1038-00009 · Client 1038 · Diligence

data-privacy-cybersecurity-due-diligence-memo.docx DOCUMENT M&A / Corporate

39 / 83 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 599 Lexington Avenue, 38th Floor New York, NY 10022

MEMORANDUM

TO: Elena Vasquez-Bright, General Counsel, Cascade Retail Holdings Inc. Theodore "Ted" Langford, SVP, Corporate Development, Cascade Retail Holdings Inc.

FROM: Tiffany Rosenthal, Partner, Calderwood & Harkness LLP Derek Okonkwo, Senior Associate, Calderwood & Harkness LLP

CC: Harrison Wexford, Partner, Calderwood & Harkness LLP Beatrice Holloway, Associate, Calderwood & Harkness LLP

DATE: April 2, 2025

RE: Data Privacy and Cybersecurity Due Diligence — NovaMart Global Inc. (Project CascadeNova)

MATTER: Cascade Retail Holdings Inc. — Acquisition of NovaMart Global Inc.

Right-click to update Table of Contents

I. Executive Summary

This memorandum summarizes the principal findings from Calderwood & Harkness LLP's review of the data privacy practices, cybersecurity posture, and compliance profile of NovaMart Global Inc. ("NovaMart" or the "Company") with applicable privacy and data security laws and regulations, conducted in connection with Cascade Retail Holdings Inc.'s ("Cascade") proposed acquisition of one hundred percent (100%) of the outstanding capital stock of NovaMart for an aggregate purchase price of $1,200,000,000 (the "Transaction"). This memorandum has been prepared at the request of Cascade's General Counsel and is protected by the attorney-client privilege and the work product doctrine.

NovaMart is a privately held corporation organized under the laws of the State of Delaware and headquartered at 1100 Congress Avenue, Suite 800, Austin, Texas 78701. The Company operates an online marketplace platform that connects buyers and sellers of consumer goods, home décor, electronics, apparel, and related categories. As of the date of this memorandum, NovaMart maintains approximately 9.1 million registered buyer accounts and approximately 62,400 active seller accounts on its platform. In addition to its marketplace operations, NovaMart operates a proprietary logistics network branded "NovaShip," which encompasses fourteen (14) fulfillment centers distributed across nine (9) states: California (3 facilities), New Jersey (2), Georgia (2), Florida (2), Ohio (1), Illinois (1), Pennsylvania (1), Tennessee (1), and Washington (1). The physical distribution of these fulfillment centers creates data touchpoints in multiple jurisdictions and implicates a correspondingly broad range of state privacy, data protection, and biometric information laws.

For fiscal year 2024, NovaMart reported gross merchandise value ("GMV") of approximately $6.2 billion and total revenue of approximately $891 million, comprising marketplace take-rate revenue, advertising revenue (generated in partnership with Stratton Digital Media Inc.), and logistics services revenue from NovaShip operations.

Overall Assessment. Based on our review of the materials described in Section II below, including interviews with NovaMart's General Counsel, Amanda Trevino, and its Co-Founder and Chief Technology Officer, Priya Narasimhan, we conclude that NovaMart maintains a generally mature and adequate data privacy and cybersecurity program. The Company has implemented written policies and procedures, maintains a dedicated security function, has obtained SOC 2 Type II reports for the past two fiscal years, and has executed data processing agreements with its most significant vendors. However, our review has identified certain areas that require attention and potential remediation, both prior to and following the closing of the Transaction. These areas include, most notably: (i) the classification of NovaMart's data-sharing arrangement with Stratton Digital Media Inc. under the California Consumer Privacy Act ("CCPA") "sale" and "sharing" provisions; (ii) the Company's compliance with the Illinois Biometric Information Privacy Act ("BIPA") at its Illinois fulfillment center; (iii) gaps in the Company's multi-state breach notification compliance infrastructure; and (iv) considerations relating to the post-closing integration of NovaMart's customer data with Cascade's existing CascadeDirect.com customer database. Each of these issues, along with other findings, is discussed in detail in the body of this memorandum.

Cross-References. This memorandum should be read in conjunction with the following related due diligence memoranda prepared by Calderwood & Harkness LLP and its advisors in connection with the Transaction:

• IP Due Diligence Memorandum — addressing open-source software components and data-integrated intellectual property assets;

• Material Contracts Due Diligence Memorandum — addressing data-sharing provisions in key vendor and partner agreements, including the approximately thirty-four (34) contracts with change of control provisions;

• Insurance Due Diligence Memorandum — addressing cyber insurance coverage, including the scope and adequacy of NovaMart's current cyber liability insurance program;

• Litigation and Regulatory Due Diligence Memorandum — addressing any privacy-related enforcement actions, regulatory investigations, or pending or threatened litigation; and

• Due Diligence Summary and Risk Assessment Memorandum — prepared by Harrison Wexford and Derek Okonkwo, providing an integrated risk assessment across all diligence workstreams.

Materials Reviewed. In preparing this memorandum, our team reviewed a comprehensive set of documents and materials provided by NovaMart through the virtual data room maintained by Calloway, Brandt & Loewe LLP ("Seller's Counsel"), including NovaMart's privacy policies, terms of service, data processing agreements, information security policies, SOC 2 Type II reports, penetration test results, incident response plans, breach notification logs, vendor security assessment records, and employee training records. We also conducted interviews with Amanda Trevino (General Counsel) and Priya Narasimhan (Co-Founder & CTO) on March 14 and March 21, 2025, respectively. A complete index of all documents reviewed is set forth in Appendix A to this memorandum.

II. Scope of Review

A. Documents and Materials Reviewed

In connection with our data privacy and cybersecurity due diligence review, Calderwood & Harkness reviewed the following categories of documents and materials, each of which was produced by NovaMart through the virtual data room administered by Calloway, Brandt & Loewe LLP (Richard Calloway and Simone Adesanya, counsel for the Seller). A detailed index of all documents reviewed, including data room reference numbers, is attached hereto as Appendix A.

1. Public-Facing Privacy Policy. NovaMart's privacy policy as published on its website (www.novamart.com/privacy) and within its mobile application (iOS and Android), including the current version (effective January 15, 2025) and archived versions dating back to the Company's initial launch in 2016. We reviewed a total of seven (7) versions of the privacy policy reflecting material updates over the Company's operating history.

2. Public-Facing Terms of Service. NovaMart's terms of service governing both buyer and seller use of the platform, including the current buyer terms of service (effective March 1, 2024), the current seller terms of service (effective March 1, 2024), and prior versions thereof.

3. Internal Data Governance Policy and Data Classification Framework. NovaMart's internal data governance policy (version 3.2, last updated September 2024) and the Company's data classification framework, which categorizes data into four tiers: Public, Internal, Confidential, and Restricted.

4. Data Processing Agreements (DPAs). Data processing agreements and related data security addenda executed between NovaMart and its key third-party vendors and partners, including:

(a) Pinnacle Cloud Solutions Inc. ("Pinnacle Cloud") — cloud hosting and infrastructure services;

(b) PayStream Financial Technologies Inc. ("PayStream") — payment processing services;

(d) Arcwave Software LLC ("Arcwave") — technology licensor for proprietary search algorithm;

(e) Redline Freight Corp. ("Redline Freight") — logistics and shipping partner for NovaShip operations; and

(f) Approximately twenty-three (23) additional DPAs with smaller vendors and service providers, as listed in Appendix A.

5. Information Security Policy Suite. NovaMart's information security policies, including the following individual policies and procedures documents:

(a) Acceptable Use Policy (version 2.1, effective July 2024);

(b) Access Control Policy (version 3.0, effective October 2024);

(d) Incident Response Plan (version 4.0, effective November 2024);

(e) Business Continuity and Disaster Recovery Plan (version 2.0, effective August 2024); and

(f) Data Retention and Destruction Policy (version 1.8, effective May 2024).

6. SOC 2 Type II Audit Reports. SOC 2 Type II reports issued by Severin Beck CPAs LLP for fiscal years 2023 and 2024, covering the trust service criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy as applied to NovaMart's marketplace platform and supporting infrastructure.

7. Penetration Testing and Vulnerability Assessment Reports. Reports from external penetration testing and vulnerability assessments conducted within the last twelve (12) months, including a comprehensive external penetration test conducted by Blackpoint Security Partners LLC in October 2024 and quarterly automated vulnerability scans performed using internal and third-party scanning tools.

8. Data Breach and Security Incident Logs. NovaMart's internal breach and security incident log covering the five-year period from January 2020 through March 2025, including incident reports, root cause analyses, notification records, and remediation documentation.

9. Employee and Contractor Training Materials and Records. Materials from NovaMart's mandatory annual data privacy and security awareness training program, including training content, completion records, and phishing simulation results for calendar years 2023 and 2024.

10. Privacy Impact Assessments / Data Protection Impact Assessments. Records of privacy impact assessments conducted by NovaMart's legal and compliance team in connection with new product features, data collection practices, and third-party data sharing arrangements. We reviewed a total of nine (9) PIAs completed between 2022 and 2025.

11. Cookie Consent Management Platform. Configuration documentation and operational records for NovaMart's cookie consent management platform (operated through Sundial Solutions), including cookie categorization, consent collection mechanisms, and opt-out functionality.

12. Data Subject Access Request (DSAR) Logs and Procedures. NovaMart's DSAR intake and response procedures and logs documenting all DSARs received and processed from January 2023 through March 2025.

13. Regulatory Correspondence. All correspondence between NovaMart and federal or state regulators relating to privacy or data security matters, including correspondence with the Federal Trade Commission ("FTC"), state attorneys general, and other regulatory authorities.

14. Cyber Insurance Policy. NovaMart's cyber liability insurance policy details (reviewed in detail in the Insurance Due Diligence Memorandum; referenced herein for coverage scope and adequacy).

15. Management Interviews. Interviews conducted by Calderwood & Harkness with the following NovaMart personnel:

(a) Priya Narasimhan, Co-Founder & Chief Technology Officer — interviewed on March 14, 2025 (in-person at NovaMart's Austin headquarters), covering cybersecurity architecture, technical controls, vendor management, and incident response capabilities; and

(b) Amanda Trevino, General Counsel — interviewed on March 21, 2025 (video conference), covering privacy policy development and maintenance, regulatory compliance, litigation history, DSAR processing, and data governance.

B. Scope Limitations

The following limitations apply to the scope of our review and should be taken into account when evaluating the findings and assessments set forth in this memorandum:

1. Outstanding Data Room Items. As of the date of this memorandum, certain documents requested by Calderwood & Harkness through the virtual data room have not yet been produced by NovaMart or Seller's Counsel (Calloway, Brandt & Loewe LLP, Richard Calloway / Simone Adesanya). Specifically, we are awaiting production of: (a) complete DPA documentation for four (4) mid-tier vendors identified in NovaMart's vendor registry; (b) the Company's written biometric data retention and destruction schedule applicable to the Illinois fulfillment center; (c) detailed configuration documentation for the Company's SIEM (Security Information and Event Management) platform; and (d) records of any privacy or security-related complaints filed by consumers directly with NovaMart (as distinct from regulatory inquiries). We have communicated these outstanding requests to Simone Adesanya on March 28, 2025, and will supplement this memorandum upon receipt of additional materials.

2. No Independent Technical Assessment. Calderwood & Harkness did not conduct independent technical penetration testing, vulnerability scanning, source code review, or any other form of independent technical security assessment of NovaMart's systems, applications, or infrastructure. Our assessment of NovaMart's cybersecurity posture is based solely on our review of the Company's existing third-party assessment reports (including the Blackpoint Security Partners LLC penetration test and Severin Beck CPAs LLP SOC 2 Type II reports), the Company's internal policies and documentation, and statements made by NovaMart personnel during management interviews. Should Cascade desire an independent technical assessment, we recommend engaging a qualified cybersecurity firm to conduct such testing prior to or promptly following closing.

3. No On-Site Inspection. Calderwood & Harkness did not conduct on-site inspections of any NovaMart data centers, fulfillment centers, or corporate offices. Our review of physical security controls and physical data handling practices at the Company's fourteen (14) fulfillment centers and its corporate headquarters is limited to documentary evidence and management representations.

4. Reliance on Representations. Certain factual statements contained in this memorandum are based on representations made by NovaMart's management during interviews and in responses to our due diligence questionnaire. We have not independently verified all such representations, and our findings are subject to the accuracy and completeness of the information provided to us.

III. Nature and Volume of Data Collected and Processed

NovaMart collects, processes, stores, and shares a substantial volume of personal data across multiple categories of data subjects. The following sections describe the principal categories of personal data maintained by NovaMart, the approximate volumes thereof, and the data flows associated with the Company's operations. A visual representation of NovaMart's data flows is set forth in Appendix C (NovaMart Data Flow Diagram).

A. Categories of Personal Data — Registered Buyers (Approximately 9.1 Million)

NovaMart collects and processes the following categories of personal data from its registered buyer base of approximately 9.1 million accounts:

1. Account Registration Data. Full legal name, email address, telephone number, mailing and/or shipping address(es), and date of birth (collected on an optional basis for age-verification and promotional purposes). NovaMart also collects account credentials (username and hashed password).

2. Payment Card and Financial Account Information. Credit card numbers, debit card numbers, and associated billing information. This data is processed through NovaMart's payment processor, PayStream Financial Technologies Inc. NovaMart represents that it does not store full payment card numbers (primary account numbers, or "PANs") on its own systems and instead relies on PayStream's tokenization infrastructure. NovaMart does retain truncated card numbers (last four digits) and transaction reference tokens for order management and customer service purposes.

3. Transaction and Order Data. Complete transaction history, including order details, product descriptions, quantities, pricing, shipping addresses, delivery status, and return and refund records. NovaMart retains historical transaction data spanning from the Company's founding in 2016 to the present.

4. Browsing, Search, and Behavioral Data. Search queries, product browsing history, clickstream data, time-on-page metrics, product reviews and ratings authored by buyers, wish list and favorites data, and cart abandonment data. This data is used for personalization, recommendation algorithms, and advertising purposes.

5. Device and Technical Data. Device identifiers (including mobile advertising identifiers such as IDFA and GAID), IP addresses, browser type and version, operating system, geolocation data (derived from IP address and, where permitted, GPS data from mobile devices), and cookies and tracking technologies. NovaMart deploys first-party cookies and, through its advertising partnership with Stratton Digital Media Inc., certain third-party cookies and tracking pixels.

6. Customer Service Communications. Records of customer service interactions, including email correspondence, live chat transcripts, and telephone call recordings and transcripts. NovaMart's customer service operations are conducted in-house from its Austin headquarters, with overflow support provided by a third-party customer service vendor.

7. Marketing Preferences. Records of marketing opt-in and opt-out elections, email subscription preferences, SMS marketing consent records, and push notification preferences.

Estimated Volume and Historical Depth: NovaMart maintains approximately 9.1 million registered buyer profiles. Historical transaction data spans from the Company's launch in 2016 to the present, representing approximately nine years of accumulated buyer activity data. NovaMart estimates that its buyer database contains in excess of 180 million individual transaction records.

B. Categories of Personal Data — Active Sellers (Approximately 62,400)

NovaMart collects and processes the following categories of personal data from its active seller base of approximately 62,400 accounts. NovaMart also retains data for an additional approximately 18,700 inactive or closed seller accounts.

1. Business and Individual Identity Information. Seller name (individual or business entity name), business address, primary contact name, email address, telephone number, and website URL. For individual sellers (sole proprietors), this includes the individual's legal name and personal address.

2. Tax Identification and Financial Information. Employer Identification Number (EIN) or Social Security Number (SSN) for tax reporting purposes, bank account information (routing number and account number) for disbursement of seller proceeds, and W-9 certification data. NovaMart issues IRS Form 1099-K to sellers meeting applicable reporting thresholds.

3. Tax Documentation. Completed IRS Form W-9 (or W-8BEN/W-8BEN-E for non-U.S. sellers, though the platform is primarily U.S.-focused), copies of issued 1099-K forms, and associated tax correspondence.

4. Sales Performance and Platform Data. Sales volume and revenue data, product listing information and catalog data, seller ratings and reviews, seller performance metrics, and communications between sellers and NovaMart (including policy compliance notifications and seller support interactions).

5. Identity Verification Documents. Government-issued photo identification (e.g., driver's license, passport), proof of address documentation, and, for certain high-volume sellers, business registration documents. These documents are collected as part of NovaMart's seller onboarding and identity verification process.

Estimated Volume: Approximately 62,400 active seller accounts plus approximately 18,700 inactive or closed seller accounts, for a total of approximately 81,100 seller profiles maintained in NovaMart's systems.

C. Categories of Personal Data — Employees (Approximately 2,400)

NovaMart employs approximately 2,400 individuals across its corporate headquarters in Austin, Texas and its fourteen (14) NovaShip fulfillment centers. The Company collects and processes the following categories of employee personal data:

1. Standard Human Resources Data. Full legal name, home address, Social Security Number, date of birth, compensation and payroll information, benefits enrollment records, direct deposit banking information, performance reviews and disciplinary records, and background check results (conducted at hire for all employees).

2. Fulfillment Center Employee Data — Biometric Data. At certain NovaShip fulfillment centers, NovaMart collects biometric data in the form of fingerprint scans or badge-based biometric scans for timekeeping and access control purposes. Based on our review, biometric data collection currently occurs at the following facilities:

(a) NovaMart Fulfillment Center — Joliet, IL (fingerprint scan for timekeeping);

(b) NovaMart Fulfillment Center — Edison, NJ (fingerprint scan for timekeeping); and

The collection of fingerprint biometric data at the Joliet, Illinois fulfillment center is of particular significance because it triggers compliance obligations under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. ("BIPA"), which is discussed in detail in Section V.C below.

3. Workplace Surveillance Data. Video surveillance footage from security cameras installed at fulfillment centers and corporate offices, badge swipe access logs, and, at certain facilities, vehicle license plate recognition data for parking access.

D. Data Flows and Storage

NovaMart's data flows across multiple internal and external systems, as depicted in the Data Flow Diagram attached as Appendix C. The principal data flows and storage configurations are summarized below.

1. Primary Data Hosting — Pinnacle Cloud Solutions Inc. NovaMart's marketplace platform, including the buyer and seller databases, transaction data, and application infrastructure, is hosted on cloud infrastructure provided by Pinnacle Cloud Solutions Inc. ("Pinnacle Cloud"), headquartered in Redmond, Washington. Pinnacle Cloud operates data centers located exclusively within the United States. Based on our review of the Pinnacle Cloud Master Services Agreement and associated DPA, NovaMart's data is hosted in Pinnacle Cloud's US-West (Oregon) and US-East (Virginia) regions, with geographic redundancy. No offshore data storage was identified in our review.

2. Payment Data — PayStream Financial Technologies Inc. Payment card data is tokenized at the point of entry and processed through PayStream Financial Technologies Inc. ("PayStream"). PayStream is a PCI DSS Level 1 certified payment processor. NovaMart represents that it does not store, process, or transmit full primary account numbers on its own systems; all payment card data is handled within PayStream's PCI-compliant environment, with NovaMart retaining only tokenized references and truncated card numbers.

3. Advertising Data — Stratton Digital Media Inc. NovaMart shares certain buyer behavioral data with Stratton Digital Media Inc. ("Stratton Digital") under a Data Sharing and Advertising Revenue Agreement for the purpose of enabling targeted advertising on and off the NovaMart platform. The categories of data shared with Stratton Digital include hashed email addresses, browsing and purchase history segments, device identifiers, and cookie data. The implications of this data sharing under the CCPA are discussed in detail in Sections IV.A and V.B below.

4. Logistics and Shipping Data — Redline Freight Corp. NovaMart shares buyer shipping data with Redline Freight Corp. ("Redline Freight") for the purpose of order fulfillment through the NovaShip logistics network. Data shared includes buyer name, shipping address, order reference number, and package contents descriptions. The DPA with Redline Freight includes a provision requiring deletion of buyer personal data within ninety (90) days of delivery confirmation, though our review identified no mechanism for NovaMart to verify compliance with this obligation.

5. Data Retention Policy. NovaMart's Data Retention and Destruction Policy (version 1.8, effective May 2024) provides for the following retention periods:

(a) Buyer data: Retained for seven (7) years following the date of the buyer's last activity on the platform (last login, purchase, or customer service interaction);

(b) Seller data: Retained for seven (7) years following the date of seller account closure, which NovaMart represents is driven primarily by IRS record retention requirements for 1099-K reporting purposes; and

(c) Employee data: Retained for the duration of employment and for seven (7) years following termination, subject to longer retention periods for certain categories of data required by applicable employment laws.

We note that the seven-year buyer data retention period, while reasonable for transaction records linked to tax and financial reporting, may result in the retention of behavioral and marketing data (browsing history, search queries, device identifiers) well beyond the period necessary for the original purpose of collection. This could present compliance challenges under the CCPA's data minimization principles and, for post-closing integration purposes, under other state privacy laws that impose purpose limitation requirements.

IV. Privacy Policy and Terms of Service Review

A. Public-Facing Privacy Policy

NovaMart maintains a publicly accessible privacy policy on its website (www.novamart.com/privacy) and within its mobile applications. The current version of the privacy policy is dated January 15, 2025, and reflects the most recent substantive revision. Prior to the current version, the privacy policy was updated in March 2024, June 2023, January 2023, August 2021, February 2019, and at the time of the Company's launch in October 2016.

Structure and Comprehensiveness. The current privacy policy is approximately 5,200 words in length and is organized into the following sections: (i) Information We Collect; (ii) How We Use Your Information; (iii) How We Share Your Information; (iv) Your Privacy Rights; (v) Cookies and Tracking Technologies; (vi) Data Security; (vii) Data Retention; (viii) Children's Privacy; (ix) Changes to This Policy; and (x) Contact Us. The policy is written in reasonably plain language and employs a layered disclosure format with expandable sections for detailed information.

Categories of Information and Purposes of Collection. The privacy policy accurately describes the categories of personal information collected by NovaMart, generally consistent with the categories identified in Section III above. The stated purposes of collection include: providing and improving platform services, processing transactions, communicating with users, personalizing user experience, providing targeted advertising, complying with legal obligations, and protecting the security of the platform and its users.

Third-Party Sharing Disclosures. The privacy policy discloses that NovaMart shares personal information with: (i) service providers that assist with platform operations (including cloud hosting, payment processing, and logistics partners); (ii) advertising partners for targeted advertising purposes; (iii) sellers, to the extent necessary to fulfill orders; and (iv) as required by law or in connection with legal proceedings. The policy names Stratton Digital Media Inc. as an advertising partner and notes that data may be shared for "personalized advertising and analytics purposes."

CCPA-Specific Disclosures. The privacy policy includes a dedicated section addressing California residents' rights under the CCPA/CPRA, including the rights to know, delete, correct, opt out of sale/sharing, and limit the use of sensitive personal information. The policy includes a "Do Not Sell or Share My Personal Information" link that directs users to a preference management page.

Assessment of CCPA "Sale" / "Sharing" Disclosures. The privacy policy states that NovaMart "may share certain personal information with advertising partners for targeted advertising purposes" and that such sharing "may be considered a 'sale' or 'sharing' under the California Consumer Privacy Act." We note that while this disclosure is reasonably transparent, NovaMart's current operational practice involves the transmission of hashed email addresses, behavioral data, device identifiers, and cookie data to Stratton Digital Media Inc. in exchange for advertising revenue. Under the CCPA's broad definitions of "sale" (Cal. Civ. Code § 1798.140(ad)) and "sharing" (Cal. Civ. Code § 1798.140(ah)), this arrangement likely constitutes both a "sale" and "sharing" of personal information. NovaMart should ensure that its opt-out mechanisms fully comply with CCPA requirements, including recognition of the Global Privacy Control ("GPC") browser signal, which is required under CPRA regulations. During our interview with Amanda Trevino, she confirmed that NovaMart implemented GPC recognition in Q4 2024, but we were unable to independently verify the technical implementation.

Do Not Sell/Share Link. The privacy policy and NovaMart's website footer include a "Do Not Sell or Share My Personal Information" link as required by Cal. Civ. Code § 1798.135. The link directs users to an opt-out preference page powered by Sundial Solutions. Based on our review of the Bramwell Systems documentation, the opt-out mechanism appears to be functional, though we recommend that Cascade independently verify its operation through user-experience testing.

Children's Privacy (COPPA). NovaMart's terms of service require that all users be at least eighteen (18) years of age to register for an account or make purchases on the platform. The privacy policy includes a brief children's privacy section stating that NovaMart "does not knowingly collect personal information from children under the age of 13" and that the Company will delete any such information upon becoming aware of its collection. NovaMart has not implemented a formal COPPA compliance program, including age verification mechanisms beyond the self-certification at account registration. Given the nature of NovaMart's marketplace (consumer goods, home décor, electronics, and apparel), the risk of significant underage user activity is moderate. However, the absence of technical age verification creates residual risk, particularly in light of the FTC's renewed enforcement focus on children's privacy. We recommend that Cascade evaluate whether additional age verification measures are warranted post-closing.

Cookies and Tracking Technologies. The privacy policy describes NovaMart's use of cookies, web beacons, pixels, and similar tracking technologies, and categorizes these technologies as "strictly necessary," "functional," "performance/analytics," and "targeting/advertising." The policy describes the use of third-party advertising cookies placed by Stratton Digital Media Inc. and other advertising network partners. NovaMart's cookie consent management platform, operated through Sundial Solutions, presents a cookie consent banner to website visitors that allows users to accept all cookies, reject non-essential cookies, or manage cookie preferences by category. Based on our review, the cookie consent implementation appears generally adequate, though we note that the consent banner defaults to a "Reject All" button configuration for California users — a practice consistent with CCPA/CPRA requirements but not universally implemented across all jurisdictions.

Adequacy Assessment. Overall, NovaMart's privacy policy is reasonably comprehensive and reflects a generally mature approach to privacy disclosures. The policy addresses the principal categories of personal information collected, the purposes of processing, third-party sharing, and consumer rights. The CCPA-specific disclosures are substantively adequate, though we have identified the following areas for improvement:

(a) The privacy policy does not specifically enumerate all categories of "sensitive personal information" collected (as defined under CPRA), including precise geolocation data and financial account information combined with access codes;

(b) The data retention section provides general statements about retention periods but does not specify retention periods for each category of personal information, as increasingly expected by state regulators;

(c) The privacy policy does not include specific disclosures addressing the rights of consumers under state privacy laws other than the CCPA (e.g., Virginia VCDPA, Colorado CPA, Texas TDPSA), relying instead on a general statement that NovaMart "complies with applicable state privacy laws"; and

(d) The "Changes to This Policy" section states that NovaMart "may update this privacy policy from time to time" and will notify users of "material changes" via email or platform notification, but does not define what constitutes a "material change" or provide a specific notice period.

B. Terms of Service

Data Licensing — Seller Terms. NovaMart's seller terms of service include a broad data licensing provision under which sellers grant NovaMart a "non-exclusive, worldwide, royalty-free, sublicensable, transferable license to use, reproduce, modify, distribute, display, and create derivative works from" all data and content uploaded by sellers to the platform, including product listings, images, descriptions, and seller profile information. This license survives account termination. While this provision is common among marketplace platforms, its breadth — particularly the "sublicensable" and "transferable" elements — should be considered in the context of post-closing data integration and any potential monetization of seller data by Cascade.

Buyer Consent Provisions. NovaMart's buyer terms of service include a consent provision under which buyers consent to the collection and processing of personal information as described in the privacy policy. The consent is obtained through a clickwrap mechanism at account registration, requiring buyers to affirmatively check a box confirming that they have read and agree to the terms of service and privacy policy. This consent mechanism is generally adequate for purposes of federal and state privacy law, though it relies on the privacy policy's disclosures being complete and accurate.

Arbitration and Dispute Resolution. Both the buyer and seller terms of service include mandatory binding arbitration clauses administered by JAMS, with a class action waiver. The arbitration clause applies to "any dispute arising out of or relating to these Terms, the Services, or your use of the Platform, including any dispute regarding the collection, use, or disclosure of your personal information." This arbitration provision may limit the exposure to class action litigation arising from privacy-related claims, though we note that the CCPA private right of action for data breaches (Cal. Civ. Code § 1798.150) has been held to be subject to arbitration in certain circumstances, while other courts have found such waivers unenforceable as applied to statutory privacy claims. The enforceability of the arbitration clause may vary by jurisdiction.

Assignment and Change of Control. NovaMart's terms of service include a provision permitting NovaMart to assign its rights and obligations under the terms of service "in connection with a merger, acquisition, reorganization, or sale of all or substantially all of [NovaMart's] assets, without the prior consent of users." This provision is relevant to the Transaction because the stock purchase structure means that NovaMart, as a legal entity, will continue to exist and will continue to be the party to the terms of service. In a stock acquisition, there is no assignment of the terms of service — the entity simply has new ownership. Accordingly, the change of control / assignment provision is unlikely to be triggered by the Transaction, and user notification or re-consent should not be required under the terms of service themselves. However, as discussed in Section IX.A below, this analysis must be considered alongside NovaMart's privacy policy representations regarding business transfers and applicable privacy law requirements.

C. Seller Data Processing Agreement

NovaMart offers a standard Seller Data Processing Agreement ("Seller DPA") to sellers who request one, though execution of the Seller DPA is not mandatory for seller onboarding. As of the date of our review, approximately 12,300 of NovaMart's approximately 62,400 active sellers (approximately 19.7%) have executed the Seller DPA. The remaining sellers are governed solely by the data handling provisions in the seller terms of service.

The Seller DPA addresses NovaMart's handling of seller data, including payment information and tax records, and imposes the following key obligations on NovaMart:

(a) Data security: NovaMart must implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect seller data;

(b) Breach notification: NovaMart must notify affected sellers of a data breach involving seller data "without unreasonable delay and in no event later than seventy-two (72) hours" after becoming aware of the breach;

(c) Data portability: Upon account closure, NovaMart must make available to the seller, in a structured, commonly used, and machine-readable format, a copy of the seller's data maintained on the platform; and

(d) Assignability: The Seller DPA includes a provision permitting assignment by NovaMart "to any successor entity in connection with a merger, acquisition, or reorganization" without seller consent, provided the successor assumes NovaMart's obligations under the Seller DPA.

We note that the low adoption rate of the Seller DPA (approximately 19.7%) means that the majority of sellers are not covered by its enhanced protections. This may present a risk if sellers assert claims related to NovaMart's handling of their data, as the seller terms of service provide fewer specific data protection commitments than the Seller DPA.

V. Applicable Privacy and Data Protection Laws

A. Federal Law

1. FTC Act Section 5

Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, prohibits "unfair or deceptive acts or practices in or affecting commerce." The FTC has used this authority extensively to bring enforcement actions against companies whose data practices are inconsistent with their privacy policy representations or that fail to implement reasonable data security measures. NovaMart's public-facing privacy policy constitutes a set of enforceable commitments, and any material deviation between the Company's stated practices and its actual practices could give rise to FTC enforcement risk.

Based on our review, NovaMart's actual data collection, use, and sharing practices appear generally consistent with the representations made in its privacy policy. However, we have identified two areas of potential concern: (i) the privacy policy's characterization of data sharing with Stratton Digital Media Inc. as being "for analytics and advertising" may understate the full scope of data shared and the purposes for which Stratton Digital uses the data; and (ii) the privacy policy's data security representations ("We use industry-standard security measures to protect your personal information") are broad and could be viewed as deceptive if NovaMart's security practices are found to be deficient in any material respect. We recommend that these disclosures be tightened in a post-closing privacy policy update.

2. CAN-SPAM Act

The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, 15 U.S.C. §§ 7701–7713, governs commercial email communications. NovaMart's marketing emails, based on our review of sample emails provided in the data room, include the required elements: accurate sender identification, a physical mailing address, clear identification as advertising, and a functioning opt-out mechanism. NovaMart represents that opt-out requests are processed within seven (7) business days, within the statutory ten-business-day maximum. We did not identify material CAN-SPAM compliance deficiencies.

3. COPPA. The Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the FTC's implementing regulations at 16 C.F.R. Part 312, impose requirements on operators of websites and online services directed to children under 13, or that have actual knowledge of collecting personal information from children under 13. NovaMart's terms of service require users to be at least 18 years of age, and the platform is not directed to children. However, NovaMart does not employ age-gating or age verification technology beyond self-certification at account registration. Given the consumer goods nature of NovaMart's marketplace, which includes categories such as toys, games, and children's apparel, there is a residual risk that children under 13 may access and use the platform. The absence of a formal COPPA compliance program, including verifiable parental consent mechanisms, represents a low-to-moderate risk. We note that the FTC has signaled increased scrutiny of platforms that fail to take adequate steps to prevent the collection of children's data, even when the platform is not specifically directed to children.

4. Gramm-Leach-Bliley Act

The Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, and its implementing regulations apply to "financial institutions," a term defined broadly to include entities that are "significantly engaged" in financial activities. NovaMart is not a financial institution within the meaning of the GLBA. However, NovaMart's handling of payment card data through PayStream, its maintenance of seller bank account information for disbursement purposes, and its issuance of IRS Form 1099-K necessitate careful data security practices for financial data. NovaMart's payment data handling is addressed through its contractual relationship with PayStream (PCI DSS-certified) and is subject to the data security obligations in the PayStream DPA.

5. Internal Revenue Code / IRS Requirements

NovaMart is subject to IRS Form 1099-K reporting requirements as a third-party settlement organization under Internal Revenue Code § 6050W. NovaMart issues 1099-K forms to sellers meeting applicable reporting thresholds. The Company's collection and retention of seller tax identification information (SSN/EIN) and financial data is driven in part by these reporting obligations, which also inform the Company's seven-year seller data retention period. Coordination with Whitmore & Paige LLP (Sandra Chiu) on tax implications of seller data handling is recommended.

B. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), Cal. Civ. Code §§ 1798.100–1798.199.100, is the most significant state privacy law applicable to NovaMart's operations.

Applicability. NovaMart meets the CCPA's jurisdictional thresholds on multiple grounds:

(a) NovaMart's annual gross revenue for fiscal year 2024 was approximately $891 million, exceeding the $25 million threshold under Cal. Civ. Code § 1798.140(d)(1)(A);

(b) NovaMart annually buys, sells, or shares the personal information of more than 100,000 California consumers, households, or devices (NovaMart estimates that approximately 1.4 million of its 9.1 million registered buyers are California residents), exceeding the threshold under Cal. Civ. Code § 1798.140(d)(1)(B); and

(c) While NovaMart does not derive more than 50% of its annual revenue from selling or sharing consumers' personal information under Cal. Civ. Code § 1798.140(d)(1)(C), the first two grounds are independently sufficient to establish CCPA applicability.

NovaMart's physical presence in California is also significant. The Company operates three (3) fulfillment centers in California (locations in Stockton, Ontario, and San Bernardino), employing approximately 420 workers in the state, which amplifies NovaMart's nexus with California and its exposure to California Privacy Protection Agency ("CPPA") enforcement.

Compliance Assessment. Our assessment of NovaMart's CCPA compliance is as follows:

1. Right to Know / Access (§ 1798.100, 1798.110, 1798.115). NovaMart provides California consumers with the ability to submit requests to know what personal information has been collected, the categories of sources, the business or commercial purposes for collection, the categories of third parties with whom information is shared, and the specific pieces of personal information collected. DSAR requests are submitted through a web form and are verified through a two-step email and account verification process. Based on our review of the DSAR logs, NovaMart received approximately 2,340 requests to know/access in calendar year 2024, with a median response time of twenty-two (22) days — well within the forty-five (45) day statutory deadline.

2. Right to Delete (§ 1798.105). NovaMart provides California consumers with the ability to submit deletion requests. Upon receiving a verified deletion request, NovaMart deletes the consumer's account and associated personal information, subject to exceptions for data required to complete transactions, maintain security, comply with legal obligations, and fulfill internal business purposes. NovaMart received approximately 1,870 deletion requests in calendar year 2024, with a median processing time of eighteen (18) days. We note that NovaMart's seven-year buyer data retention policy may result in the retention of certain data beyond the period necessary to comply with the stated exceptions, and we recommend that Cascade evaluate whether the retention policy should be shortened for categories of data not subject to specific legal retention requirements.

3. Right to Opt Out of Sale/Sharing (§ 1798.120, 1798.121). As discussed above, NovaMart's data sharing with Stratton Digital Media Inc. likely constitutes a "sale" and/or "sharing" of personal information under the CCPA. NovaMart provides a "Do Not Sell or Share My Personal Information" link and opt-out mechanism, and NovaMart represents that it implemented Global Privacy Control (GPC) recognition in Q4 2024. Based on our review, approximately 187,000 California buyers (approximately 13.4% of estimated California buyers) have exercised the opt-out right. This is an area of elevated risk. If NovaMart's data sharing with Stratton Digital is determined to constitute a "sale" and NovaMart's opt-out mechanisms are found to be inadequate or improperly implemented, the Company could face enforcement action by the CPPA or the California Attorney General, as well as private litigation. We recommend that Cascade conduct an independent technical assessment of the opt-out mechanism's effectiveness.

4. Right to Correct (§ 1798.106). NovaMart provides a mechanism for consumers to correct inaccurate personal information through their account settings page and through DSAR submissions. This right appears to be adequately implemented.

5. Right to Limit Use of Sensitive Personal Information (§ 1798.121). NovaMart collects certain categories of sensitive personal information, including precise geolocation data (from mobile app users who grant location access), financial account information (truncated payment card data and transaction data), and account log-in credentials. NovaMart provides a "Limit the Use of My Sensitive Personal Information" link on its website, consistent with CPRA requirements. The implementation of this right appears adequate.

6. Non-Discrimination (§ 1798.125). NovaMart's privacy policy includes a non-discrimination statement, and we did not identify evidence of discriminatory practices against consumers who exercise their privacy rights.

7. Service Provider and Contractor Agreements. The CCPA requires that businesses enter into contracts with service providers and contractors that process personal information on the business's behalf, restricting the service provider's or contractor's use of personal information to the business purposes specified in the contract. We reviewed the DPAs with NovaMart's five key vendors (Pinnacle Cloud, PayStream, Stratton Digital, Redline Freight, and Arcwave) and found them generally consistent with CCPA requirements, with one notable exception: the DPA with Arcwave Software LLC does not include the specific CCPA service provider contractual provisions required by Cal. Civ. Code § 1798.100(d). We recommend that this DPA be updated to include CCPA-compliant terms.

CCPA Private Right of Action (§ 1798.150). California consumers have a private right of action for data breaches involving unencrypted and unredacted personal information resulting from a business's failure to implement and maintain reasonable security procedures and practices. Given the volume of California buyer data maintained by NovaMart (estimated 1.4 million California buyers), a data breach involving unencrypted personal information could expose NovaMart to significant statutory damages (between $100 and $750 per consumer per incident, or actual damages, whichever is greater). NovaMart's data security practices, as discussed in Section VI below, appear generally reasonable, but the risk of a qualifying breach cannot be eliminated.

C. Other State Privacy Laws

NovaMart's nationwide operations and user base implicate comprehensive state privacy laws in multiple jurisdictions. The following is a summary of the most significant state privacy laws applicable to NovaMart's operations, with a complete state-by-state analysis set forth in Appendix B.

1. Texas Data Privacy and Security Act (TDPSA)

The Texas Data Privacy and Security Act, Tex. Bus. & Com. Code §§ 541.001–541.205, is particularly relevant given NovaMart's headquarters in Austin, Texas and its substantial operational nexus with the state. The TDPSA, effective July 1, 2024, applies to entities that conduct business in Texas, process or engage in the sale of personal data, and are not classified as small businesses under the Small Business Administration's definition. NovaMart clearly exceeds these thresholds. NovaMart must comply with the TDPSA's requirements for consumer rights (access, correction, deletion, opt-out of targeted advertising and sale of personal data), privacy notices, data protection assessments, and contractual obligations with processors. Based on our review, NovaMart has not yet updated its privacy policy to include Texas-specific consumer rights disclosures, which we identify as an area requiring prompt remediation.

2. Virginia Consumer Data Protection Act (VCDPA)

The Virginia Consumer Data Protection Act, Va. Code §§ 59.1-575–59.1-585, applies to entities that control or process the personal data of at least 100,000 Virginia consumers or that control or process the personal data of at least 25,000 Virginia consumers and derive over 50% of gross revenue from the sale of personal data. NovaMart estimates that it has approximately 430,000 registered buyers in Virginia, well above the 100,000 threshold. NovaMart appears to comply with the VCDPA's core requirements but has not conducted a formal compliance gap assessment specific to Virginia.

3. Colorado Privacy Act (CPA) and Connecticut Data Privacy Act (CTDPA)

Both the Colorado Privacy Act and the Connecticut Data Privacy Act impose requirements similar to the VCDPA, including consumer rights, purpose limitation, data minimization, and opt-out rights for targeted advertising and sale of personal data. NovaMart's user base in both states exceeds applicable thresholds. NovaMart's privacy program appears generally consistent with these laws' requirements, though state-specific compliance assessments have not been formally documented.

4. Illinois Biometric Information Privacy Act (BIPA)

The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq., is of specific and material concern in connection with this Transaction. BIPA is the most stringent biometric privacy law in the United States and provides a private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation.

As described in Section III.C above, NovaMart collects fingerprint biometric data from employees at its Joliet, Illinois NovaShip fulfillment center for timekeeping purposes. BIPA requires that before collecting biometric identifiers or biometric information, a private entity must:

(a) Inform the subject in writing that a biometric identifier or biometric information is being collected or stored;

(b) Inform the subject in writing of the specific purpose and length of time for which a biometric identifier or biometric information is being collected, stored, and used;

(d) Publish a publicly available written retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.

During our interview with Amanda Trevino, she confirmed that NovaMart requires new employees at the Joliet facility to sign a biometric consent form as part of the onboarding process. However, we were unable to confirm the following based on the documents currently available in the data room:

(a) Whether the written consent form fully complies with BIPA's requirements (including disclosure of the specific purpose and length of time for collection);

(b) Whether all current and former employees at the Joliet facility have executed the required written release (NovaMart's General Counsel acknowledged that the consent form was introduced in mid-2023, but the Joliet facility has been operational since early 2022, creating a gap period of approximately eighteen months); and

(c) Whether NovaMart has published a written biometric data retention schedule and destruction guidelines as required by BIPA § 15(a).

The BIPA exposure is potentially significant. The Joliet facility currently employs approximately 145 workers, and an estimated additional 60 workers were employed at the facility during the gap period before the consent form was introduced. Under BIPA's statutory damages framework, the potential exposure for the pre-consent gap period alone could range from approximately $60,000 (at $1,000 per negligent violation for 60 workers) to $300,000 (at $5,000 per intentional violation for 60 workers), and potentially significantly higher if claims are asserted on a per-scan basis (each fingerprint scan could constitute a separate violation). Recent Illinois Supreme Court precedent, Cothron v. White Castle System, Inc., 2023 IL 128004, held that a separate BIPA claim accrues with each individual scan, though the Illinois legislature subsequently enacted amendments moderating damages calculations. We have requested NovaMart's biometric data consent records and retention schedule through the data room and are awaiting production.

We flag this as a high-priority issue requiring prompt remediation and disclosure in the Seller's Disclosure Schedules.

5. Other State Privacy Laws

Additional state comprehensive privacy laws enacted and effective as of the date of this memorandum, including those in Oregon, Montana, Utah, New Hampshire, New Jersey, Delaware, Iowa, Nebraska, and Maryland, impose varying requirements. NovaMart has not conducted formal compliance assessments for each of these individual state laws. We recommend that Cascade prioritize a comprehensive multi-state compliance gap assessment post-closing. A summary table of applicable state privacy laws is set forth in Appendix B.

6. New Jersey Consumer Protection Statutes

NovaMart operates two fulfillment centers in New Jersey (Edison and Secaucus). The New Jersey Consumer Fraud Act, N.J.S.A. 56:8-1 et seq., and New Jersey's recently enacted comprehensive privacy law, both apply to NovaMart's data practices. The New Jersey Attorney General's Office has been active in data privacy enforcement, and NovaMart's New Jersey operations create a meaningful enforcement nexus.

D. State Data Breach Notification Laws

NovaMart collects personal information from residents of all fifty (50) states, the District of Columbia, and U.S. territories. As a result, the Company is subject to data breach notification laws in each of these jurisdictions. The specific requirements of these laws vary considerably, including with respect to:

(a) Definition of "personal information" triggering notification — some states (e.g., California, Illinois, Texas) define personal information broadly to include health information, biometric data, and online account credentials, while others maintain narrower definitions;

(b) Notification timelines — ranging from "without unreasonable delay" to specific deadlines (e.g., sixty (60) days in California, thirty (30) days in Colorado, as soon as practicable and within sixty (60) days in Texas);

(c) Notification recipients — including affected individuals, state attorneys general, and in some cases consumer reporting agencies; and

(d) Content requirements — varying requirements for the information that must be included in breach notification letters.

NovaMart's incident response plan (discussed in Section VII.B below) includes a multi-state breach notification protocol that maps notification requirements across jurisdictions. However, based on our review, the notification protocol has not been updated since June 2024 and does not reflect recent amendments to breach notification laws in several states. We recommend that the protocol be updated to reflect current law as a post-closing remediation priority.

The states with the most stringent breach notification requirements, and thus the highest enforcement exposure for NovaMart, include California, New York, Texas, Illinois, Massachusetts, and Colorado. NovaMart's estimated user concentrations in these states are:

E. Payment Card Industry Data Security Standard (PCI DSS)

NovaMart is subject to PCI DSS compliance requirements as a merchant that accepts payment card transactions. The Company's payment card processing is handled primarily through PayStream Financial Technologies Inc., which is a PCI DSS Level 1 certified service provider. NovaMart is classified as a Level 2 merchant (processing between 1 million and 6 million card transactions annually) under the payment card brand rules.

Based on our review and management representations, NovaMart does not store, process, or transmit full primary account numbers (PANs) on its own systems. All payment card data is tokenized at the point of entry by PayStream's payment gateway, and NovaMart retains only tokenized references and the last four digits of card numbers. This architecture significantly reduces NovaMart's PCI DSS compliance scope. NovaMart completes an annual PCI DSS Self-Assessment Questionnaire (SAQ A-EP), reflecting its status as an e-commerce merchant that partially outsources payment processing.

NovaMart's most recent SAQ A-EP, completed in November 2024, did not identify any material compliance deficiencies. We note, however, that SAQ A-EP is a self-assessment in

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 599 Lexington Avenue, 38th Floor New York, NY 10022
MEMORANDUM
TO: Elena Vasquez-Bright, General Counsel, Cascade Retail Holdings Inc. Theodore "Ted" Langford, SVP, Corporate Development, Cascade Retail Holdings Inc.
FROM: Tiffany Rosenthal, Partner, Calderwood & Harkness LLP Derek Okonkwo, Senior Associate, Calderwood & Harkness LLP
CC: Harrison Wexford, Partner, Calderwood & Harkness LLP Beatrice Holloway, Associate, Calderwood & Harkness LLP
DATE: April 2, 2025
RE: Data Privacy and Cybersecurity Due Diligence — NovaMart Global Inc. (Project CascadeNova)
MATTER: Cascade Retail Holdings Inc. — Acquisition of NovaMart Global Inc.
Right-click to update Table of Contents
I. Executive Summary
This memorandum summarizes the principal findings from Calderwood & Harkness LLP's review of the data privacy practices, cybersecurity posture, and compliance profile of NovaMart Global Inc. ("NovaMart" or the "Company") with applicable privacy and data security laws and regulations, conducted in connection with Cascade Retail Holdings Inc.'s ("Cascade") proposed acquisition of one hundred percent (100%) of the outstanding capital stock of NovaMart for an aggregate purchase price of $1,200,000,000 (the "Transaction"). This memorandum has been prepared at the request of Cascade's General Counsel and is protected by the attorney-client privilege and the work product doctrine.
NovaMart is a privately held corporation organized under the laws of the State of Delaware and headquartered at 1100 Congress Avenue, Suite 800, Austin, Texas 78701. The Company operates an online marketplace platform that connects buyers and sellers of consumer goods, home décor, electronics, apparel, and related categories. As of the date of this memorandum, NovaMart maintains approximately 9.1 million registered buyer accounts and approximately 62,400 active seller accounts on its platform. In addition to its marketplace operations, NovaMart operates a proprietary logistics network branded "NovaShip," which encompasses fourteen (14) fulfillment centers distributed across nine (9) states: California (3 facilities), New Jersey (2), Georgia (2), Florida (2), Ohio (1), Illinois (1), Pennsylvania (1), Tennessee (1), and Washington (1). The physical distribution of these fulfillment centers creates data touchpoints in multiple jurisdictions and implicates a correspondingly broad range of state privacy, data protection, and biometric information laws.
For fiscal year 2024, NovaMart reported gross merchandise value ("GMV") of approximately $6.2 billion and total revenue of approximately $891 million, comprising marketplace take-rate revenue, advertising revenue (generated in partnership with Stratton Digital Media Inc.), and logistics services revenue from NovaShip operations.
Overall Assessment. Based on our review of the materials described in Section II below, including interviews with NovaMart's General Counsel, Amanda Trevino, and its Co-Founder and Chief Technology Officer, Priya Narasimhan, we conclude that NovaMart maintains a generally mature and adequate data privacy and cybersecurity program. The Company has implemented written policies and procedures, maintains a dedicated security function, has obtained SOC 2 Type II reports for the past two fiscal years, and has executed data processing agreements with its most significant vendors. However, our review has identified certain areas that require attention and potential remediation, both prior to and following the closing of the Transaction. These areas include, most notably: (i) the classification of NovaMart's data-sharing arrangement with Stratton Digital Media Inc. under the California Consumer Privacy Act ("CCPA") "sale" and "sharing" provisions; (ii) the Company's compliance with the Illinois Biometric Information Privacy Act ("BIPA") at its Illinois fulfillment center; (iii) gaps in the Company's multi-state breach notification compliance infrastructure; and (iv) considerations relating to the post-closing integration of NovaMart's customer data with Cascade's existing CascadeDirect.com customer database. Each of these issues, along with other findings, is discussed in detail in the body of this memorandum.
Cross-References. This memorandum should be read in conjunction with the following related due diligence memoranda prepared by Calderwood & Harkness LLP and its advisors in connection with the Transaction:
• IP Due Diligence Memorandum — addressing open-source software components and data-integrated intellectual property assets;
• Material Contracts Due Diligence Memorandum — addressing data-sharing provisions in key vendor and partner agreements, including the approximately thirty-four (34) contracts with change of control provisions;
• Insurance Due Diligence Memorandum — addressing cyber insurance coverage, including the scope and adequacy of NovaMart's current cyber liability insurance program;
• Litigation and Regulatory Due Diligence Memorandum — addressing any privacy-related enforcement actions, regulatory investigations, or pending or threatened litigation; and
• Due Diligence Summary and Risk Assessment Memorandum — prepared by Harrison Wexford and Derek Okonkwo, providing an integrated risk assessment across all diligence workstreams.
Materials Reviewed. In preparing this memorandum, our team reviewed a comprehensive set of documents and materials provided by NovaMart through the virtual data room maintained by Calloway, Brandt & Loewe LLP ("Seller's Counsel"), including NovaMart's privacy policies, terms of service, data processing agreements, information security policies, SOC 2 Type II reports, penetration test results, incident response plans, breach notification logs, vendor security assessment records, and employee training records. We also conducted interviews with Amanda Trevino (General Counsel) and Priya Narasimhan (Co-Founder & CTO) on March 14 and March 21, 2025, respectively. A complete index of all documents reviewed is set forth in Appendix A to this memorandum.
II. Scope of Review
A. Documents and Materials Reviewed
In connection with our data privacy and cybersecurity due diligence review, Calderwood & Harkness reviewed the following categories of documents and materials, each of which was produced by NovaMart through the virtual data room administered by Calloway, Brandt & Loewe LLP (Richard Calloway and Simone Adesanya, counsel for the Seller). A detailed index of all documents reviewed, including data room reference numbers, is attached hereto as Appendix A.
1. Public-Facing Privacy Policy. NovaMart's privacy policy as published on its website (www.novamart.com/privacy) and within its mobile application (iOS and Android), including the current version (effective January 15, 2025) and archived versions dating back to the Company's initial launch in 2016. We reviewed a total of seven (7) versions of the privacy policy reflecting material updates over the Company's operating history.
2. Public-Facing Terms of Service. NovaMart's terms of service governing both buyer and seller use of the platform, including the current buyer terms of service (effective March 1, 2024), the current seller terms of service (effective March 1, 2024), and prior versions thereof.
3. Internal Data Governance Policy and Data Classification Framework. NovaMart's internal data governance policy (version 3.2, last updated September 2024) and the Company's data classification framework, which categorizes data into four tiers: Public, Internal, Confidential, and Restricted.
4. Data Processing Agreements (DPAs). Data processing agreements and related data security addenda executed between NovaMart and its key third-party vendors and partners, including:
(a) Pinnacle Cloud Solutions Inc. ("Pinnacle Cloud") — cloud hosting and infrastructure services;
(b) PayStream Financial Technologies Inc. ("PayStream") — payment processing services;
(c) Stratton Digital Media Inc. ("Stratton Digital") — advertising revenue partnership and data-sharing arrangement;
(d) Arcwave Software LLC ("Arcwave") — technology licensor for proprietary search algorithm;
(e) Redline Freight Corp. ("Redline Freight") — logistics and shipping partner for NovaShip operations; and
(f) Approximately twenty-three (23) additional DPAs with smaller vendors and service providers, as listed in Appendix A.
5. Information Security Policy Suite. NovaMart's information security policies, including the following individual policies and procedures documents:
(a) Acceptable Use Policy (version 2.1, effective July 2024);
(b) Access Control Policy (version 3.0, effective October 2024);
(c) Encryption Standards Policy (version 2.5, effective June 2024);
(d) Incident Response Plan (version 4.0, effective November 2024);
(e) Business Continuity and Disaster Recovery Plan (version 2.0, effective August 2024); and
(f) Data Retention and Destruction Policy (version 1.8, effective May 2024).
6. SOC 2 Type II Audit Reports. SOC 2 Type II reports issued by Severin Beck CPAs LLP for fiscal years 2023 and 2024, covering the trust service criteria of Security, Availability, Processing Integrity, Confidentiality, and Privacy as applied to NovaMart's marketplace platform and supporting infrastructure.
7. Penetration Testing and Vulnerability Assessment Reports. Reports from external penetration testing and vulnerability assessments conducted within the last twelve (12) months, including a comprehensive external penetration test conducted by Blackpoint Security Partners LLC in October 2024 and quarterly automated vulnerability scans performed using internal and third-party scanning tools.
8. Data Breach and Security Incident Logs. NovaMart's internal breach and security incident log covering the five-year period from January 2020 through March 2025, including incident reports, root cause analyses, notification records, and remediation documentation.
9. Employee and Contractor Training Materials and Records. Materials from NovaMart's mandatory annual data privacy and security awareness training program, including training content, completion records, and phishing simulation results for calendar years 2023 and 2024.
10. Privacy Impact Assessments / Data Protection Impact Assessments. Records of privacy impact assessments conducted by NovaMart's legal and compliance team in connection with new product features, data collection practices, and third-party data sharing arrangements. We reviewed a total of nine (9) PIAs completed between 2022 and 2025.
11. Cookie Consent Management Platform. Configuration documentation and operational records for NovaMart's cookie consent management platform (operated through Sundial Solutions), including cookie categorization, consent collection mechanisms, and opt-out functionality.
12. Data Subject Access Request (DSAR) Logs and Procedures. NovaMart's DSAR intake and response procedures and logs documenting all DSARs received and processed from January 2023 through March 2025.
13. Regulatory Correspondence. All correspondence between NovaMart and federal or state regulators relating to privacy or data security matters, including correspondence with the Federal Trade Commission ("FTC"), state attorneys general, and other regulatory authorities.
14. Cyber Insurance Policy. NovaMart's cyber liability insurance policy details (reviewed in detail in the Insurance Due Diligence Memorandum; referenced herein for coverage scope and adequacy).
15. Management Interviews. Interviews conducted by Calderwood & Harkness with the following NovaMart personnel:
(a) Priya Narasimhan, Co-Founder & Chief Technology Officer — interviewed on March 14, 2025 (in-person at NovaMart's Austin headquarters), covering cybersecurity architecture, technical controls, vendor management, and incident response capabilities; and
(b) Amanda Trevino, General Counsel — interviewed on March 21, 2025 (video conference), covering privacy policy development and maintenance, regulatory compliance, litigation history, DSAR processing, and data governance.
B. Scope Limitations
The following limitations apply to the scope of our review and should be taken into account when evaluating the findings and assessments set forth in this memorandum:
1. Outstanding Data Room Items. As of the date of this memorandum, certain documents requested by Calderwood & Harkness through the virtual data room have not yet been produced by NovaMart or Seller's Counsel (Calloway, Brandt & Loewe LLP, Richard Calloway / Simone Adesanya). Specifically, we are awaiting production of: (a) complete DPA documentation for four (4) mid-tier vendors identified in NovaMart's vendor registry; (b) the Company's written biometric data retention and destruction schedule applicable to the Illinois fulfillment center; (c) detailed configuration documentation for the Company's SIEM (Security Information and Event Management) platform; and (d) records of any privacy or security-related complaints filed by consumers directly with NovaMart (as distinct from regulatory inquiries). We have communicated these outstanding requests to Simone Adesanya on March 28, 2025, and will supplement this memorandum upon receipt of additional materials.
2. No Independent Technical Assessment. Calderwood & Harkness did not conduct independent technical penetration testing, vulnerability scanning, source code review, or any other form of independent technical security assessment of NovaMart's systems, applications, or infrastructure. Our assessment of NovaMart's cybersecurity posture is based solely on our review of the Company's existing third-party assessment reports (including the Blackpoint Security Partners LLC penetration test and Severin Beck CPAs LLP SOC 2 Type II reports), the Company's internal policies and documentation, and statements made by NovaMart personnel during management interviews. Should Cascade desire an independent technical assessment, we recommend engaging a qualified cybersecurity firm to conduct such testing prior to or promptly following closing.
3. No On-Site Inspection. Calderwood & Harkness did not conduct on-site inspections of any NovaMart data centers, fulfillment centers, or corporate offices. Our review of physical security controls and physical data handling practices at the Company's fourteen (14) fulfillment centers and its corporate headquarters is limited to documentary evidence and management representations.
4. Reliance on Representations. Certain factual statements contained in this memorandum are based on representations made by NovaMart's management during interviews and in responses to our due diligence questionnaire. We have not independently verified all such representations, and our findings are subject to the accuracy and completeness of the information provided to us.
III. Nature and Volume of Data Collected and Processed
NovaMart collects, processes, stores, and shares a substantial volume of personal data across multiple categories of data subjects. The following sections describe the principal categories of personal data maintained by NovaMart, the approximate volumes thereof, and the data flows associated with the Company's operations. A visual representation of NovaMart's data flows is set forth in Appendix C (NovaMart Data Flow Diagram).
A. Categories of Personal Data — Registered Buyers (Approximately 9.1 Million)
NovaMart collects and processes the following categories of personal data from its registered buyer base of approximately 9.1 million accounts:
1. Account Registration Data. Full legal name, email address, telephone number, mailing and/or shipping address(es), and date of birth (collected on an optional basis for age-verification and promotional purposes). NovaMart also collects account credentials (username and hashed password).
2. Payment Card and Financial Account Information. Credit card numbers, debit card numbers, and associated billing information. This data is processed through NovaMart's payment processor, PayStream Financial Technologies Inc. NovaMart represents that it does not store full payment card numbers (primary account numbers, or "PANs") on its own systems and instead relies on PayStream's tokenization infrastructure. NovaMart does retain truncated card numbers (last four digits) and transaction reference tokens for order management and customer service purposes.
3. Transaction and Order Data. Complete transaction history, including order details, product descriptions, quantities, pricing, shipping addresses, delivery status, and return and refund records. NovaMart retains historical transaction data spanning from the Company's founding in 2016 to the present.
4. Browsing, Search, and Behavioral Data. Search queries, product browsing history, clickstream data, time-on-page metrics, product reviews and ratings authored by buyers, wish list and favorites data, and cart abandonment data. This data is used for personalization, recommendation algorithms, and advertising purposes.
5. Device and Technical Data. Device identifiers (including mobile advertising identifiers such as IDFA and GAID), IP addresses, browser type and version, operating system, geolocation data (derived from IP address and, where permitted, GPS data from mobile devices), and cookies and tracking technologies. NovaMart deploys first-party cookies and, through its advertising partnership with Stratton Digital Media Inc., certain third-party cookies and tracking pixels.
6. Customer Service Communications. Records of customer service interactions, including email correspondence, live chat transcripts, and telephone call recordings and transcripts. NovaMart's customer service operations are conducted in-house from its Austin headquarters, with overflow support provided by a third-party customer service vendor.
7. Marketing Preferences. Records of marketing opt-in and opt-out elections, email subscription preferences, SMS marketing consent records, and push notification preferences.
Estimated Volume and Historical Depth: NovaMart maintains approximately 9.1 million registered buyer profiles. Historical transaction data spans from the Company's launch in 2016 to the present, representing approximately nine years of accumulated buyer activity data. NovaMart estimates that its buyer database contains in excess of 180 million individual transaction records.
B. Categories of Personal Data — Active Sellers (Approximately 62,400)
NovaMart collects and processes the following categories of personal data from its active seller base of approximately 62,400 accounts. NovaMart also retains data for an additional approximately 18,700 inactive or closed seller accounts.
1. Business and Individual Identity Information. Seller name (individual or business entity name), business address, primary contact name, email address, telephone number, and website URL. For individual sellers (sole proprietors), this includes the individual's legal name and personal address.
2. Tax Identification and Financial Information. Employer Identification Number (EIN) or Social Security Number (SSN) for tax reporting purposes, bank account information (routing number and account number) for disbursement of seller proceeds, and W-9 certification data. NovaMart issues IRS Form 1099-K to sellers meeting applicable reporting thresholds.
3. Tax Documentation. Completed IRS Form W-9 (or W-8BEN/W-8BEN-E for non-U.S. sellers, though the platform is primarily U.S.-focused), copies of issued 1099-K forms, and associated tax correspondence.
4. Sales Performance and Platform Data. Sales volume and revenue data, product listing information and catalog data, seller ratings and reviews, seller performance metrics, and communications between sellers and NovaMart (including policy compliance notifications and seller support interactions).
5. Identity Verification Documents. Government-issued photo identification (e.g., driver's license, passport), proof of address documentation, and, for certain high-volume sellers, business registration documents. These documents are collected as part of NovaMart's seller onboarding and identity verification process.
Estimated Volume: Approximately 62,400 active seller accounts plus approximately 18,700 inactive or closed seller accounts, for a total of approximately 81,100 seller profiles maintained in NovaMart's systems.
C. Categories of Personal Data — Employees (Approximately 2,400)
NovaMart employs approximately 2,400 individuals across its corporate headquarters in Austin, Texas and its fourteen (14) NovaShip fulfillment centers. The Company collects and processes the following categories of employee personal data:
1. Standard Human Resources Data. Full legal name, home address, Social Security Number, date of birth, compensation and payroll information, benefits enrollment records, direct deposit banking information, performance reviews and disciplinary records, and background check results (conducted at hire for all employees).
2. Fulfillment Center Employee Data — Biometric Data. At certain NovaShip fulfillment centers, NovaMart collects biometric data in the form of fingerprint scans or badge-based biometric scans for timekeeping and access control purposes. Based on our review, biometric data collection currently occurs at the following facilities:
(a) NovaMart Fulfillment Center — Joliet, IL (fingerprint scan for timekeeping);
(b) NovaMart Fulfillment Center — Edison, NJ (fingerprint scan for timekeeping); and
(c) NovaMart Fulfillment Center — Stockton, CA (badge-based biometric scan for access control).
The collection of fingerprint biometric data at the Joliet, Illinois fulfillment center is of particular significance because it triggers compliance obligations under the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. ("BIPA"), which is discussed in detail in Section V.C below.
3. Workplace Surveillance Data. Video surveillance footage from security cameras installed at fulfillment centers and corporate offices, badge swipe access logs, and, at certain facilities, vehicle license plate recognition data for parking access.
D. Data Flows and Storage
NovaMart's data flows across multiple internal and external systems, as depicted in the Data Flow Diagram attached as Appendix C. The principal data flows and storage configurations are summarized below.
1. Primary Data Hosting — Pinnacle Cloud Solutions Inc. NovaMart's marketplace platform, including the buyer and seller databases, transaction data, and application infrastructure, is hosted on cloud infrastructure provided by Pinnacle Cloud Solutions Inc. ("Pinnacle Cloud"), headquartered in Redmond, Washington. Pinnacle Cloud operates data centers located exclusively within the United States. Based on our review of the Pinnacle Cloud Master Services Agreement and associated DPA, NovaMart's data is hosted in Pinnacle Cloud's US-West (Oregon) and US-East (Virginia) regions, with geographic redundancy. No offshore data storage was identified in our review.
2. Payment Data — PayStream Financial Technologies Inc. Payment card data is tokenized at the point of entry and processed through PayStream Financial Technologies Inc. ("PayStream"). PayStream is a PCI DSS Level 1 certified payment processor. NovaMart represents that it does not store, process, or transmit full primary account numbers on its own systems; all payment card data is handled within PayStream's PCI-compliant environment, with NovaMart retaining only tokenized references and truncated card numbers.
3. Advertising Data — Stratton Digital Media Inc. NovaMart shares certain buyer behavioral data with Stratton Digital Media Inc. ("Stratton Digital") under a Data Sharing and Advertising Revenue Agreement for the purpose of enabling targeted advertising on and off the NovaMart platform. The categories of data shared with Stratton Digital include hashed email addresses, browsing and purchase history segments, device identifiers, and cookie data. The implications of this data sharing under the CCPA are discussed in detail in Sections IV.A and V.B below.
4. Logistics and Shipping Data — Redline Freight Corp. NovaMart shares buyer shipping data with Redline Freight Corp. ("Redline Freight") for the purpose of order fulfillment through the NovaShip logistics network. Data shared includes buyer name, shipping address, order reference number, and package contents descriptions. The DPA with Redline Freight includes a provision requiring deletion of buyer personal data within ninety (90) days of delivery confirmation, though our review identified no mechanism for NovaMart to verify compliance with this obligation.
5. Data Retention Policy. NovaMart's Data Retention and Destruction Policy (version 1.8, effective May 2024) provides for the following retention periods:
(a) Buyer data: Retained for seven (7) years following the date of the buyer's last activity on the platform (last login, purchase, or customer service interaction);
(b) Seller data: Retained for seven (7) years following the date of seller account closure, which NovaMart represents is driven primarily by IRS record retention requirements for 1099-K reporting purposes; and
(c) Employee data: Retained for the duration of employment and for seven (7) years following termination, subject to longer retention periods for certain categories of data required by applicable employment laws.
We note that the seven-year buyer data retention period, while reasonable for transaction records linked to tax and financial reporting, may result in the retention of behavioral and marketing data (browsing history, search queries, device identifiers) well beyond the period necessary for the original purpose of collection. This could present compliance challenges under the CCPA's data minimization principles and, for post-closing integration purposes, under other state privacy laws that impose purpose limitation requirements.
IV. Privacy Policy and Terms of Service Review
A. Public-Facing Privacy Policy
NovaMart maintains a publicly accessible privacy policy on its website (www.novamart.com/privacy) and within its mobile applications. The current version of the privacy policy is dated January 15, 2025, and reflects the most recent substantive revision. Prior to the current version, the privacy policy was updated in March 2024, June 2023, January 2023, August 2021, February 2019, and at the time of the Company's launch in October 2016.
Structure and Comprehensiveness. The current privacy policy is approximately 5,200 words in length and is organized into the following sections: (i) Information We Collect; (ii) How We Use Your Information; (iii) How We Share Your Information; (iv) Your Privacy Rights; (v) Cookies and Tracking Technologies; (vi) Data Security; (vii) Data Retention; (viii) Children's Privacy; (ix) Changes to This Policy; and (x) Contact Us. The policy is written in reasonably plain language and employs a layered disclosure format with expandable sections for detailed information.
Categories of Information and Purposes of Collection. The privacy policy accurately describes the categories of personal information collected by NovaMart, generally consistent with the categories identified in Section III above. The stated purposes of collection include: providing and improving platform services, processing transactions, communicating with users, personalizing user experience, providing targeted advertising, complying with legal obligations, and protecting the security of the platform and its users.
Third-Party Sharing Disclosures. The privacy policy discloses that NovaMart shares personal information with: (i) service providers that assist with platform operations (including cloud hosting, payment processing, and logistics partners); (ii) advertising partners for targeted advertising purposes; (iii) sellers, to the extent necessary to fulfill orders; and (iv) as required by law or in connection with legal proceedings. The policy names Stratton Digital Media Inc. as an advertising partner and notes that data may be shared for "personalized advertising and analytics purposes."
CCPA-Specific Disclosures. The privacy policy includes a dedicated section addressing California residents' rights under the CCPA/CPRA, including the rights to know, delete, correct, opt out of sale/sharing, and limit the use of sensitive personal information. The policy includes a "Do Not Sell or Share My Personal Information" link that directs users to a preference management page.
Assessment of CCPA "Sale" / "Sharing" Disclosures. The privacy policy states that NovaMart "may share certain personal information with advertising partners for targeted advertising purposes" and that such sharing "may be considered a 'sale' or 'sharing' under the California Consumer Privacy Act." We note that while this disclosure is reasonably transparent, NovaMart's current operational practice involves the transmission of hashed email addresses, behavioral data, device identifiers, and cookie data to Stratton Digital Media Inc. in exchange for advertising revenue. Under the CCPA's broad definitions of "sale" (Cal. Civ. Code § 1798.140(ad)) and "sharing" (Cal. Civ. Code § 1798.140(ah)), this arrangement likely constitutes both a "sale" and "sharing" of personal information. NovaMart should ensure that its opt-out mechanisms fully comply with CCPA requirements, including recognition of the Global Privacy Control ("GPC") browser signal, which is required under CPRA regulations. During our interview with Amanda Trevino, she confirmed that NovaMart implemented GPC recognition in Q4 2024, but we were unable to independently verify the technical implementation.
Do Not Sell/Share Link. The privacy policy and NovaMart's website footer include a "Do Not Sell or Share My Personal Information" link as required by Cal. Civ. Code § 1798.135. The link directs users to an opt-out preference page powered by Sundial Solutions. Based on our review of the Bramwell Systems documentation, the opt-out mechanism appears to be functional, though we recommend that Cascade independently verify its operation through user-experience testing.
Children's Privacy (COPPA). NovaMart's terms of service require that all users be at least eighteen (18) years of age to register for an account or make purchases on the platform. The privacy policy includes a brief children's privacy section stating that NovaMart "does not knowingly collect personal information from children under the age of 13" and that the Company will delete any such information upon becoming aware of its collection. NovaMart has not implemented a formal COPPA compliance program, including age verification mechanisms beyond the self-certification at account registration. Given the nature of NovaMart's marketplace (consumer goods, home décor, electronics, and apparel), the risk of significant underage user activity is moderate. However, the absence of technical age verification creates residual risk, particularly in light of the FTC's renewed enforcement focus on children's privacy. We recommend that Cascade evaluate whether additional age verification measures are warranted post-closing.
Cookies and Tracking Technologies. The privacy policy describes NovaMart's use of cookies, web beacons, pixels, and similar tracking technologies, and categorizes these technologies as "strictly necessary," "functional," "performance/analytics," and "targeting/advertising." The policy describes the use of third-party advertising cookies placed by Stratton Digital Media Inc. and other advertising network partners. NovaMart's cookie consent management platform, operated through Sundial Solutions, presents a cookie consent banner to website visitors that allows users to accept all cookies, reject non-essential cookies, or manage cookie preferences by category. Based on our review, the cookie consent implementation appears generally adequate, though we note that the consent banner defaults to a "Reject All" button configuration for California users — a practice consistent with CCPA/CPRA requirements but not universally implemented across all jurisdictions.
Adequacy Assessment. Overall, NovaMart's privacy policy is reasonably comprehensive and reflects a generally mature approach to privacy disclosures. The policy addresses the principal categories of personal information collected, the purposes of processing, third-party sharing, and consumer rights. The CCPA-specific disclosures are substantively adequate, though we have identified the following areas for improvement:
(a) The privacy policy does not specifically enumerate all categories of "sensitive personal information" collected (as defined under CPRA), including precise geolocation data and financial account information combined with access codes;
(b) The data retention section provides general statements about retention periods but does not specify retention periods for each category of personal information, as increasingly expected by state regulators;
(c) The privacy policy does not include specific disclosures addressing the rights of consumers under state privacy laws other than the CCPA (e.g., Virginia VCDPA, Colorado CPA, Texas TDPSA), relying instead on a general statement that NovaMart "complies with applicable state privacy laws"; and
(d) The "Changes to This Policy" section states that NovaMart "may update this privacy policy from time to time" and will notify users of "material changes" via email or platform notification, but does not define what constitutes a "material change" or provide a specific notice period.
B. Terms of Service
Data Licensing — Seller Terms. NovaMart's seller terms of service include a broad data licensing provision under which sellers grant NovaMart a "non-exclusive, worldwide, royalty-free, sublicensable, transferable license to use, reproduce, modify, distribute, display, and create derivative works from" all data and content uploaded by sellers to the platform, including product listings, images, descriptions, and seller profile information. This license survives account termination. While this provision is common among marketplace platforms, its breadth — particularly the "sublicensable" and "transferable" elements — should be considered in the context of post-closing data integration and any potential monetization of seller data by Cascade.
Buyer Consent Provisions. NovaMart's buyer terms of service include a consent provision under which buyers consent to the collection and processing of personal information as described in the privacy policy. The consent is obtained through a clickwrap mechanism at account registration, requiring buyers to affirmatively check a box confirming that they have read and agree to the terms of service and privacy policy. This consent mechanism is generally adequate for purposes of federal and state privacy law, though it relies on the privacy policy's disclosures being complete and accurate.
Arbitration and Dispute Resolution. Both the buyer and seller terms of service include mandatory binding arbitration clauses administered by JAMS, with a class action waiver. The arbitration clause applies to "any dispute arising out of or relating to these Terms, the Services, or your use of the Platform, including any dispute regarding the collection, use, or disclosure of your personal information." This arbitration provision may limit the exposure to class action litigation arising from privacy-related claims, though we note that the CCPA private right of action for data breaches (Cal. Civ. Code § 1798.150) has been held to be subject to arbitration in certain circumstances, while other courts have found such waivers unenforceable as applied to statutory privacy claims. The enforceability of the arbitration clause may vary by jurisdiction.
Assignment and Change of Control. NovaMart's terms of service include a provision permitting NovaMart to assign its rights and obligations under the terms of service "in connection with a merger, acquisition, reorganization, or sale of all or substantially all of [NovaMart's] assets, without the prior consent of users." This provision is relevant to the Transaction because the stock purchase structure means that NovaMart, as a legal entity, will continue to exist and will continue to be the party to the terms of service. In a stock acquisition, there is no assignment of the terms of service — the entity simply has new ownership. Accordingly, the change of control / assignment provision is unlikely to be triggered by the Transaction, and user notification or re-consent should not be required under the terms of service themselves. However, as discussed in Section IX.A below, this analysis must be considered alongside NovaMart's privacy policy representations regarding business transfers and applicable privacy law requirements.
C. Seller Data Processing Agreement
NovaMart offers a standard Seller Data Processing Agreement ("Seller DPA") to sellers who request one, though execution of the Seller DPA is not mandatory for seller onboarding. As of the date of our review, approximately 12,300 of NovaMart's approximately 62,400 active sellers (approximately 19.7%) have executed the Seller DPA. The remaining sellers are governed solely by the data handling provisions in the seller terms of service.
The Seller DPA addresses NovaMart's handling of seller data, including payment information and tax records, and imposes the following key obligations on NovaMart:
(a) Data security: NovaMart must implement and maintain "commercially reasonable" administrative, technical, and physical safeguards to protect seller data;
(b) Breach notification: NovaMart must notify affected sellers of a data breach involving seller data "without unreasonable delay and in no event later than seventy-two (72) hours" after becoming aware of the breach;
(c) Data portability: Upon account closure, NovaMart must make available to the seller, in a structured, commonly used, and machine-readable format, a copy of the seller's data maintained on the platform; and
(d) Assignability: The Seller DPA includes a provision permitting assignment by NovaMart "to any successor entity in connection with a merger, acquisition, or reorganization" without seller consent, provided the successor assumes NovaMart's obligations under the Seller DPA.
We note that the low adoption rate of the Seller DPA (approximately 19.7%) means that the majority of sellers are not covered by its enhanced protections. This may present a risk if sellers assert claims related to NovaMart's handling of their data, as the seller terms of service provide fewer specific data protection commitments than the Seller DPA.
V. Applicable Privacy and Data Protection Laws
A. Federal Law
1. FTC Act Section 5
Section 5 of the Federal Trade Commission Act, 15 U.S.C. § 45, prohibits "unfair or deceptive acts or practices in or affecting commerce." The FTC has used this authority extensively to bring enforcement actions against companies whose data practices are inconsistent with their privacy policy representations or that fail to implement reasonable data security measures. NovaMart's public-facing privacy policy constitutes a set of enforceable commitments, and any material deviation between the Company's stated practices and its actual practices could give rise to FTC enforcement risk.
Based on our review, NovaMart's actual data collection, use, and sharing practices appear generally consistent with the representations made in its privacy policy. However, we have identified two areas of potential concern: (i) the privacy policy's characterization of data sharing with Stratton Digital Media Inc. as being "for analytics and advertising" may understate the full scope of data shared and the purposes for which Stratton Digital uses the data; and (ii) the privacy policy's data security representations ("We use industry-standard security measures to protect your personal information") are broad and could be viewed as deceptive if NovaMart's security practices are found to be deficient in any material respect. We recommend that these disclosures be tightened in a post-closing privacy policy update.
2. CAN-SPAM Act
The Controlling the Assault of Non-Solicited Pornography and Marketing Act of 2003, 15 U.S.C. §§ 7701–7713, governs commercial email communications. NovaMart's marketing emails, based on our review of sample emails provided in the data room, include the required elements: accurate sender identification, a physical mailing address, clear identification as advertising, and a functioning opt-out mechanism. NovaMart represents that opt-out requests are processed within seven (7) business days, within the statutory ten-business-day maximum. We did not identify material CAN-SPAM compliance deficiencies.
3. COPPA. The Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506, and the FTC's implementing regulations at 16 C.F.R. Part 312, impose requirements on operators of websites and online services directed to children under 13, or that have actual knowledge of collecting personal information from children under 13. NovaMart's terms of service require users to be at least 18 years of age, and the platform is not directed to children. However, NovaMart does not employ age-gating or age verification technology beyond self-certification at account registration. Given the consumer goods nature of NovaMart's marketplace, which includes categories such as toys, games, and children's apparel, there is a residual risk that children under 13 may access and use the platform. The absence of a formal COPPA compliance program, including verifiable parental consent mechanisms, represents a low-to-moderate risk. We note that the FTC has signaled increased scrutiny of platforms that fail to take adequate steps to prevent the collection of children's data, even when the platform is not specifically directed to children.
4. Gramm-Leach-Bliley Act
The Gramm-Leach-Bliley Act ("GLBA"), 15 U.S.C. §§ 6801–6809, and its implementing regulations apply to "financial institutions," a term defined broadly to include entities that are "significantly engaged" in financial activities. NovaMart is not a financial institution within the meaning of the GLBA. However, NovaMart's handling of payment card data through PayStream, its maintenance of seller bank account information for disbursement purposes, and its issuance of IRS Form 1099-K necessitate careful data security practices for financial data. NovaMart's payment data handling is addressed through its contractual relationship with PayStream (PCI DSS-certified) and is subject to the data security obligations in the PayStream DPA.
5. Internal Revenue Code / IRS Requirements
NovaMart is subject to IRS Form 1099-K reporting requirements as a third-party settlement organization under Internal Revenue Code § 6050W. NovaMart issues 1099-K forms to sellers meeting applicable reporting thresholds. The Company's collection and retention of seller tax identification information (SSN/EIN) and financial data is driven in part by these reporting obligations, which also inform the Company's seven-year seller data retention period. Coordination with Whitmore & Paige LLP (Sandra Chiu) on tax implications of seller data handling is recommended.
B. California Consumer Privacy Act (CCPA) / California Privacy Rights Act (CPRA)
The California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), Cal. Civ. Code §§ 1798.100–1798.199.100, is the most significant state privacy law applicable to NovaMart's operations.
Applicability. NovaMart meets the CCPA's jurisdictional thresholds on multiple grounds:
(a) NovaMart's annual gross revenue for fiscal year 2024 was approximately $891 million, exceeding the $25 million threshold under Cal. Civ. Code § 1798.140(d)(1)(A);
(b) NovaMart annually buys, sells, or shares the personal information of more than 100,000 California consumers, households, or devices (NovaMart estimates that approximately 1.4 million of its 9.1 million registered buyers are California residents), exceeding the threshold under Cal. Civ. Code § 1798.140(d)(1)(B); and
(c) While NovaMart does not derive more than 50% of its annual revenue from selling or sharing consumers' personal information under Cal. Civ. Code § 1798.140(d)(1)(C), the first two grounds are independently sufficient to establish CCPA applicability.
NovaMart's physical presence in California is also significant. The Company operates three (3) fulfillment centers in California (locations in Stockton, Ontario, and San Bernardino), employing approximately 420 workers in the state, which amplifies NovaMart's nexus with California and its exposure to California Privacy Protection Agency ("CPPA") enforcement.
Compliance Assessment. Our assessment of NovaMart's CCPA compliance is as follows:
1. Right to Know / Access (§ 1798.100, 1798.110, 1798.115). NovaMart provides California consumers with the ability to submit requests to know what personal information has been collected, the categories of sources, the business or commercial purposes for collection, the categories of third parties with whom information is shared, and the specific pieces of personal information collected. DSAR requests are submitted through a web form and are verified through a two-step email and account verification process. Based on our review of the DSAR logs, NovaMart received approximately 2,340 requests to know/access in calendar year 2024, with a median response time of twenty-two (22) days — well within the forty-five (45) day statutory deadline.
2. Right to Delete (§ 1798.105). NovaMart provides California consumers with the ability to submit deletion requests. Upon receiving a verified deletion request, NovaMart deletes the consumer's account and associated personal information, subject to exceptions for data required to complete transactions, maintain security, comply with legal obligations, and fulfill internal business purposes. NovaMart received approximately 1,870 deletion requests in calendar year 2024, with a median processing time of eighteen (18) days. We note that NovaMart's seven-year buyer data retention policy may result in the retention of certain data beyond the period necessary to comply with the stated exceptions, and we recommend that Cascade evaluate whether the retention policy should be shortened for categories of data not subject to specific legal retention requirements.
3. Right to Opt Out of Sale/Sharing (§ 1798.120, 1798.121). As discussed above, NovaMart's data sharing with Stratton Digital Media Inc. likely constitutes a "sale" and/or "sharing" of personal information under the CCPA. NovaMart provides a "Do Not Sell or Share My Personal Information" link and opt-out mechanism, and NovaMart represents that it implemented Global Privacy Control (GPC) recognition in Q4 2024. Based on our review, approximately 187,000 California buyers (approximately 13.4% of estimated California buyers) have exercised the opt-out right. This is an area of elevated risk. If NovaMart's data sharing with Stratton Digital is determined to constitute a "sale" and NovaMart's opt-out mechanisms are found to be inadequate or improperly implemented, the Company could face enforcement action by the CPPA or the California Attorney General, as well as private litigation. We recommend that Cascade conduct an independent technical assessment of the opt-out mechanism's effectiveness.
4. Right to Correct (§ 1798.106). NovaMart provides a mechanism for consumers to correct inaccurate personal information through their account settings page and through DSAR submissions. This right appears to be adequately implemented.
5. Right to Limit Use of Sensitive Personal Information (§ 1798.121). NovaMart collects certain categories of sensitive personal information, including precise geolocation data (from mobile app users who grant location access), financial account information (truncated payment card data and transaction data), and account log-in credentials. NovaMart provides a "Limit the Use of My Sensitive Personal Information" link on its website, consistent with CPRA requirements. The implementation of this right appears adequate.
6. Non-Discrimination (§ 1798.125). NovaMart's privacy policy includes a non-discrimination statement, and we did not identify evidence of discriminatory practices against consumers who exercise their privacy rights.
7. Service Provider and Contractor Agreements. The CCPA requires that businesses enter into contracts with service providers and contractors that process personal information on the business's behalf, restricting the service provider's or contractor's use of personal information to the business purposes specified in the contract. We reviewed the DPAs with NovaMart's five key vendors (Pinnacle Cloud, PayStream, Stratton Digital, Redline Freight, and Arcwave) and found them generally consistent with CCPA requirements, with one notable exception: the DPA with Arcwave Software LLC does not include the specific CCPA service provider contractual provisions required by Cal. Civ. Code § 1798.100(d). We recommend that this DPA be updated to include CCPA-compliant terms.
CCPA Private Right of Action (§ 1798.150). California consumers have a private right of action for data breaches involving unencrypted and unredacted personal information resulting from a business's failure to implement and maintain reasonable security procedures and practices. Given the volume of California buyer data maintained by NovaMart (estimated 1.4 million California buyers), a data breach involving unencrypted personal information could expose NovaMart to significant statutory damages (between $100 and $750 per consumer per incident, or actual damages, whichever is greater). NovaMart's data security practices, as discussed in Section VI below, appear generally reasonable, but the risk of a qualifying breach cannot be eliminated.
C. Other State Privacy Laws
NovaMart's nationwide operations and user base implicate comprehensive state privacy laws in multiple jurisdictions. The following is a summary of the most significant state privacy laws applicable to NovaMart's operations, with a complete state-by-state analysis set forth in Appendix B.
1. Texas Data Privacy and Security Act (TDPSA)
The Texas Data Privacy and Security Act, Tex. Bus. & Com. Code §§ 541.001–541.205, is particularly relevant given NovaMart's headquarters in Austin, Texas and its substantial operational nexus with the state. The TDPSA, effective July 1, 2024, applies to entities that conduct business in Texas, process or engage in the sale of personal data, and are not classified as small businesses under the Small Business Administration's definition. NovaMart clearly exceeds these thresholds. NovaMart must comply with the TDPSA's requirements for consumer rights (access, correction, deletion, opt-out of targeted advertising and sale of personal data), privacy notices, data protection assessments, and contractual obligations with processors. Based on our review, NovaMart has not yet updated its privacy policy to include Texas-specific consumer rights disclosures, which we identify as an area requiring prompt remediation.
2. Virginia Consumer Data Protection Act (VCDPA)
The Virginia Consumer Data Protection Act, Va. Code §§ 59.1-575–59.1-585, applies to entities that control or process the personal data of at least 100,000 Virginia consumers or that control or process the personal data of at least 25,000 Virginia consumers and derive over 50% of gross revenue from the sale of personal data. NovaMart estimates that it has approximately 430,000 registered buyers in Virginia, well above the 100,000 threshold. NovaMart appears to comply with the VCDPA's core requirements but has not conducted a formal compliance gap assessment specific to Virginia.
3. Colorado Privacy Act (CPA) and Connecticut Data Privacy Act (CTDPA)
Both the Colorado Privacy Act and the Connecticut Data Privacy Act impose requirements similar to the VCDPA, including consumer rights, purpose limitation, data minimization, and opt-out rights for targeted advertising and sale of personal data. NovaMart's user base in both states exceeds applicable thresholds. NovaMart's privacy program appears generally consistent with these laws' requirements, though state-specific compliance assessments have not been formally documented.
4. Illinois Biometric Information Privacy Act (BIPA)
The Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq., is of specific and material concern in connection with this Transaction. BIPA is the most stringent biometric privacy law in the United States and provides a private right of action with statutory damages of $1,000 per negligent violation and $5,000 per intentional or reckless violation.
As described in Section III.C above, NovaMart collects fingerprint biometric data from employees at its Joliet, Illinois NovaShip fulfillment center for timekeeping purposes. BIPA requires that before collecting biometric identifiers or biometric information, a private entity must:
(a) Inform the subject in writing that a biometric identifier or biometric information is being collected or stored;
(b) Inform the subject in writing of the specific purpose and length of time for which a biometric identifier or biometric information is being collected, stored, and used;
(c) Receive a written release executed by the subject of the biometric identifier or biometric information; and
(d) Publish a publicly available written retention schedule and guidelines for permanently destroying biometric identifiers and biometric information.
During our interview with Amanda Trevino, she confirmed that NovaMart requires new employees at the Joliet facility to sign a biometric consent form as part of the onboarding process. However, we were unable to confirm the following based on the documents currently available in the data room:
(a) Whether the written consent form fully complies with BIPA's requirements (including disclosure of the specific purpose and length of time for collection);
(b) Whether all current and former employees at the Joliet facility have executed the required written release (NovaMart's General Counsel acknowledged that the consent form was introduced in mid-2023, but the Joliet facility has been operational since early 2022, creating a gap period of approximately eighteen months); and
(c) Whether NovaMart has published a written biometric data retention schedule and destruction guidelines as required by BIPA § 15(a).
The BIPA exposure is potentially significant. The Joliet facility currently employs approximately 145 workers, and an estimated additional 60 workers were employed at the facility during the gap period before the consent form was introduced. Under BIPA's statutory damages framework, the potential exposure for the pre-consent gap period alone could range from approximately $60,000 (at $1,000 per negligent violation for 60 workers) to $300,000 (at $5,000 per intentional violation for 60 workers), and potentially significantly higher if claims are asserted on a per-scan basis (each fingerprint scan could constitute a separate violation). Recent Illinois Supreme Court precedent, Cothron v. White Castle System, Inc., 2023 IL 128004, held that a separate BIPA claim accrues with each individual scan, though the Illinois legislature subsequently enacted amendments moderating damages calculations. We have requested NovaMart's biometric data consent records and retention schedule through the data room and are awaiting production.
We flag this as a high-priority issue requiring prompt remediation and disclosure in the Seller's Disclosure Schedules.
5. Other State Privacy Laws
Additional state comprehensive privacy laws enacted and effective as of the date of this memorandum, including those in Oregon, Montana, Utah, New Hampshire, New Jersey, Delaware, Iowa, Nebraska, and Maryland, impose varying requirements. NovaMart has not conducted formal compliance assessments for each of these individual state laws. We recommend that Cascade prioritize a comprehensive multi-state compliance gap assessment post-closing. A summary table of applicable state privacy laws is set forth in Appendix B.
6. New Jersey Consumer Protection Statutes
NovaMart operates two fulfillment centers in New Jersey (Edison and Secaucus). The New Jersey Consumer Fraud Act, N.J.S.A. 56:8-1 et seq., and New Jersey's recently enacted comprehensive privacy law, both apply to NovaMart's data practices. The New Jersey Attorney General's Office has been active in data privacy enforcement, and NovaMart's New Jersey operations create a meaningful enforcement nexus.
D. State Data Breach Notification Laws
NovaMart collects personal information from residents of all fifty (50) states, the District of Columbia, and U.S. territories. As a result, the Company is subject to data breach notification laws in each of these jurisdictions. The specific requirements of these laws vary considerably, including with respect to:
(a) Definition of "personal information" triggering notification — some states (e.g., California, Illinois, Texas) define personal information broadly to include health information, biometric data, and online account credentials, while others maintain narrower definitions;
(b) Notification timelines — ranging from "without unreasonable delay" to specific deadlines (e.g., sixty (60) days in California, thirty (30) days in Colorado, as soon as practicable and within sixty (60) days in Texas);
(c) Notification recipients — including affected individuals, state attorneys general, and in some cases consumer reporting agencies; and
(d) Content requirements — varying requirements for the information that must be included in breach notification letters.
NovaMart's incident response plan (discussed in Section VII.B below) includes a multi-state breach notification protocol that maps notification requirements across jurisdictions. However, based on our review, the notification protocol has not been updated since June 2024 and does not reflect recent amendments to breach notification laws in several states. We recommend that the protocol be updated to reflect current law as a post-closing remediation priority.
The states with the most stringent breach notification requirements, and thus the highest enforcement exposure for NovaMart, include California, New York, Texas, Illinois, Massachusetts, and Colorado. NovaMart's estimated user concentrations in these states are:
E. Payment Card Industry Data Security Standard (PCI DSS)
NovaMart is subject to PCI DSS compliance requirements as a merchant that accepts payment card transactions. The Company's payment card processing is handled primarily through PayStream Financial Technologies Inc., which is a PCI DSS Level 1 certified service provider. NovaMart is classified as a Level 2 merchant (processing between 1 million and 6 million card transactions annually) under the payment card brand rules.
Based on our review and management representations, NovaMart does not store, process, or transmit full primary account numbers (PANs) on its own systems. All payment card data is tokenized at the point of entry by PayStream's payment gateway, and NovaMart retains only tokenized references and the last four digits of card numbers. This architecture significantly reduces NovaMart's PCI DSS compliance scope. NovaMart completes an annual PCI DSS Self-Assessment Questionnaire (SAQ A-EP), reflecting its status as an e-commerce merchant that partially outsources payment processing.
NovaMart's most recent SAQ A-EP, completed in November 2024, did not identify any material compliance deficiencies. We note, however, that SAQ A-EP is a self-assessment in

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT PRIVILEGE / ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts