Forensic Auditor at a mutually agreed upon time and location. The Forensic Auditor shall use commercially reasonable efforts to preserve the Individual Defendant's non-CRH personal data during such targeted deletion.

Section 2.4 — Prohibition on Retention. No Individual Defendant shall retain, in any form or medium (whether physical, electronic, digital, handwritten, or otherwise), any CRH Data after the Data Return/Destruction Deadline. This prohibition extends to all copies, duplicates, extracts, summaries, notes, screenshots, photographs, and any other reproductions of CRH Data, regardless of the format in which such materials exist. If any Individual Defendant is required by applicable law, regulation, or valid legal process to retain any CRH Data beyond the Data Return/Destruction Deadline, such Individual Defendant shall (i) provide prior written notice to CRH's counsel specifying the specific legal basis for such retention, the categories and volume of data to be retained, and the custodian responsible for such data, and (ii) segregate and secure such data in a manner that prevents its use for any purpose other than compliance with such legal requirement.

Section 2.5 — Individual Certifications. Each Individual Defendant shall, on or before the Certification Deadline, deliver to CRH's counsel a signed certification under penalty of perjury, substantially in the form attached as Annex B-1 to this Exhibit (the "Individual Certification"), attesting to the following:

(a) That such Individual Defendant has complied in full with Sections 2.1 through 2.4 of this Protocol;

(b) That no CRH Data remains in such Individual Defendant's possession, custody, or control, whether directly or through any agent, representative, family member, or other person acting on such Individual Defendant's behalf, or, if any CRH Data has been retained pursuant to the exception set forth in Section 2.4, identifying such data and the legal basis for its retention;

(c) That no CRH Data was transmitted, shared, forwarded, or otherwise made available to any person or entity other than as fully disclosed in the Individual Inventory required under Section 2.1; and

(d) Identification of the specific deletion methods employed for each Covered System, including the software tools used (if any), the sanitization standard applied, and the date on which deletion was completed.

Each Individual Certification shall be duly notarized. Failure to deliver a timely and complete Individual Certification shall constitute a material breach of this Protocol.

ARTICLE III — OBLIGATIONS OF VERDANA COMMERCE GROUP, INC.

Section 3.1 — Internal Search and Identification. Within five (5) business days of the Effective Date, Verdana shall conduct a thorough, diligent, and good-faith search of all Verdana Systems to identify any and all CRH Data that may have been introduced, uploaded, stored, cached, transmitted, accessed, or otherwise present on any Verdana System, whether as a result of actions taken by any Individual Defendant or by any other person.

The search shall be supervised by Verdana's General Counsel, Helen Tsoi, and shall encompass, at a minimum, each of the following:

(a) All devices and accounts issued to or used by any Individual Defendant in connection with such Individual Defendant's employment or engagement with Verdana, including laptops, desktops, mobile devices, email accounts, and collaboration platform accounts;

(b) All shared drives, collaboration platforms (including Meridian Solutions workspaces, Northgate Data Systems channels, confluence spaces, and Aldermere Systems sites), email systems, and document management systems accessible by any Individual Defendant during his or her tenure at Verdana;

(c) Any systems, databases, repositories, or platforms used by Verdana's merchandising division, strategy division, ecommerce division, or any other business unit that may have received, reviewed, or utilized CRH Data in connection with business planning, competitive analysis, vendor negotiations, product development, or any other purpose; and

(d) Any systems operated by or on behalf of Greystone Capital Partners, LP or Greystone Capital Fund VII, LP to which CRH Data may have been transmitted by Verdana or by any Individual Defendant.

Verdana shall provide a detailed written report of the search results (the "Verdana Search Report") to CRH's counsel and to the Forensic Auditor within the same five (5) business day period. The Verdana Search Report shall identify, for each instance of CRH Data found, the specific file name (or description if no file name is available), the Verdana System on which it was located, the date it was introduced onto the Verdana System (to the extent determinable), and the identity of the person who introduced or uploaded it.

Section 3.2 — Destruction on Verdana Systems. Verdana shall, on or before the Data Return/Destruction Deadline, permanently delete all CRH Data identified on Verdana Systems using deletion and sanitization methods that meet or exceed the standards set forth in NIST SP 800-88 or equivalent standards as approved by the Forensic Auditor. Verdana shall maintain a detailed log of all destruction activities, including the file or data set destroyed, the system from which it was destroyed, the method of destruction, the date and time of destruction, and the identity of the person who performed or supervised the destruction.

Verdana shall ensure that no CRH Data remains in backup tapes, disaster recovery systems, archival storage, or any other secondary or tertiary storage media. Verdana acknowledges that certain backup media may operate on automated rotation schedules that do not permit immediate targeted deletion. Accordingly, for backup media only, Verdana shall have a reasonable timeframe not to exceed sixty (60) calendar days from the Effective Date to complete destruction of CRH Data from backup media, provided that (i) Verdana takes all commercially reasonable steps to expedite such destruction, (ii) all backup media containing CRH Data is quarantined in accordance with Section 3.3 pending destruction, and (iii) Verdana provides CRH's counsel and the Forensic Auditor with a written schedule of anticipated backup rotation and destruction dates within ten (10) business days of the Effective Date.

Section 3.3 — Quarantine Pending Forensic Audit. Verdana shall, immediately upon the Effective Date, quarantine (i.e., isolate and restrict all access to) any and all CRH Data identified on Verdana Systems, pending completion of the destruction process described in Section 3.2 and verification by the Forensic Auditor as described in Article IV. Quarantine measures shall include, at a minimum, the following:

(a) Removal of all user access permissions to quarantined data, except for the limited access required by Verdana's information technology security personnel and General Counsel to administer the quarantine and facilitate the Forensic Auditor's work;

(b) Transfer of quarantined data to a segregated and access-restricted storage environment, if technically feasible, with access logging enabled; and

Quarantined data shall not be accessed, reviewed, copied, printed, downloaded, transmitted, or used by any Verdana employee, officer, director, consultant, advisor, agent, or any other person pending its destruction, except as necessary to facilitate the Forensic Auditor's work or as expressly authorized in writing by CRH's counsel.

Section 3.4 — Verdana Certification. Verdana shall, within five (5) business days following completion of the Independent Forensic Audit described in Article IV and receipt of the Forensic Audit Report, deliver to CRH's counsel a certification signed by an authorized officer of Verdana, substantially in the form attached as Annex B-2 to this Exhibit (the "Verdana Certification"), attesting to the following:

(a) That Verdana has complied in full with Sections 3.1 through 3.3 of this Protocol;

(b) That no CRH Data remains on any Verdana System (including backup media, to the extent the sixty (60) day backup rotation period has elapsed), or, if any CRH Data has been retained due to a legal or regulatory requirement, identifying such data, the legal basis for its retention, the system on which it is stored, and the custodian responsible; and

(c) That no CRH Data was used in any business decision, strategy, product development initiative, vendor negotiation, pricing determination, competitive analysis, or other commercial purpose by Verdana, any Verdana affiliate, or any officer, director, employee, consultant, or agent of Verdana, at any time.

The Verdana Certification shall be duly notarized. Failure to deliver a timely and complete Verdana Certification shall constitute a material breach of this Protocol.

Section 3.5 — Ongoing Restrictions. For a period of twelve (12) months following the Effective Date (the "Monitoring Period"), Verdana shall maintain reasonable technical and administrative controls to prevent the re-introduction of CRH Data into Verdana Systems. Such controls shall include, at a minimum:

(a) Enhanced monitoring of file uploads, downloads, and transfers by any Individual Defendant employed by or engaged by Verdana, including data loss prevention ("DLP") tools configured to detect and flag files matching the hash values or metadata profiles of known CRH Data;

(b) Periodic (no less than quarterly) internal audits of systems and accounts used by Individual Defendants to confirm the absence of CRH Data; and

(c) Prompt notification to CRH's counsel in the event that any CRH Data is detected on Verdana Systems during the Monitoring Period, together with immediate quarantine and destruction of such data in accordance with the procedures set forth in this Protocol.

ARTICLE IV — INDEPENDENT FORENSIC AUDIT

Section 4.1 — Appointment of Forensic Auditor. The parties agree that Pinnacle Forensics LLC, located at 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910, with Dr. Rajiv Anand serving as engagement lead, shall serve as the independent Forensic Auditor for purposes of verifying compliance with this Protocol. Pinnacle Forensics LLC was originally retained by Calderwood & Harkness LLP on behalf of CRH on February 20, 2025, and has served as CRH's forensic consultant throughout the investigation giving rise to the Agreement. For purposes of this Protocol, and effective as of the Effective Date, Pinnacle Forensics LLC shall transition from its role as CRH's forensic consultant to the role of a neutral forensic auditor, with professional obligations to report its findings impartially and completely to both CRH's counsel (Calderwood & Harkness LLP, Attention: Bernard Crawford and James Underwood) and Verdana's counsel (Blackhall & Soren LLP, 300 Delaware Avenue, Suite 900, Wilmington, Delaware 19801, Attention: Gavin Blackhall and Meredith Lau), as well as to counsel for the Individual Defendants as specified in Section 4.5. Pinnacle Forensics LLC shall execute a neutrality acknowledgment letter, in form reasonably satisfactory to both CRH's and Verdana's counsel, within three (3) business days of the Effective Date.

Section 4.2 — Scope of Forensic Audit. The Forensic Auditor shall conduct an independent forensic audit (the "Independent Forensic Audit") encompassing the following:

(a) Individual Defendant Systems. All Covered Systems identified by each Individual Defendant in his or her Individual Inventory provided pursuant to Section 2.1, to the extent the Individual Defendant consents or is directed by the Agreement, the Consent Order, or Court order to provide access to such systems.

(b) Verdana Systems. All Verdana Systems relevant to the receipt, storage, processing, or use of CRH Data, as identified by Verdana in the Verdana Search Report provided pursuant to Section 3.1, as well as any additional Verdana Systems that the Forensic Auditor reasonably determines should be included within the scope of the audit based on its professional judgment and the information available.

The Independent Forensic Audit shall include, at a minimum, each of the following activities:

(i) Forensic imaging or targeted scanning of all relevant devices and storage media, using industry-standard forensic tools and methodologies, to identify any residual CRH Data, including files that may have been deleted but remain recoverable;

(ii) Analysis of file access logs, download histories, transfer records, email transmission logs, cloud synchronization logs, and deletion artifacts to verify the completeness and accuracy of the Individual Inventories and the Verdana Search Report;

(iii) Verification that the destruction methods employed by the Individual Defendants and by Verdana meet or exceed the standards set forth in NIST SP 800-88, including confirmation that deleted files are not recoverable through standard forensic recovery techniques;

(iv) Identification and documentation of any residual CRH Data that was not properly returned or destroyed in accordance with this Protocol; and

(v) Comparison of the Forensic Auditor's findings against the baseline inventory of the approximately 14,327 exfiltrated files (approximately 2.8 gigabytes) documented in Pinnacle Forensics LLC's Initial Forensic Report dated March 12, 2025, to confirm that all known instances of CRH Data have been accounted for, returned, or destroyed.

Section 4.3 — Verdana Cooperation and Access. Verdana shall provide the Forensic Auditor with full, prompt, and unrestricted access to all Verdana Systems (including, without limitation, production systems, development and staging environments, backup systems, disaster recovery infrastructure, and archival storage) as reasonably necessary to conduct the Independent Forensic Audit. Such access shall include the provision of administrative-level credentials or equivalent access rights to the extent necessary.

Verdana shall designate a technical liaison (the "Verdana Technical Liaison") to facilitate the Forensic Auditor's access to Verdana Systems and to respond to technical inquiries. Verdana shall identify the Verdana Technical Liaison in writing to the Forensic Auditor and to CRH's counsel within three (3) business days of the Effective Date, and such identification shall include the liaison's name, title, email address, and direct telephone number.

Verdana shall not interfere with, delay, impede, or obstruct the Forensic Auditor's work in any manner. In the event of any dispute regarding the scope, timing, or manner of the Forensic Auditor's access to Verdana Systems, such dispute shall be submitted to the Delaware Court of Chancery (Vice Chancellor Margaret T. Zhao, C.A. No. 2025-0198-MTZ) for expedited resolution on no fewer than three (3) business days' notice to all parties, and the Court's determination shall be final and binding.

Section 4.4 — Individual Defendant Cooperation. Each Individual Defendant shall provide the Forensic Auditor with reasonable access to his or her Covered Systems for purposes of verification of compliance with this Protocol, subject to reasonable scheduling accommodations that do not unreasonably delay the completion of the Independent Forensic Audit. Each Individual Defendant shall cooperate fully with the Forensic Auditor's reasonable requests for information and technical assistance in connection with the audit.

If any Individual Defendant has disposed of, lost, damaged, or no longer possesses a Covered System that was identified (or should have been identified) in such Individual Defendant's Individual Inventory, such Individual Defendant shall provide a detailed declaration under penalty of perjury explaining the circumstances of the disposition, loss, or damage, including the date of disposition, the method of disposition (e.g., sale, trade-in, donation, accidental loss, destruction), the identity of any transferee, and whether any CRH Data resided on the device at the time of disposition.

Section 4.5 — Timeline for Forensic Audit. The Forensic Auditor shall commence the Independent Forensic Audit within five (5) business days following the Data Return/Destruction Deadline. The Forensic Auditor shall use commercially reasonable efforts to complete the audit within thirty (30) calendar days of commencement. If the Forensic Auditor determines that additional time is required to complete the audit due to the volume of data, the number of systems to be examined, access delays, or other circumstances beyond the Forensic Auditor's reasonable control, the Forensic Auditor shall notify all parties' counsel in writing and shall provide an estimated revised completion date.

The Forensic Auditor shall deliver a comprehensive written report (the "Forensic Audit Report") within ten (10) business days of the completion of the audit. The Forensic Audit Report shall be delivered simultaneously to:

(a) CRH's counsel: Calderwood & Harkness LLP, 1301 K Street NW, Suite 1200, Washington, DC 20005, Attention: Bernard Crawford and James Underwood;

(b) Verdana's counsel: Blackhall & Soren LLP, 300 Delaware Avenue, Suite 900, Wilmington, DE 19801, Attention: Gavin Blackhall and Meredith Lau; and

(c) Counsel for the Individual Defendants: Whitfield, Nygaard & Doyle LLP, 1000 North Market Street, Suite 1500, Wilmington, DE 19801, Attention: Catherine Nygaard.

The Forensic Audit Report shall set forth in reasonable detail the Forensic Auditor's findings, including the methodology employed, the systems examined, the results of the analysis, and the Forensic Auditor's conclusions regarding whether each party subject to this Protocol has complied with its obligations hereunder.

Section 4.6 — Cost of Forensic Audit. The costs and expenses of the Independent Forensic Audit shall be allocated as follows:

(a) Verdana Systems. All costs and expenses of the Independent Forensic Audit as applied to the examination of Verdana Systems shall be borne exclusively by Verdana, subject to a cap of One Hundred Seventy-Five Thousand Dollars ($175,000). If the Forensic Auditor projects that the costs of the Verdana Systems audit will exceed $175,000, the Forensic Auditor shall promptly notify both CRH's counsel and Verdana's counsel in writing before incurring any costs in excess of such cap. Any excess costs shall require either (i) mutual written agreement of CRH and Verdana as to the allocation of such excess costs, or (ii) an order of the Court directing the allocation of such excess costs.

(b) Individual Defendant Systems. All costs and expenses of any audit of the Individual Defendants' personal Covered Systems shall be borne by CRH. For the avoidance of doubt, this allocation is without prejudice to CRH's right to seek recovery of such costs from the Individual Defendants or from Verdana as part of any enforcement proceeding or as otherwise provided in the Agreement.

Section 4.7 — Remediation of Non-Compliance. In the event that the Forensic Audit Report identifies any CRH Data that was not properly returned or destroyed in accordance with this Protocol, the following remediation procedures shall apply:

(a) The responsible party (whether an Individual Defendant or Verdana, as applicable) shall, immediately and without further delay, complete the return or destruction of such CRH Data under the direct supervision of the Forensic Auditor, at such responsible party's sole cost and expense.

(b) The Forensic Auditor shall conduct a follow-up verification within ten (10) business days of the completion of such remedial action and shall issue a supplemental report (the "Supplemental Forensic Report") to all parties' counsel confirming whether the remediation was successful and whether all CRH Data has been properly returned or destroyed.

(c) CRH shall have the right, in addition to any remediation under this Section, to seek enforcement of this Protocol through the retained jurisdiction of the Delaware Court of Chancery pursuant to the Consent Order entered in C.A. No. 2025-0198-MTZ, including without limitation by motion for contempt, sanctions, or other appropriate relief.

(d) Nothing in this Section 4.7 shall be deemed to limit or restrict any other right or remedy available to CRH under the Agreement, at law, or in equity.

ARTICLE V — CONFIDENTIALITY OF PROTOCOL AND REPORTS

Section 5.1 — Confidential Treatment. This Protocol, the Individual Inventories, the Verdana Search Report, the Individual Certifications, the Verdana Certification, the Forensic Audit Report, the Supplemental Forensic Report (if any), and all other documents, communications, and materials produced, generated, or exchanged pursuant to this Protocol (collectively, the "Protocol Materials") shall be treated as strictly confidential and shall not be disclosed to any third party, except:

(a) As required by applicable law, regulation, subpoena, or court order, provided that the disclosing party shall provide prompt written notice to the other parties (to the extent permitted by law) prior to any such disclosure, to permit the other parties to seek a protective order or other appropriate relief;

(b) To the Delaware Court of Chancery in connection with any enforcement proceedings arising under the Agreement or the Consent Order, subject to the filing-under-seal provisions of Section 5.2 below;

(c) To the independent compliance monitor, Aldwyn Compliance Solutions LLC, located at 1700 Market Street, Suite 2800, Philadelphia, Pennsylvania 19103, appointed pursuant to Section 9.4 of the Agreement, solely in connection with the performance of such monitor's duties under the Agreement; or

(d) To CRH's outside auditors, Hargrove & Tillett CPA, PLLC, solely for purposes of financial reporting, internal controls assessment, and litigation contingency evaluation, provided that such auditors are bound by professional confidentiality obligations no less restrictive than those set forth herein.

Each party shall take all commercially reasonable steps to ensure that its officers, directors, employees, agents, and advisors who receive access to Protocol Materials are informed of and comply with the confidentiality obligations set forth in this Article V.

Section 5.2 — Court Filing Under Seal. To the extent any Protocol Materials are filed with the Delaware Court of Chancery in connection with any proceeding arising under or related to this Protocol or the Agreement, such materials shall be filed under seal and shall be subject to the Stipulated Protective Order entered by Vice Chancellor Zhao on March 28, 2025, or such other protective order as the Court may enter. The parties shall cooperate in good faith in the preparation and submission of any motion to seal or any application for a protective order as may be necessary to protect the confidentiality of Protocol Materials.

ARTICLE VI — REPRESENTATIONS AND WARRANTIES

Section 6.1 — Individual Defendants' Representations. Each Individual Defendant hereby represents and warrants to CRH, as of the Effective Date and as of the Certification Deadline, as follows:

(a) The Individual Inventory provided by such Individual Defendant pursuant to Section 2.1 is complete and accurate in all material respects, and such Individual Defendant has not knowingly omitted any Covered System or any category of CRH Data from the Individual Inventory;

(b) As of the Certification Deadline, no CRH Data remains in such Individual Defendant's possession, custody, or control, whether directly or through any agent, representative, family member, business associate, or other person acting on such Individual Defendant's behalf, except as specifically disclosed in accordance with Section 2.4 and identified in the Individual Certification; and

(c) No CRH Data has been provided, transmitted, shared, forwarded, or otherwise made available by such Individual Defendant to any person or entity other than Verdana, and, to the extent any CRH Data was provided to Verdana, such transfer has been fully and accurately disclosed in the Individual Inventory, including the identity of the Verdana recipient(s), the date(s) and method(s) of transfer, and a description of the CRH Data so transferred.

Each Individual Defendant acknowledges that CRH is relying on the foregoing representations and warranties in entering into the Agreement and this Protocol, and that any material breach of such representations and warranties may give rise to claims for damages and other relief beyond those specified in Article VII.

Section 6.2 — Verdana's Representations. Verdana hereby represents and warrants to CRH, as of the Effective Date and as of the date of delivery of the Verdana Certification, as follows:

(a) Verdana has not, other than through the receipt of CRH Data from the Individual Defendants as may be disclosed in the Individual Inventories and the Verdana Search Report, independently obtained CRH Data through any other means, including without limitation through the engagement of third-party data brokers, competitive intelligence firms, hacking or unauthorized access to CRH systems, or any other lawful or unlawful method;

(b) Verdana has not incorporated, integrated, or otherwise used CRH Data in any business strategy, product development initiative, vendor negotiation, pricing decision, assortment planning exercise, customer targeting effort, marketing campaign, or other commercial activity of any kind, including, without limitation, Verdana's publicly announced "transformational growth initiative" targeting $4 billion in annual revenue by fiscal year 2028, the development of Verdana's private-label portfolio, and any negotiations with vendors or suppliers that overlap with CRH's vendor or supplier base; and

(c) Verdana will comply in full and in good faith with the quarantine, destruction, certification, and ongoing monitoring obligations set forth in this Protocol, and will take all commercially reasonable steps to ensure that its officers, directors, employees, agents, consultants, and affiliates do the same.

Verdana acknowledges that CRH is relying on the foregoing representations and warranties in entering into the Agreement and this Protocol, and that any material breach of such representations and warranties may give rise to claims for damages and other relief beyond those specified in Article VII.

ARTICLE VII — CONSEQUENCES OF NON-COMPLIANCE

Section 7.1 — Breach. A material breach of this Protocol by any Individual Defendant or by Verdana shall constitute a material breach of the Agreement and shall entitle CRH to all remedies available under the Agreement, at law, and in equity, without limitation, including the following:

(a) Enforcement of this Protocol and the Agreement through the Consent Order entered by the Delaware Court of Chancery in C.A. No. 2025-0198-MTZ (Vice Chancellor Margaret T. Zhao presiding), including by motion for specific performance, injunctive relief, or other equitable remedies;

(b) Initiation of contempt proceedings against the breaching party or parties for violation of the Consent Order, with all attendant sanctions and penalties available under Delaware law;

(c) Recovery of all reasonable attorneys' fees, forensic consultant fees, expert fees, court costs, and other expenses incurred by CRH in connection with the investigation and enforcement of such breach; and

(d) Reactivation of the original (pre-modification) restrictive covenant terms applicable to the breaching Individual Defendant(s), as provided in Section 7.3 of the Agreement, such that the original non-competition, non-solicitation, and confidentiality restrictions shall be reinstated in full force and effect for their original durations, measured from the date of such reactivation.

The remedies set forth in this Section 7.1 are cumulative and are in addition to, and not in limitation of, any other rights or remedies available to CRH under the Agreement, at law, or in equity.

Section 7.2 — Liquidated Damages. In the event of a material breach of this Protocol, the liquidated damages provisions set forth in Section 7.4 of the Agreement shall apply, and the breaching party shall be liable for the liquidated damages amounts specified therein. The parties acknowledge and agree that such liquidated damages are a reasonable estimate of the harm that CRH would suffer as a result of a breach of this Protocol, that such harm would be difficult or impossible to calculate with precision, and that such liquidated damages are not intended as a penalty. The payment of liquidated damages shall not relieve the breaching party of its obligation to comply with this Protocol or limit CRH's right to seek equitable relief, including specific performance and injunctive relief.

ARTICLE VIII — GENERAL PROVISIONS

Section 8.1 — Governing Law. This Protocol shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to any conflict-of-laws principles that would require or permit the application of the laws of any other jurisdiction.

Section 8.2 — Jurisdiction. The Delaware Court of Chancery shall have exclusive jurisdiction for the interpretation and enforcement of this Protocol, and the parties hereby consent to the personal jurisdiction of the Delaware Court of Chancery for such purposes. The Delaware Court of Chancery shall retain continuing jurisdiction over the parties and the subject matter of this Protocol pursuant to the Consent Order entered in C.A. No. 2025-0198-MTZ.

Section 8.3 — Notices. All notices, certifications, inventories, reports, and other communications required or permitted to be given or delivered under this Protocol shall be in writing and shall be deemed duly given (a) upon personal delivery, (b) one (1) business day after deposit with a nationally recognized overnight courier service (with tracking and signature confirmation), or (c) upon confirmed transmission by email (with PDF attachment), in each case addressed to the applicable party at the address set forth below:

For CRH:

Calderwood & Harkness LLP 1301 K Street NW, Suite 1200 Washington, DC 20005

Attention: Bernard Crawford / James Underwood

Email: bcrawford@calderwoodharkness.com / junderwood@calderwoodharkness.com

with a copy to:

Theresa Yun-Park, General Counsel Cascade Retail Holdings Inc. 2200 Elliott Avenue West, Suite 3400 Seattle, WA 98119

Email: tyunpark@cascaderetail.com

For Individual Defendants:

Whitfield, Nygaard & Doyle LLP 1000 North Market Street, Suite 1500 Wilmington, DE 19801

Attention: Catherine Nygaard / Travis Beaumont

Email: cnygaard@wndlaw.com / tbeaumont@wndlaw.com

For Verdana:

Blackhall & Soren LLP 300 Delaware Avenue, Suite 900 Wilmington, DE 19801

Attention: Gavin Blackhall / Meredith Lau

Email: gblackhall@blackhallsoren.com / mlau@blackhallsoren.com

with a copy to:

Helen Tsoi, General Counsel Verdana Commerce Group, Inc. 400 Christiana Gateway, Suite 700 Wilmington, DE 19801

Email: htsoi@verdanacommerce.com

For Forensic Auditor:

Pinnacle Forensics LLC 8700 Georgia Avenue, Suite 300 Silver Spring, MD 20910

Attention: Dr. Rajiv Anand

Email: ranand@pinnacleforensics.com

Any party may change its address for notice purposes by providing written notice of such change to all other parties in accordance with this Section 8.3.

Section 8.4 — Amendments. This Protocol may not be amended, modified, supplemented, or waived except by a written instrument signed by CRH, each Individual Defendant, and Verdana. If the Consent Order has been entered by the Delaware Court of Chancery at the time of any proposed amendment, such amendment shall not be effective unless and until it has been approved by the Court.

Section 8.5 — Integration. This Protocol is an integral part of the Agreement and is incorporated therein by reference as Exhibit B. This Protocol, together with the Agreement and the other exhibits and annexes thereto, constitutes the entire agreement among the parties with respect to the subject matter hereof and supersedes all prior negotiations, representations, warranties, commitments, offers, contracts, and writings (whether oral or written) with respect to such subject matter. In the event of any conflict or inconsistency between the terms of this Protocol and the terms of the body of the Agreement, the terms of the Agreement shall control.

ANNEX B-1

FORM OF INDIVIDUAL DEFENDANT CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL

CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL

I, ________, a defendant in Civil Action No. 2025-0198-MTZ pending in the Delaware Court of Chancery, and a party to the Standstill and Settlement Agreement dated as of April 14, 2025 (the "Agreement"), among Cascade Retail Holdings Inc. ("CRH"), the Individual Defendants (as defined therein), and Verdana Commerce Group, Inc. ("Verdana"), hereby certify under penalty of perjury, pursuant to Article II, Section 2.5 of the Data Return and Destruction Protocol attached as Exhibit B to the Agreement (the "Protocol"), as follows:

1. Identification of Covered Systems. I have identified all Covered Systems (as defined in the Protocol) on which CRH Data (as defined in the Protocol) resided or at any time resided since January 1, 2025, as set forth in my sworn Individual Inventory dated ____, which was delivered to CRH's counsel in accordance with Section 2.1 of the Protocol. The Individual Inventory is complete and accurate in all material respects.

2. Return and Destruction of CRH Data. I have returned to CRH or permanently destroyed all CRH Data that was in my possession, custody, or control, in accordance with the methods and standards specified in the Protocol, including compliance with NIST SP 800-88, Revision 1, "Guidelines for Media Sanitization," or equivalent standards approved by the Forensic Auditor. All return and destruction activities were completed on or before the Data Return/Destruction Deadline.

3. No Retention. I have not retained any CRH Data in any form or medium, whether physical, electronic, digital, handwritten, or otherwise, and no CRH Data remains in my possession, custody, or control, whether directly or through any agent, representative, family member, or other person acting on my behalf.

Exception (if applicable): If any CRH Data has been retained pursuant to the legal-obligation exception set forth in Section 2.4 of the Protocol, I identify such data and the legal basis for its retention as follows:

________________________________________

4. No Unauthorized Transmission. I have not transmitted, shared, forwarded, or otherwise made CRH Data available to any person or entity other than as fully disclosed in my sworn Individual Inventory delivered pursuant to Section 2.1 of the Protocol.

5. Deletion Methods Employed. The specific deletion and sanitization methods I employed for each Covered System are as follows:

(Attach additional pages as necessary.)

I declare under penalty of perjury under the laws of the State of Delaware and the United States of America that the foregoing is true and correct to the best of my knowledge, information, and belief.

Executed on this _ day of ___, 2025.

________________________________________

Name: ________

NOTARY ACKNOWLEDGMENT

STATE OF ______ )

) ss.

COUNTY OF ______ )

On this _ day of ___, 2025, before me, the undersigned notary public, personally appeared ________, known to me (or proved to me on the basis of satisfactory evidence) to be the person whose name is subscribed to the within instrument, and acknowledged to me that he/she executed the same in his/her authorized capacity, and that by his/her signature on the instrument, he/she executed this certification voluntarily and under penalty of perjury.

WITNESS my hand and official seal.

________________________________________

Notary Public My Commission Expires: ____

This form of certification shall be executed individually by each of the following Individual Defendants:

1. Priya Rathore

2. Derek Linden

3. Sonia Kaczmarek

4. Amara Osei

5. Brent Halvorsen

6. Lucia Fernandez-Gill

7. Nathan Tsao

8. Kira Johansson

Each Individual Defendant shall execute a separate original of this certification and deliver it to CRH's counsel on or before the Certification Deadline.

ANNEX B-2

FORM OF VERDANA CORPORATE CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL

CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL VERDANA COMMERCE GROUP, INC.

The undersigned, a duly authorized officer of Verdana Commerce Group, Inc., a Delaware corporation ("Verdana"), hereby certifies on behalf of Verdana under penalty of perjury, pursuant to Article III, Section 3.4 of the Data Return and Destruction Protocol attached as Exhibit B (the "Protocol") to the Standstill and Settlement Agreement dated as of April 14, 2025 (the "Agreement"), among Cascade Retail Holdings Inc. ("CRH"), the Individual Defendants (as defined therein), and Verdana, as follows:

1. Search and Identification. Verdana has conducted a thorough and diligent search of all Verdana Systems (as defined in the Protocol), under the supervision of Verdana's General Counsel, Helen Tsoi, and has identified all CRH Data (as defined in the Protocol) residing on or accessible through any Verdana System. The results of such search were set forth in the Verdana Search Report delivered to CRH's counsel and to the Forensic Auditor in accordance with Section 3.1 of the Protocol, and such report was complete and accurate in all material respects as of the date of its delivery.

2. Destruction of CRH Data. Verdana has permanently deleted all CRH Data from all Verdana Systems using deletion and sanitization methods that meet or exceed the standards set forth in NIST SP 800-88, Revision 1, "Guidelines for Media Sanitization," or equivalent standards approved by the Forensic Auditor. With respect to backup media operating on automated rotation schedules, destruction of CRH Data on such media has been completed (or, if within the sixty (60) calendar day period following the Effective Date, is scheduled to be completed by ____, 2025, in accordance with the backup rotation schedule provided to CRH's counsel and the Forensic Auditor).

3. Quarantine and Non-Access. Verdana quarantined all identified CRH Data on Verdana Systems immediately upon the Effective Date, in accordance with Section 3.3 of the Protocol, and subsequently destroyed all such quarantined data. During the quarantine period, no Verdana employee, officer, director, consultant, advisor, or agent accessed, reviewed, copied, or used any quarantined CRH Data.

4. No Commercial Use. No CRH Data has been used, in whole or in part, in any business decision, strategy, product development initiative, vendor negotiation, pricing determination, assortment planning exercise, customer targeting effort, competitive analysis, marketing campaign, or other commercial purpose by Verdana, any Verdana affiliate, or any officer, director, employee, consultant, or agent of Verdana, at any time. Without limiting the generality of the foregoing, no CRH Data was used in connection with Verdana's announced "transformational growth initiative" or any related planning, analysis, or execution activities.

5. Ongoing Controls. Verdana has implemented, and will maintain for the duration of the Monitoring Period (as defined in the Protocol), reasonable technical and administrative controls to prevent the re-introduction of CRH Data into Verdana Systems, including the measures described in Section 3.5 of the Protocol.

Executed on this _ day of ___, 2025.

EXHIBIT B
DATA RETURN AND DESTRUCTION PROTOCOL
This Data Return and Destruction Protocol (this "Protocol") is Exhibit B to the Standstill and Settlement Agreement dated as of April 14, 2025 (the "Agreement"), among Cascade Retail Holdings Inc., a Delaware corporation ("CRH"), Priya Rathore, Derek Linden, Sonia Kaczmarek, Amara Osei, Brent Halvorsen, Lucia Fernandez-Gill, Nathan Tsao, and Kira Johansson (collectively, the "Individual Defendants" or the "Rathore Group"), and Verdana Commerce Group, Inc., a Delaware corporation ("Verdana" or "VCG").
Capitalized terms used but not defined herein shall have the meanings ascribed to them in the Agreement. In the event of a conflict between any defined term set forth in this Protocol and the corresponding term as defined in the Agreement, the definition set forth in the Agreement shall control unless this Protocol expressly provides otherwise.
ARTICLE I — DEFINITIONS
For purposes of this Protocol, the following terms shall have the meanings set forth below:
Section 1.1 — "CRH Data." "CRH Data" means all documents, files, records, data, information, and materials (in whatever form or medium, whether physical, electronic, or digital) that (a) were created, developed, stored, or maintained by or on behalf of CRH, (b) were accessed, obtained, copied, downloaded, transferred, or otherwise acquired by any Individual Defendant during his or her employment with CRH, and (c) constitute or contain Confidential Information or Trade Secrets (as those terms are defined in the applicable Employment Agreements entered into between CRH and each Individual Defendant, copies of which are annexed to the Agreement as Exhibit D). Without limiting the generality of the foregoing, "CRH Data" specifically includes:
(i) all Project Ridgeline materials, including presentations, strategic roadmaps, financial analyses, market assessments, competitive benchmarking studies, and all supporting data and work product related thereto;
(ii) vendor negotiation term sheets and playbooks, including any annotated vendor scorecards, pricing frameworks, rebate structures, markdown allowance schedules, and related negotiation strategies;
(iii) private-label cost models and sourcing strategies, including factory-level cost breakdowns, duty and logistics modeling, quality audit reports, and supplier diversification plans;
(iv) seasonal buying algorithms and category analytics, including open-to-buy models, demand forecasting algorithms, SKU-level performance analytics, assortment optimization frameworks, and inventory turn models;
(v) customer segmentation data, including loyalty program analytics, customer lifetime value models, demographic and psychographic profiles, purchase history databases, and personalization engine training data;
(vi) ecommerce assortment models, including digital merchandising planograms, conversion rate optimization data, A/B testing results, search algorithm tuning parameters, and marketplace channel strategies; and
(vii) any and all derivatives, extracts, summaries, compilations, notes, analyses, or copies of any of the foregoing, whether created by an Individual Defendant or by any other person using or incorporating such materials.
Section 1.2 — "Covered Systems." "Covered Systems" means all personal devices (including personal laptops, desktop computers, tablets, smartphones, and any other computing devices), personal email accounts (including accounts hosted by Northgate Software, Cascade Health IT, Ridgeline Technologies, Greaves Systems, or any other email service provider), personal cloud storage accounts (including, but not limited to, personal Hollowell Health IT, Larkspur Technologies, Meridian Systems, Severin Services Inc., box, Halcyon Services Inc., and any similar cloud storage or file synchronization services), USB drives, external hard drives, SD cards, portable storage devices, and any other storage media or platforms to which any CRH Data was transferred, downloaded, copied, or otherwise made accessible by any Individual Defendant, at any time.
Section 1.3 — "Verdana Systems." "Verdana Systems" means all devices, servers, networks, cloud environments (including, without limitation, Ridgeway Industries, Crestline Systems, Aldermere Technologies, and any private cloud infrastructure), email systems, collaboration platforms (including, without limitation, Meridian Solutions, Northgate Data Systems, Ashbury Data Systems, and similar platforms), shared drives, document management systems, databases, and any other information technology infrastructure owned, operated, leased, or controlled by Verdana or any of its affiliates. For the avoidance of doubt, "Verdana Systems" includes any systems operated by or on behalf of Greystone Capital Partners, LP or Greystone Capital Fund VII, LP that may have received, stored, or processed CRH Data, whether directly from an Individual Defendant or through Verdana.
Section 1.4 — "Exfiltrated Data." "Exfiltrated Data" means the approximately 14,327 files comprising approximately 2.8 gigabytes of data identified in the forensic report of Pinnacle Forensics LLC dated March 12, 2025 (the "Initial Forensic Report"), as having been downloaded from CRH's Aldermere Systems and Pinnacle Health IT environments to personal cloud storage accounts between January 10, 2025, and February 4, 2025. The Initial Forensic Report identifies the specific file names, hash values, file sizes, creation dates, modification dates, and download timestamps for each of the 14,327 files and constitutes the baseline inventory against which compliance with this Protocol shall be measured.
Section 1.5 — "Forensic Auditor." "Forensic Auditor" means Pinnacle Forensics LLC, located at 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910, engagement lead Dr. Rajiv Anand, or such other qualified forensic firm as the parties may mutually agree upon in writing or as the Court may appoint.
Section 1.6 — "Effective Date." "Effective Date" means the date of execution of the Agreement, which the parties have targeted to be April 14, 2025.
Section 1.7 — "Data Return/Destruction Deadline." "Data Return/Destruction Deadline" means the date that is ten (10) business days following the Effective Date.
Section 1.8 — "Certification Deadline." "Certification Deadline" means the date that is twelve (12) business days following the Effective Date (i.e., two (2) business days after the Data Return/Destruction Deadline).
ARTICLE II — OBLIGATIONS OF INDIVIDUAL DEFENDANTS
Section 2.1 — Identification of CRH Data. Within three (3) business days of the Effective Date, each Individual Defendant shall provide to CRH's counsel, Calderwood & Harkness LLP, 1301 K Street NW, Suite 1200, Washington, DC 20005, Attention: Bernard Crawford and James Underwood, a sworn written inventory (the "Individual Inventory"), executed under penalty of perjury, identifying the following:
(a) All Covered Systems on which CRH Data resides or has at any time resided since January 1, 2025, including for each such Covered System a description sufficient to identify the device or account (e.g., device make, model, and serial number; email account address; cloud storage account URL and provider; external media type and capacity);
(b) A description of the categories and approximate volume (in terms of number of files and total data size) of CRH Data on each such Covered System, organized by reference to the categories set forth in Section 1.1 above to the extent practicable;
(c) Whether any CRH Data was forwarded, shared, transmitted, or otherwise made available to any third party, including, without limitation, Verdana, any officer, director, employee, consultant, or agent of Verdana, any representative of Greystone Capital Partners, LP or Greystone Capital Fund VII, LP, or any other person or entity, and if so, the identity of each such recipient, the date(s) of transmission, the method of transmission, and a description of the CRH Data so transmitted; and
(d) Any CRH Data that has already been deleted, destroyed, or otherwise disposed of by such Individual Defendant prior to the Effective Date, including the date and method of each such deletion or destruction and, to the extent known, whether such deletion was permanent or recoverable.
Each Individual Inventory shall be accompanied by a declaration confirming its completeness and accuracy, and each Individual Defendant acknowledges that any material omission from or misstatement in the Individual Inventory may constitute a breach of this Protocol and a violation of the Consent Order.
Section 2.2 — Return of CRH Data. Each Individual Defendant shall, on or before the Data Return/Destruction Deadline:
(a) Return to CRH all physical documents, media, and tangible items containing or constituting CRH Data. All such physical materials shall be delivered to Calderwood & Harkness LLP at the address set forth in Section 2.1 above, via hand delivery, overnight courier (with tracking and signature confirmation), or such other method as CRH's counsel may approve in writing. Each delivery shall be accompanied by a transmittal letter identifying the contents of the delivery by category and approximate volume.
(b) Transfer all electronic CRH Data to a secure encrypted file transfer system designated by CRH's counsel or the Forensic Auditor. The Forensic Auditor shall provide each Individual Defendant with access credentials and instructions for the designated transfer system within two (2) business days of the Effective Date. Each Individual Defendant shall use the designated transfer system exclusively for this purpose and shall not transmit CRH Data by any other electronic means (including email, messaging applications, or consumer file-sharing services) unless expressly authorized in writing by CRH's counsel.
Section 2.3 — Destruction of CRH Data. Following confirmed receipt of returned data by CRH (or upon CRH's written direction to destroy in lieu of return, which CRH may issue in its sole discretion), each Individual Defendant shall, on or before the Data Return/Destruction Deadline:
(a) Permanently delete all CRH Data from all Covered Systems using deletion and sanitization methods that meet or exceed the standards set forth in the National Institute of Standards and Technology Special Publication 800-88, Revision 1 ("NIST SP 800-88"), "Guidelines for Media Sanitization," or equivalent standards as approved by the Forensic Auditor. For electronic media, acceptable methods include, without limitation, cryptographic erasure, secure overwrite (minimum three-pass), degaussing (for magnetic media), and physical destruction (shredding, disintegration, or incineration) where appropriate.
(b) Empty all recycle bins, trash folders, "recently deleted" folders, and similar temporary deletion repositories on all Covered Systems, and clear any cached, temporary, or thumbnail copies of CRH Data from all Covered Systems.
(c) Deauthorize and unlink any CRH cloud accounts, VPN tokens, single sign-on credentials, multi-factor authentication tokens, or other access credentials associated with CRH systems that remain active or accessible to such Individual Defendant, and provide written confirmation of such deauthorization to CRH's counsel.
(d) If any Covered System cannot be wiped of CRH Data without destruction of the entire device or without rendering the device inoperable for purposes unrelated to CRH Data, such Individual Defendant shall promptly notify CRH's counsel and the Forensic Auditor and shall make the device available for forensic imaging and targeted deletion by the Forensic Auditor at a mutually agreed upon time and location. The Forensic Auditor shall use commercially reasonable efforts to preserve the Individual Defendant's non-CRH personal data during such targeted deletion.
Section 2.4 — Prohibition on Retention. No Individual Defendant shall retain, in any form or medium (whether physical, electronic, digital, handwritten, or otherwise), any CRH Data after the Data Return/Destruction Deadline. This prohibition extends to all copies, duplicates, extracts, summaries, notes, screenshots, photographs, and any other reproductions of CRH Data, regardless of the format in which such materials exist. If any Individual Defendant is required by applicable law, regulation, or valid legal process to retain any CRH Data beyond the Data Return/Destruction Deadline, such Individual Defendant shall (i) provide prior written notice to CRH's counsel specifying the specific legal basis for such retention, the categories and volume of data to be retained, and the custodian responsible for such data, and (ii) segregate and secure such data in a manner that prevents its use for any purpose other than compliance with such legal requirement.
Section 2.5 — Individual Certifications. Each Individual Defendant shall, on or before the Certification Deadline, deliver to CRH's counsel a signed certification under penalty of perjury, substantially in the form attached as Annex B-1 to this Exhibit (the "Individual Certification"), attesting to the following:
(a) That such Individual Defendant has complied in full with Sections 2.1 through 2.4 of this Protocol;
(b) That no CRH Data remains in such Individual Defendant's possession, custody, or control, whether directly or through any agent, representative, family member, or other person acting on such Individual Defendant's behalf, or, if any CRH Data has been retained pursuant to the exception set forth in Section 2.4, identifying such data and the legal basis for its retention;
(c) That no CRH Data was transmitted, shared, forwarded, or otherwise made available to any person or entity other than as fully disclosed in the Individual Inventory required under Section 2.1; and
(d) Identification of the specific deletion methods employed for each Covered System, including the software tools used (if any), the sanitization standard applied, and the date on which deletion was completed.
Each Individual Certification shall be duly notarized. Failure to deliver a timely and complete Individual Certification shall constitute a material breach of this Protocol.
ARTICLE III — OBLIGATIONS OF VERDANA COMMERCE GROUP, INC.
Section 3.1 — Internal Search and Identification. Within five (5) business days of the Effective Date, Verdana shall conduct a thorough, diligent, and good-faith search of all Verdana Systems to identify any and all CRH Data that may have been introduced, uploaded, stored, cached, transmitted, accessed, or otherwise present on any Verdana System, whether as a result of actions taken by any Individual Defendant or by any other person.
The search shall be supervised by Verdana's General Counsel, Helen Tsoi, and shall encompass, at a minimum, each of the following:
(a) All devices and accounts issued to or used by any Individual Defendant in connection with such Individual Defendant's employment or engagement with Verdana, including laptops, desktops, mobile devices, email accounts, and collaboration platform accounts;
(b) All shared drives, collaboration platforms (including Meridian Solutions workspaces, Northgate Data Systems channels, confluence spaces, and Aldermere Systems sites), email systems, and document management systems accessible by any Individual Defendant during his or her tenure at Verdana;
(c) Any systems, databases, repositories, or platforms used by Verdana's merchandising division, strategy division, ecommerce division, or any other business unit that may have received, reviewed, or utilized CRH Data in connection with business planning, competitive analysis, vendor negotiations, product development, or any other purpose; and
(d) Any systems operated by or on behalf of Greystone Capital Partners, LP or Greystone Capital Fund VII, LP to which CRH Data may have been transmitted by Verdana or by any Individual Defendant.
Verdana shall provide a detailed written report of the search results (the "Verdana Search Report") to CRH's counsel and to the Forensic Auditor within the same five (5) business day period. The Verdana Search Report shall identify, for each instance of CRH Data found, the specific file name (or description if no file name is available), the Verdana System on which it was located, the date it was introduced onto the Verdana System (to the extent determinable), and the identity of the person who introduced or uploaded it.
Section 3.2 — Destruction on Verdana Systems. Verdana shall, on or before the Data Return/Destruction Deadline, permanently delete all CRH Data identified on Verdana Systems using deletion and sanitization methods that meet or exceed the standards set forth in NIST SP 800-88 or equivalent standards as approved by the Forensic Auditor. Verdana shall maintain a detailed log of all destruction activities, including the file or data set destroyed, the system from which it was destroyed, the method of destruction, the date and time of destruction, and the identity of the person who performed or supervised the destruction.
Verdana shall ensure that no CRH Data remains in backup tapes, disaster recovery systems, archival storage, or any other secondary or tertiary storage media. Verdana acknowledges that certain backup media may operate on automated rotation schedules that do not permit immediate targeted deletion. Accordingly, for backup media only, Verdana shall have a reasonable timeframe not to exceed sixty (60) calendar days from the Effective Date to complete destruction of CRH Data from backup media, provided that (i) Verdana takes all commercially reasonable steps to expedite such destruction, (ii) all backup media containing CRH Data is quarantined in accordance with Section 3.3 pending destruction, and (iii) Verdana provides CRH's counsel and the Forensic Auditor with a written schedule of anticipated backup rotation and destruction dates within ten (10) business days of the Effective Date.
Section 3.3 — Quarantine Pending Forensic Audit. Verdana shall, immediately upon the Effective Date, quarantine (i.e., isolate and restrict all access to) any and all CRH Data identified on Verdana Systems, pending completion of the destruction process described in Section 3.2 and verification by the Forensic Auditor as described in Article IV. Quarantine measures shall include, at a minimum, the following:
(a) Removal of all user access permissions to quarantined data, except for the limited access required by Verdana's information technology security personnel and General Counsel to administer the quarantine and facilitate the Forensic Auditor's work;
(b) Transfer of quarantined data to a segregated and access-restricted storage environment, if technically feasible, with access logging enabled; and
(c) Implementation of monitoring controls to detect and alert on any attempted access to quarantined data.
Quarantined data shall not be accessed, reviewed, copied, printed, downloaded, transmitted, or used by any Verdana employee, officer, director, consultant, advisor, agent, or any other person pending its destruction, except as necessary to facilitate the Forensic Auditor's work or as expressly authorized in writing by CRH's counsel.
Section 3.4 — Verdana Certification. Verdana shall, within five (5) business days following completion of the Independent Forensic Audit described in Article IV and receipt of the Forensic Audit Report, deliver to CRH's counsel a certification signed by an authorized officer of Verdana, substantially in the form attached as Annex B-2 to this Exhibit (the "Verdana Certification"), attesting to the following:
(a) That Verdana has complied in full with Sections 3.1 through 3.3 of this Protocol;
(b) That no CRH Data remains on any Verdana System (including backup media, to the extent the sixty (60) day backup rotation period has elapsed), or, if any CRH Data has been retained due to a legal or regulatory requirement, identifying such data, the legal basis for its retention, the system on which it is stored, and the custodian responsible; and
(c) That no CRH Data was used in any business decision, strategy, product development initiative, vendor negotiation, pricing determination, competitive analysis, or other commercial purpose by Verdana, any Verdana affiliate, or any officer, director, employee, consultant, or agent of Verdana, at any time.
The Verdana Certification shall be duly notarized. Failure to deliver a timely and complete Verdana Certification shall constitute a material breach of this Protocol.
Section 3.5 — Ongoing Restrictions. For a period of twelve (12) months following the Effective Date (the "Monitoring Period"), Verdana shall maintain reasonable technical and administrative controls to prevent the re-introduction of CRH Data into Verdana Systems. Such controls shall include, at a minimum:
(a) Enhanced monitoring of file uploads, downloads, and transfers by any Individual Defendant employed by or engaged by Verdana, including data loss prevention ("DLP") tools configured to detect and flag files matching the hash values or metadata profiles of known CRH Data;
(b) Periodic (no less than quarterly) internal audits of systems and accounts used by Individual Defendants to confirm the absence of CRH Data; and
(c) Prompt notification to CRH's counsel in the event that any CRH Data is detected on Verdana Systems during the Monitoring Period, together with immediate quarantine and destruction of such data in accordance with the procedures set forth in this Protocol.
ARTICLE IV — INDEPENDENT FORENSIC AUDIT
Section 4.1 — Appointment of Forensic Auditor. The parties agree that Pinnacle Forensics LLC, located at 8700 Georgia Avenue, Suite 300, Silver Spring, Maryland 20910, with Dr. Rajiv Anand serving as engagement lead, shall serve as the independent Forensic Auditor for purposes of verifying compliance with this Protocol. Pinnacle Forensics LLC was originally retained by Calderwood & Harkness LLP on behalf of CRH on February 20, 2025, and has served as CRH's forensic consultant throughout the investigation giving rise to the Agreement. For purposes of this Protocol, and effective as of the Effective Date, Pinnacle Forensics LLC shall transition from its role as CRH's forensic consultant to the role of a neutral forensic auditor, with professional obligations to report its findings impartially and completely to both CRH's counsel (Calderwood & Harkness LLP, Attention: Bernard Crawford and James Underwood) and Verdana's counsel (Blackhall & Soren LLP, 300 Delaware Avenue, Suite 900, Wilmington, Delaware 19801, Attention: Gavin Blackhall and Meredith Lau), as well as to counsel for the Individual Defendants as specified in Section 4.5. Pinnacle Forensics LLC shall execute a neutrality acknowledgment letter, in form reasonably satisfactory to both CRH's and Verdana's counsel, within three (3) business days of the Effective Date.
Section 4.2 — Scope of Forensic Audit. The Forensic Auditor shall conduct an independent forensic audit (the "Independent Forensic Audit") encompassing the following:
(a) Individual Defendant Systems. All Covered Systems identified by each Individual Defendant in his or her Individual Inventory provided pursuant to Section 2.1, to the extent the Individual Defendant consents or is directed by the Agreement, the Consent Order, or Court order to provide access to such systems.
(b) Verdana Systems. All Verdana Systems relevant to the receipt, storage, processing, or use of CRH Data, as identified by Verdana in the Verdana Search Report provided pursuant to Section 3.1, as well as any additional Verdana Systems that the Forensic Auditor reasonably determines should be included within the scope of the audit based on its professional judgment and the information available.
The Independent Forensic Audit shall include, at a minimum, each of the following activities:
(i) Forensic imaging or targeted scanning of all relevant devices and storage media, using industry-standard forensic tools and methodologies, to identify any residual CRH Data, including files that may have been deleted but remain recoverable;
(ii) Analysis of file access logs, download histories, transfer records, email transmission logs, cloud synchronization logs, and deletion artifacts to verify the completeness and accuracy of the Individual Inventories and the Verdana Search Report;
(iii) Verification that the destruction methods employed by the Individual Defendants and by Verdana meet or exceed the standards set forth in NIST SP 800-88, including confirmation that deleted files are not recoverable through standard forensic recovery techniques;
(iv) Identification and documentation of any residual CRH Data that was not properly returned or destroyed in accordance with this Protocol; and
(v) Comparison of the Forensic Auditor's findings against the baseline inventory of the approximately 14,327 exfiltrated files (approximately 2.8 gigabytes) documented in Pinnacle Forensics LLC's Initial Forensic Report dated March 12, 2025, to confirm that all known instances of CRH Data have been accounted for, returned, or destroyed.
Section 4.3 — Verdana Cooperation and Access. Verdana shall provide the Forensic Auditor with full, prompt, and unrestricted access to all Verdana Systems (including, without limitation, production systems, development and staging environments, backup systems, disaster recovery infrastructure, and archival storage) as reasonably necessary to conduct the Independent Forensic Audit. Such access shall include the provision of administrative-level credentials or equivalent access rights to the extent necessary.
Verdana shall designate a technical liaison (the "Verdana Technical Liaison") to facilitate the Forensic Auditor's access to Verdana Systems and to respond to technical inquiries. Verdana shall identify the Verdana Technical Liaison in writing to the Forensic Auditor and to CRH's counsel within three (3) business days of the Effective Date, and such identification shall include the liaison's name, title, email address, and direct telephone number.
Verdana shall not interfere with, delay, impede, or obstruct the Forensic Auditor's work in any manner. In the event of any dispute regarding the scope, timing, or manner of the Forensic Auditor's access to Verdana Systems, such dispute shall be submitted to the Delaware Court of Chancery (Vice Chancellor Margaret T. Zhao, C.A. No. 2025-0198-MTZ) for expedited resolution on no fewer than three (3) business days' notice to all parties, and the Court's determination shall be final and binding.
Section 4.4 — Individual Defendant Cooperation. Each Individual Defendant shall provide the Forensic Auditor with reasonable access to his or her Covered Systems for purposes of verification of compliance with this Protocol, subject to reasonable scheduling accommodations that do not unreasonably delay the completion of the Independent Forensic Audit. Each Individual Defendant shall cooperate fully with the Forensic Auditor's reasonable requests for information and technical assistance in connection with the audit.
If any Individual Defendant has disposed of, lost, damaged, or no longer possesses a Covered System that was identified (or should have been identified) in such Individual Defendant's Individual Inventory, such Individual Defendant shall provide a detailed declaration under penalty of perjury explaining the circumstances of the disposition, loss, or damage, including the date of disposition, the method of disposition (e.g., sale, trade-in, donation, accidental loss, destruction), the identity of any transferee, and whether any CRH Data resided on the device at the time of disposition.
Section 4.5 — Timeline for Forensic Audit. The Forensic Auditor shall commence the Independent Forensic Audit within five (5) business days following the Data Return/Destruction Deadline. The Forensic Auditor shall use commercially reasonable efforts to complete the audit within thirty (30) calendar days of commencement. If the Forensic Auditor determines that additional time is required to complete the audit due to the volume of data, the number of systems to be examined, access delays, or other circumstances beyond the Forensic Auditor's reasonable control, the Forensic Auditor shall notify all parties' counsel in writing and shall provide an estimated revised completion date.
The Forensic Auditor shall deliver a comprehensive written report (the "Forensic Audit Report") within ten (10) business days of the completion of the audit. The Forensic Audit Report shall be delivered simultaneously to:
(a) CRH's counsel: Calderwood & Harkness LLP, 1301 K Street NW, Suite 1200, Washington, DC 20005, Attention: Bernard Crawford and James Underwood;
(b) Verdana's counsel: Blackhall & Soren LLP, 300 Delaware Avenue, Suite 900, Wilmington, DE 19801, Attention: Gavin Blackhall and Meredith Lau; and
(c) Counsel for the Individual Defendants: Whitfield, Nygaard & Doyle LLP, 1000 North Market Street, Suite 1500, Wilmington, DE 19801, Attention: Catherine Nygaard.
The Forensic Audit Report shall set forth in reasonable detail the Forensic Auditor's findings, including the methodology employed, the systems examined, the results of the analysis, and the Forensic Auditor's conclusions regarding whether each party subject to this Protocol has complied with its obligations hereunder.
Section 4.6 — Cost of Forensic Audit. The costs and expenses of the Independent Forensic Audit shall be allocated as follows:
(a) Verdana Systems. All costs and expenses of the Independent Forensic Audit as applied to the examination of Verdana Systems shall be borne exclusively by Verdana, subject to a cap of One Hundred Seventy-Five Thousand Dollars ($175,000). If the Forensic Auditor projects that the costs of the Verdana Systems audit will exceed $175,000, the Forensic Auditor shall promptly notify both CRH's counsel and Verdana's counsel in writing before incurring any costs in excess of such cap. Any excess costs shall require either (i) mutual written agreement of CRH and Verdana as to the allocation of such excess costs, or (ii) an order of the Court directing the allocation of such excess costs.
(b) Individual Defendant Systems. All costs and expenses of any audit of the Individual Defendants' personal Covered Systems shall be borne by CRH. For the avoidance of doubt, this allocation is without prejudice to CRH's right to seek recovery of such costs from the Individual Defendants or from Verdana as part of any enforcement proceeding or as otherwise provided in the Agreement.
Section 4.7 — Remediation of Non-Compliance. In the event that the Forensic Audit Report identifies any CRH Data that was not properly returned or destroyed in accordance with this Protocol, the following remediation procedures shall apply:
(a) The responsible party (whether an Individual Defendant or Verdana, as applicable) shall, immediately and without further delay, complete the return or destruction of such CRH Data under the direct supervision of the Forensic Auditor, at such responsible party's sole cost and expense.
(b) The Forensic Auditor shall conduct a follow-up verification within ten (10) business days of the completion of such remedial action and shall issue a supplemental report (the "Supplemental Forensic Report") to all parties' counsel confirming whether the remediation was successful and whether all CRH Data has been properly returned or destroyed.
(c) CRH shall have the right, in addition to any remediation under this Section, to seek enforcement of this Protocol through the retained jurisdiction of the Delaware Court of Chancery pursuant to the Consent Order entered in C.A. No. 2025-0198-MTZ, including without limitation by motion for contempt, sanctions, or other appropriate relief.
(d) Nothing in this Section 4.7 shall be deemed to limit or restrict any other right or remedy available to CRH under the Agreement, at law, or in equity.
ARTICLE V — CONFIDENTIALITY OF PROTOCOL AND REPORTS
Section 5.1 — Confidential Treatment. This Protocol, the Individual Inventories, the Verdana Search Report, the Individual Certifications, the Verdana Certification, the Forensic Audit Report, the Supplemental Forensic Report (if any), and all other documents, communications, and materials produced, generated, or exchanged pursuant to this Protocol (collectively, the "Protocol Materials") shall be treated as strictly confidential and shall not be disclosed to any third party, except:
(a) As required by applicable law, regulation, subpoena, or court order, provided that the disclosing party shall provide prompt written notice to the other parties (to the extent permitted by law) prior to any such disclosure, to permit the other parties to seek a protective order or other appropriate relief;
(b) To the Delaware Court of Chancery in connection with any enforcement proceedings arising under the Agreement or the Consent Order, subject to the filing-under-seal provisions of Section 5.2 below;
(c) To the independent compliance monitor, Aldwyn Compliance Solutions LLC, located at 1700 Market Street, Suite 2800, Philadelphia, Pennsylvania 19103, appointed pursuant to Section 9.4 of the Agreement, solely in connection with the performance of such monitor's duties under the Agreement; or
(d) To CRH's outside auditors, Hargrove & Tillett CPA, PLLC, solely for purposes of financial reporting, internal controls assessment, and litigation contingency evaluation, provided that such auditors are bound by professional confidentiality obligations no less restrictive than those set forth herein.
Each party shall take all commercially reasonable steps to ensure that its officers, directors, employees, agents, and advisors who receive access to Protocol Materials are informed of and comply with the confidentiality obligations set forth in this Article V.
Section 5.2 — Court Filing Under Seal. To the extent any Protocol Materials are filed with the Delaware Court of Chancery in connection with any proceeding arising under or related to this Protocol or the Agreement, such materials shall be filed under seal and shall be subject to the Stipulated Protective Order entered by Vice Chancellor Zhao on March 28, 2025, or such other protective order as the Court may enter. The parties shall cooperate in good faith in the preparation and submission of any motion to seal or any application for a protective order as may be necessary to protect the confidentiality of Protocol Materials.
ARTICLE VI — REPRESENTATIONS AND WARRANTIES
Section 6.1 — Individual Defendants' Representations. Each Individual Defendant hereby represents and warrants to CRH, as of the Effective Date and as of the Certification Deadline, as follows:
(a) The Individual Inventory provided by such Individual Defendant pursuant to Section 2.1 is complete and accurate in all material respects, and such Individual Defendant has not knowingly omitted any Covered System or any category of CRH Data from the Individual Inventory;
(b) As of the Certification Deadline, no CRH Data remains in such Individual Defendant's possession, custody, or control, whether directly or through any agent, representative, family member, business associate, or other person acting on such Individual Defendant's behalf, except as specifically disclosed in accordance with Section 2.4 and identified in the Individual Certification; and
(c) No CRH Data has been provided, transmitted, shared, forwarded, or otherwise made available by such Individual Defendant to any person or entity other than Verdana, and, to the extent any CRH Data was provided to Verdana, such transfer has been fully and accurately disclosed in the Individual Inventory, including the identity of the Verdana recipient(s), the date(s) and method(s) of transfer, and a description of the CRH Data so transferred.
Each Individual Defendant acknowledges that CRH is relying on the foregoing representations and warranties in entering into the Agreement and this Protocol, and that any material breach of such representations and warranties may give rise to claims for damages and other relief beyond those specified in Article VII.
Section 6.2 — Verdana's Representations. Verdana hereby represents and warrants to CRH, as of the Effective Date and as of the date of delivery of the Verdana Certification, as follows:
(a) Verdana has not, other than through the receipt of CRH Data from the Individual Defendants as may be disclosed in the Individual Inventories and the Verdana Search Report, independently obtained CRH Data through any other means, including without limitation through the engagement of third-party data brokers, competitive intelligence firms, hacking or unauthorized access to CRH systems, or any other lawful or unlawful method;
(b) Verdana has not incorporated, integrated, or otherwise used CRH Data in any business strategy, product development initiative, vendor negotiation, pricing decision, assortment planning exercise, customer targeting effort, marketing campaign, or other commercial activity of any kind, including, without limitation, Verdana's publicly announced "transformational growth initiative" targeting $4 billion in annual revenue by fiscal year 2028, the development of Verdana's private-label portfolio, and any negotiations with vendors or suppliers that overlap with CRH's vendor or supplier base; and
(c) Verdana will comply in full and in good faith with the quarantine, destruction, certification, and ongoing monitoring obligations set forth in this Protocol, and will take all commercially reasonable steps to ensure that its officers, directors, employees, agents, consultants, and affiliates do the same.
Verdana acknowledges that CRH is relying on the foregoing representations and warranties in entering into the Agreement and this Protocol, and that any material breach of such representations and warranties may give rise to claims for damages and other relief beyond those specified in Article VII.
ARTICLE VII — CONSEQUENCES OF NON-COMPLIANCE
Section 7.1 — Breach. A material breach of this Protocol by any Individual Defendant or by Verdana shall constitute a material breach of the Agreement and shall entitle CRH to all remedies available under the Agreement, at law, and in equity, without limitation, including the following:
(a) Enforcement of this Protocol and the Agreement through the Consent Order entered by the Delaware Court of Chancery in C.A. No. 2025-0198-MTZ (Vice Chancellor Margaret T. Zhao presiding), including by motion for specific performance, injunctive relief, or other equitable remedies;
(b) Initiation of contempt proceedings against the breaching party or parties for violation of the Consent Order, with all attendant sanctions and penalties available under Delaware law;
(c) Recovery of all reasonable attorneys' fees, forensic consultant fees, expert fees, court costs, and other expenses incurred by CRH in connection with the investigation and enforcement of such breach; and
(d) Reactivation of the original (pre-modification) restrictive covenant terms applicable to the breaching Individual Defendant(s), as provided in Section 7.3 of the Agreement, such that the original non-competition, non-solicitation, and confidentiality restrictions shall be reinstated in full force and effect for their original durations, measured from the date of such reactivation.
The remedies set forth in this Section 7.1 are cumulative and are in addition to, and not in limitation of, any other rights or remedies available to CRH under the Agreement, at law, or in equity.
Section 7.2 — Liquidated Damages. In the event of a material breach of this Protocol, the liquidated damages provisions set forth in Section 7.4 of the Agreement shall apply, and the breaching party shall be liable for the liquidated damages amounts specified therein. The parties acknowledge and agree that such liquidated damages are a reasonable estimate of the harm that CRH would suffer as a result of a breach of this Protocol, that such harm would be difficult or impossible to calculate with precision, and that such liquidated damages are not intended as a penalty. The payment of liquidated damages shall not relieve the breaching party of its obligation to comply with this Protocol or limit CRH's right to seek equitable relief, including specific performance and injunctive relief.
ARTICLE VIII — GENERAL PROVISIONS
Section 8.1 — Governing Law. This Protocol shall be governed by and construed in accordance with the laws of the State of Delaware, without regard to any conflict-of-laws principles that would require or permit the application of the laws of any other jurisdiction.
Section 8.2 — Jurisdiction. The Delaware Court of Chancery shall have exclusive jurisdiction for the interpretation and enforcement of this Protocol, and the parties hereby consent to the personal jurisdiction of the Delaware Court of Chancery for such purposes. The Delaware Court of Chancery shall retain continuing jurisdiction over the parties and the subject matter of this Protocol pursuant to the Consent Order entered in C.A. No. 2025-0198-MTZ.
Section 8.3 — Notices. All notices, certifications, inventories, reports, and other communications required or permitted to be given or delivered under this Protocol shall be in writing and shall be deemed duly given (a) upon personal delivery, (b) one (1) business day after deposit with a nationally recognized overnight courier service (with tracking and signature confirmation), or (c) upon confirmed transmission by email (with PDF attachment), in each case addressed to the applicable party at the address set forth below:
For CRH:
Calderwood & Harkness LLP 1301 K Street NW, Suite 1200 Washington, DC 20005
Attention: Bernard Crawford / James Underwood
Email: bcrawford@calderwoodharkness.com / junderwood@calderwoodharkness.com
with a copy to:
Theresa Yun-Park, General Counsel Cascade Retail Holdings Inc. 2200 Elliott Avenue West, Suite 3400 Seattle, WA 98119
Email: tyunpark@cascaderetail.com
For Individual Defendants:
Whitfield, Nygaard & Doyle LLP 1000 North Market Street, Suite 1500 Wilmington, DE 19801
Attention: Catherine Nygaard / Travis Beaumont
Email: cnygaard@wndlaw.com / tbeaumont@wndlaw.com
For Verdana:
Blackhall & Soren LLP 300 Delaware Avenue, Suite 900 Wilmington, DE 19801
Attention: Gavin Blackhall / Meredith Lau
Email: gblackhall@blackhallsoren.com / mlau@blackhallsoren.com
with a copy to:
Helen Tsoi, General Counsel Verdana Commerce Group, Inc. 400 Christiana Gateway, Suite 700 Wilmington, DE 19801
Email: htsoi@verdanacommerce.com
For Forensic Auditor:
Pinnacle Forensics LLC 8700 Georgia Avenue, Suite 300 Silver Spring, MD 20910
Attention: Dr. Rajiv Anand
Email: ranand@pinnacleforensics.com
Any party may change its address for notice purposes by providing written notice of such change to all other parties in accordance with this Section 8.3.
Section 8.4 — Amendments. This Protocol may not be amended, modified, supplemented, or waived except by a written instrument signed by CRH, each Individual Defendant, and Verdana. If the Consent Order has been entered by the Delaware Court of Chancery at the time of any proposed amendment, such amendment shall not be effective unless and until it has been approved by the Court.
Section 8.5 — Integration. This Protocol is an integral part of the Agreement and is incorporated therein by reference as Exhibit B. This Protocol, together with the Agreement and the other exhibits and annexes thereto, constitutes the entire agreement among the parties with respect to the subject matter hereof and supersedes all prior negotiations, representations, warranties, commitments, offers, contracts, and writings (whether oral or written) with respect to such subject matter. In the event of any conflict or inconsistency between the terms of this Protocol and the terms of the body of the Agreement, the terms of the Agreement shall control.
ANNEX B-1
FORM OF INDIVIDUAL DEFENDANT CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL
CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL
I, ________, a defendant in Civil Action No. 2025-0198-MTZ pending in the Delaware Court of Chancery, and a party to the Standstill and Settlement Agreement dated as of April 14, 2025 (the "Agreement"), among Cascade Retail Holdings Inc. ("CRH"), the Individual Defendants (as defined therein), and Verdana Commerce Group, Inc. ("Verdana"), hereby certify under penalty of perjury, pursuant to Article II, Section 2.5 of the Data Return and Destruction Protocol attached as Exhibit B to the Agreement (the "Protocol"), as follows:
1.  Identification of Covered Systems. I have identified all Covered Systems (as defined in the Protocol) on which CRH Data (as defined in the Protocol) resided or at any time resided since January 1, 2025, as set forth in my sworn Individual Inventory dated ____, which was delivered to CRH's counsel in accordance with Section 2.1 of the Protocol. The Individual Inventory is complete and accurate in all material respects.
2.  Return and Destruction of CRH Data. I have returned to CRH or permanently destroyed all CRH Data that was in my possession, custody, or control, in accordance with the methods and standards specified in the Protocol, including compliance with NIST SP 800-88, Revision 1, "Guidelines for Media Sanitization," or equivalent standards approved by the Forensic Auditor. All return and destruction activities were completed on or before the Data Return/Destruction Deadline.
3.  No Retention. I have not retained any CRH Data in any form or medium, whether physical, electronic, digital, handwritten, or otherwise, and no CRH Data remains in my possession, custody, or control, whether directly or through any agent, representative, family member, or other person acting on my behalf.
Exception (if applicable): If any CRH Data has been retained pursuant to the legal-obligation exception set forth in Section 2.4 of the Protocol, I identify such data and the legal basis for its retention as follows:
________________________________________
________________________________________
________________________________________
4.  No Unauthorized Transmission. I have not transmitted, shared, forwarded, or otherwise made CRH Data available to any person or entity other than as fully disclosed in my sworn Individual Inventory delivered pursuant to Section 2.1 of the Protocol.
5.  Deletion Methods Employed. The specific deletion and sanitization methods I employed for each Covered System are as follows:
(Attach additional pages as necessary.)
I declare under penalty of perjury under the laws of the State of Delaware and the United States of America that the foregoing is true and correct to the best of my knowledge, information, and belief.
Executed on this _ day of ___, 2025.
________________________________________
Name: ________
NOTARY ACKNOWLEDGMENT
STATE OF ______ )
) ss.
COUNTY OF ______ )
On this _ day of ___, 2025, before me, the undersigned notary public, personally appeared ________, known to me (or proved to me on the basis of satisfactory evidence) to be the person whose name is subscribed to the within instrument, and acknowledged to me that he/she executed the same in his/her authorized capacity, and that by his/her signature on the instrument, he/she executed this certification voluntarily and under penalty of perjury.
WITNESS my hand and official seal.
________________________________________
Notary Public My Commission Expires: ____
This form of certification shall be executed individually by each of the following Individual Defendants:
1.  Priya Rathore
2.  Derek Linden
3.  Sonia Kaczmarek
4.  Amara Osei
5.  Brent Halvorsen
6.  Lucia Fernandez-Gill
7.  Nathan Tsao
8.  Kira Johansson
Each Individual Defendant shall execute a separate original of this certification and deliver it to CRH's counsel on or before the Certification Deadline.
ANNEX B-2
FORM OF VERDANA CORPORATE CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL
CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL VERDANA COMMERCE GROUP, INC.
The undersigned, a duly authorized officer of Verdana Commerce Group, Inc., a Delaware corporation ("Verdana"), hereby certifies on behalf of Verdana under penalty of perjury, pursuant to Article III, Section 3.4 of the Data Return and Destruction Protocol attached as Exhibit B (the "Protocol") to the Standstill and Settlement Agreement dated as of April 14, 2025 (the "Agreement"), among Cascade Retail Holdings Inc. ("CRH"), the Individual Defendants (as defined therein), and Verdana, as follows:
1.  Search and Identification. Verdana has conducted a thorough and diligent search of all Verdana Systems (as defined in the Protocol), under the supervision of Verdana's General Counsel, Helen Tsoi, and has identified all CRH Data (as defined in the Protocol) residing on or accessible through any Verdana System. The results of such search were set forth in the Verdana Search Report delivered to CRH's counsel and to the Forensic Auditor in accordance with Section 3.1 of the Protocol, and such report was complete and accurate in all material respects as of the date of its delivery.
2.  Destruction of CRH Data. Verdana has permanently deleted all CRH Data from all Verdana Systems using deletion and sanitization methods that meet or exceed the standards set forth in NIST SP 800-88, Revision 1, "Guidelines for Media Sanitization," or equivalent standards approved by the Forensic Auditor. With respect to backup media operating on automated rotation schedules, destruction of CRH Data on such media has been completed (or, if within the sixty (60) calendar day period following the Effective Date, is scheduled to be completed by ____, 2025, in accordance with the backup rotation schedule provided to CRH's counsel and the Forensic Auditor).
3.  Quarantine and Non-Access. Verdana quarantined all identified CRH Data on Verdana Systems immediately upon the Effective Date, in accordance with Section 3.3 of the Protocol, and subsequently destroyed all such quarantined data. During the quarantine period, no Verdana employee, officer, director, consultant, advisor, or agent accessed, reviewed, copied, or used any quarantined CRH Data.
4.  No Commercial Use. No CRH Data has been used, in whole or in part, in any business decision, strategy, product development initiative, vendor negotiation, pricing determination, assortment planning exercise, customer targeting effort, competitive analysis, marketing campaign, or other commercial purpose by Verdana, any Verdana affiliate, or any officer, director, employee, consultant, or agent of Verdana, at any time. Without limiting the generality of the foregoing, no CRH Data was used in connection with Verdana's announced "transformational growth initiative" or any related planning, analysis, or execution activities.
5.  Ongoing Controls. Verdana has implemented, and will maintain for the duration of the Monitoring Period (as defined in the Protocol), reasonable technical and administrative controls to prevent the re-introduction of CRH Data into Verdana Systems, including the measures described in Section 3.5 of the Protocol.
I declare under penalty of perjury under the laws of the State of Delaware and the United States of America that the foregoing is true and correct to the best of my knowledge, information, and belief, and that I am authorized to execute this certification on behalf of Verdana.
Executed on this _ day of ___, 2025.
VERDANA COMMERCE GROUP, INC.
By: ________
Name: ________
Title: ________
NOTARY ACKNOWLEDGMENT
STATE OF ______ )
) ss.
COUNTY OF ______ )
On this _ day of ___, 2025, before me, the undersigned notary public, personally appeared ______, known to me (or proved to me on the basis of satisfactory evidence) to be the person whose name is subscribed to the within instrument, and who, being by me duly sworn, stated that he/she is the ______ of Verdana Commerce Group, Inc., the corporation described in and which executed the within instrument, and acknowledged to me that such corporation executed the same by authority of its Board of Directors, and that by his/her signature on the instrument, he/she executed this certification on behalf of said corporation voluntarily and under penalty of perjury.
WITNESS my hand and official seal.
________________________________________
Notary Public My Commission Expires: ____
This certification may be executed by any of the following authorized officers of Verdana Commerce Group, Inc.: Helen Tsoi, General Counsel; Warren Dietrich, Chief Executive Officer; or such other officer as may be designated by the Board of Directors of Verdana for this purpose.
Covered System | Deletion Method | Software/Tool Used | Date Completed
________ | ________ | ________ | ____
________ | ________ | ________ | ____
________ | ________ | ________ | ____
________ | ________ | ________ | ____
________ | ________ | ________ | ____

EXHIBIT B

DATA RETURN AND DESTRUCTION PROTOCOL

ANNEX B-1

CERTIFICATION OF COMPLIANCE WITH DATA RETURN AND DESTRUCTION PROTOCOL

NOTARY ACKNOWLEDGMENT

ANNEX B-2

Record

Parties

Dates

Amounts