PRIVILEGED AND CONFIDENTIAL — ATTORNEY WORK PRODUCT
MEMORANDUM
FROM: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
TO: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP
DATE: July 14, 2025
RE: Legal Review of Fieldhaven Consulting Group LLC Data-Mapping Report — Cascade Retail Holdings Inc. US State Privacy Compliance Program
MATTER NO.: 1038-00010
CLIENT: Cascade Retail Holdings Inc. (Nasdaq: CSRD)
Right-click to update Table of Contents
I. Executive Summary
This memorandum provides a legal-compliance review of the data-mapping report prepared and delivered by Fieldhaven Consulting Group LLC ("Fieldhaven") on May 19, 2025 (the "Fieldhaven Report"). The Fieldhaven Report was commissioned by Cascade Retail Holdings Inc. ("Cascade" or "CRH") as part of the technical workstream under Fieldhaven's fixed-fee statement of work (total contract value: $3,150,000; data-mapping milestone payment: $945,000). The Fieldhaven Report represents the primary deliverable under Milestone 1 of Fieldhaven's engagement and serves as the foundational factual basis upon which Calderwood & Harkness's legal analysis and compliance program design will rest.
This review evaluates the Fieldhaven Report from the perspective of Cascade's obligations under the nineteen (19) applicable United States state privacy statutes, with particular focus on the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"), which carries the most comprehensive and prescriptive requirements among the applicable regimes and which, given Cascade's significant California consumer base and digital operations, presents the most immediate enforcement exposure.
Our review has identified the following key findings. The Fieldhaven Report reveals several legally significant data flows and practices that require immediate remediation, including:
(i) the volume and nature of consumer-event data processing by Peakview Analytics Inc. ("Peakview"), a wholly owned subsidiary of Cascade, which currently processes approximately 2.1 billion consumer-event data records per month, sourced from browsing activity, mobile-app interactions, in-store POS transactions, and loyalty-program activity;
(ii) the sharing of consumer personal information with forty-seven (47) third-party advertising and analytics partners, twenty-three (23) of which lack executed data-processing agreements ("DPAs"), resulting in disclosures that must currently be classified as uncontrolled sales or sharing under CCPA/CPRA;
(iii) the commingling of third-party seller data on Cascade Digital Marketplace LLC ("CDM") with first-party customer data within a single unified data lake, without role-based access controls or logical data segregation, creating cross-contamination risk and undermining data-minimization compliance; and
(iv) twelve (12) categories of cookies and tracking technologies deployed on cascade.com and the Cascade mobile application without adequate consent mechanisms, without honoring the Global Privacy Control ("GPC") signal, and without a consent-management platform ("CMP") currently in operation.
This memorandum classifies each material data flow identified in the Fieldhaven Report under the applicable CCPA/CPRA categories: sale, sharing, service-provider processing, and contractor processing. Where applicable, we note the parallel requirements imposed by other state statutes with distinct definitional frameworks or consent standards.
Our recommendations are aligned with the Phase 1 milestones established in the Phase 1 Work Plan (issued June 6, 2025), including the gap-analysis report delivery (August 15, 2025), DPA template finalization (September 30, 2025), and CMP deployment (December 15, 2025). We identify seven primary compliance gaps surfaced or confirmed by the Fieldhaven Report, each of which is detailed in Section IX below and accompanied by specific remediation recommendations and target completion dates.
We note at the outset that this memorandum is focused exclusively on the consumer-facing data flows mapped by Fieldhaven. Employee and human-resources data flows are outside the scope of the Fieldhaven Report and will be addressed separately in the employee privacy-notice workstream. In addition, certain legacy systems that were not fully accessible to Fieldhaven during the mapping period may contain additional data flows not yet catalogued; we recommend that supplemental mapping be undertaken once system access is obtained.
II. Background
A. Engagement Context
Calderwood & Harkness LLP was engaged by Cascade Retail Holdings Inc. on June 2, 2025, pursuant to an executed engagement letter of the same date, to design, build, and implement a comprehensive US state-privacy compliance program. The engagement encompasses legal analysis, policy and notice drafting, contract template development, vendor assessment, regulatory-response framework development, and ongoing advisory support through the full Phase 1 implementation period, with an anticipated transition to Phase 2 (ongoing compliance monitoring and program maintenance) upon successful completion of all Phase 1 deliverables.
Cascade is a publicly traded omnichannel retailer and e-commerce platform, headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Cascade is incorporated in the State of Delaware and holds Employer Identification Number 84-3192057. Cascade's common stock trades on the Nasdaq Global Select Market under the ticker symbol CSRD.
Cascade reported fiscal year 2024 ("FY2024") revenue of approximately $3.87 billion, reflecting its position as a significant player in the US omnichannel retail space. The company employs approximately 22,500 individuals across 186 retail locations in thirty-one (31) US states, as well as e-commerce fulfillment centers and corporate offices. Cascade's e-commerce platform, cascade.com, processed approximately 94 million online transactions during FY2024, generating substantial volumes of consumer personal information across browsing, purchasing, and post-purchase engagement activities.
In addition to its core retail and e-commerce operations, Cascade operates the Cascade Rewards loyalty program through its subsidiary, Cascade Rewards Corp., a Delaware corporation (EIN: 86-3381729). The Cascade Rewards program currently has approximately 41.2 million registered members across all fifty (50) US states and the District of Columbia. The program collects and processes member personal information including name, contact information, date of birth, purchase history, points balance, stored-value card data, and marketing preferences. The scale and geographic breadth of the Cascade Rewards program is a significant driver of Cascade's exposure under state privacy statutes, as discussed further in Section V.E below.
The Phase 1 kickoff meeting was held on June 6, 2025, and the initial data-mapping workshop — attended by representatives of Calderwood & Harkness, Fieldhaven, and Cascade's internal data, analytics, marketing, and information-security teams — was held on June 16, 2025. The present memorandum represents the first substantive legal analysis delivered under the engagement.
B. Fieldhaven Consulting Engagement
Fieldhaven Consulting Group LLC ("Fieldhaven"), a Delaware limited liability company located at 350 Sansome Street, Suite 400, San Francisco, California 94104, was retained by Cascade as the privacy-program technical implementer. Fieldhaven was selected following a competitive RFP process that included three finalist vendors and was engaged under a master services agreement and statement of work executed in April 2025. The engagement lead at Fieldhaven is Marcus Ellerby, who serves as the primary point of contact for both Cascade and Calderwood & Harkness on all technical workstream matters.
The Fieldhaven statement of work provides for a fixed fee of $3,150,000, payable in three milestone installments tied to specific deliverables:
• Milestone 1 — Data Mapping Complete: $945,000. The Fieldhaven Report, dated May 19, 2025, constitutes the primary deliverable under this milestone.
• Milestone 2 — Consent Management Platform Deployed: $1,102,500. This milestone encompasses CMP deployment, configuration, and integration with Cascade's digital properties and the selected CMP vendor, OnPoint Data Solutions Inc.
• Milestone 3 — Data Subject Request Automation Live: $1,102,500. This milestone encompasses the design, build, and deployment of an automated DSR intake, routing, fulfillment, and response workflow integrated with all Cascade data repositories.
The Fieldhaven Report, dated May 19, 2025 and delivered to Cascade on the same date, constitutes the primary deliverable under Milestone 1. Calderwood & Harkness received a copy of the Fieldhaven Report on June 4, 2025, two days after execution of the Calderwood & Harkness engagement letter. The full Fieldhaven Report is incorporated by reference as Appendix A to this memorandum and is available in the matter file under Calderwood & Harkness Matter No. 1038-00010.
Calderwood & Harkness's role in the engagement is to review Fieldhaven's work product for legal sufficiency, to identify legally significant data flows, to apply legal classification frameworks (particularly under CCPA/CPRA and the other applicable state statutes) to Fieldhaven's factual findings, and to develop the legal components of Cascade's compliance program, including policies, notices, contracts, and response frameworks. Fieldhaven's role is confined to technical analysis and implementation; Fieldhaven does not provide legal advice, and its report does not contain legal analysis or compliance conclusions.
C. Applicable Legal Framework
As of the opening of this engagement, nineteen (19) US state comprehensive privacy statutes are applicable to Cascade's operations, either because they are currently in effect or because they will take effect during the Phase 1 implementation period and require preparatory compliance measures. The applicable statutes are as follows:
1. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — Cal. Civ. Code §§ 1798.100 et seq.
2. Virginia Consumer Data Protection Act (VCDPA) — Va. Code §§ 59.1-575 et seq.
3. Colorado Privacy Act (CPA) — Colo. Rev. Stat. §§ 6-1-1301 et seq.
4. Connecticut Data Privacy Act (CTDPA) — Conn. Gen. Stat. §§ 42-515 et seq.
5. Utah Consumer Privacy Act (UCPA) — Utah Code §§ 13-61-101 et seq.
6. Iowa Consumer Data Protection Act (ICDPA) — Iowa Code ch. 715D
7. Indiana Consumer Data Protection Act (INCDPA) — Ind. Code §§ 24-15-1-1 et seq.
8. Tennessee Information Protection Act (TIPA) — Tenn. Code §§ 47-18-3201 et seq.
9. Montana Consumer Data Privacy Act (MCDPA) — Mont. Code §§ 30-14-2801 et seq.
10. Texas Data Privacy and Security Act (TDPSA) — Tex. Bus. & Com. Code ch. 541
11. Oregon Consumer Privacy Act (OCPA) — Or. Rev. Stat. §§ 646A.570 et seq.
12. Delaware Personal Data Privacy Act (DPDPA) — Del. Code tit. 6, ch. 12D
13. New Jersey Data Privacy Act (NJDPA) — N.J. Stat. §§ 56:8-166 et seq.
14. New Hampshire Data Privacy Act (NHDPA) — N.H. Rev. Stat. ch. 507-H
15. Nebraska Data Privacy Act (NDPA) — Neb. Rev. Stat. §§ 87-1101 et seq.
16. Minnesota Consumer Data Privacy Act (MCDPA) — Minn. Stat. ch. 325O
17. Maryland Online Data Privacy Act (MODPA) — Md. Code, Com. Law §§ 14-4601 et seq.
18. Kentucky Data Privacy Act (KYDPA) — Ky. Rev. Stat. ch. 367
19. Additional statutes enacted or effective through the 2025–2026 legislative cycle as identified during the engagement.
Cascade operates retail locations in thirty-one (31) US states and ships e-commerce orders to all fifty (50) states plus the District of Columbia. The geographic scope of Cascade's consumer base, combined with the broad applicability thresholds of most state privacy statutes (typically triggered by processing data of a specified number of residents or deriving a specified percentage of revenue from data sales), results in Cascade triggering applicability of virtually all enacted comprehensive state privacy statutes. We have confirmed applicability of each of the nineteen statutes listed above based on publicly available information regarding Cascade's revenue, transaction volumes, and consumer counts, and we do not anticipate any statute being excluded on threshold grounds.
Throughout this memorandum, we reference key CCPA/CPRA definitions that are central to the classification of data flows, including: "sale" (§ 1798.140(ad)), "sharing" (§ 1798.140(ah)), "service provider" (§ 1798.140(ag)), "contractor" (§ 1798.140(j)), "third party" (§ 1798.140(ai)), "business purpose" (§ 1798.140(e)), "commercial purpose" (§ 1798.140(f)), and "sensitive personal information" (§ 1798.140(ae)). Where other state statutes define analogous concepts differently — for example, Virginia's "sale" definition, which requires monetary consideration and does not encompass "other valuable consideration" — we note those distinctions in context.
D. Cascade Corporate Structure — Entities in Scope
Cascade's corporate family includes five entities within the scope of the Fieldhaven data-mapping exercise and this legal review. An understanding of the corporate structure is essential to the legal classification of data flows, particularly with respect to intra-group transfers, which receive different treatment under CCPA/CPRA (through the "common branding" business-family exception) than disclosures to unaffiliated third parties.
The five entities in scope are as follows:
1. Cascade Retail Holdings Inc. (parent entity; Delaware corporation; EIN: 84-3192057). Cascade Retail Holdings is the publicly traded parent entity and operates the core direct-to-consumer retail business and e-commerce platform at cascade.com. This entity is the primary "business" for CCPA purposes and is the entity that collects the majority of consumer personal information through its online and in-store channels.
2. Cascade Digital Marketplace LLC ("CDM") (Delaware limited liability company; EIN: 85-4107638). CDM operates the third-party seller marketplace at cascade.com/marketplace, which hosts approximately 3,800 third-party sellers. CDM collects and processes consumer data generated through marketplace transactions, seller account information, and related commercial data. CDM is a wholly owned subsidiary of Cascade Retail Holdings.
3. Ridgeline Fulfillment Services Inc. ("Ridgeline") (Washington corporation; EIN: 91-1647823). Ridgeline operates warehousing and logistics services for Cascade's retail and e-commerce operations, including order fulfillment, shipping, and returns processing. Ridgeline processes shipping addresses, order data, and limited consumer contact information for delivery coordination purposes. Ridgeline is a wholly owned subsidiary of Cascade Retail Holdings.
4. Peakview Analytics Inc. ("Peakview") (Delaware corporation; EIN: 87-2250194). Peakview is Cascade's in-house advertising technology and customer analytics subsidiary. Peakview receives consumer-event data from across the Cascade ecosystem and processes it for audience segmentation, ad targeting, personalization, and analytics purposes. Peakview is a wholly owned subsidiary of Cascade Retail Holdings and is the most data-intensive entity in the corporate family.
5. Cascade Rewards Corp. ("Cascade Rewards") (Delaware corporation; EIN: 86-3381729). Cascade Rewards operates the Cascade Rewards loyalty and stored-value card programs. With approximately 41.2 million registered members, Cascade Rewards maintains one of the largest consumer databases within the Cascade ecosystem. Cascade Rewards is a wholly owned subsidiary of Cascade Retail Holdings.
All five entities share common branding under the "Cascade" trade name and are under common ownership and control of Cascade Retail Holdings Inc. For CCPA/CPRA purposes, data transfers among these entities may qualify for the "common branding" business-family treatment under Section 1798.140(c), which defines "business" to include entities that share common branding and that are under the control of the same parent entity, provided that common branding is reasonably understood by consumers. We discuss the implications of this structure for specific data flows in Section V below.
III. Scope and Methodology of the Fieldhaven Report
A. Data-Mapping Scope
Fieldhaven mapped data flows across all five Cascade entities identified in Section II.D above. The scope of the data-mapping exercise was defined in the Fieldhaven statement of work and further refined during the data-mapping workshop held on June 16, 2025. The scope encompassed the following systems, platforms, and data environments:
• Consumer-facing digital properties: cascade.com (including cascade.com/marketplace), the Cascade mobile application (iOS and Android), and in-store point-of-sale ("POS") systems deployed across all 186 retail locations.
• Backend analytics infrastructure: Peakview's analytics servers, data warehouses, audience-segmentation engines, and ad-delivery platforms.
• Loyalty-program databases: Cascade Rewards Corp.'s member database, points-management system, stored-value card records, and associated marketing platforms.
• Marketplace platform: CDM's seller-management system, marketplace transaction database, and the unified data lake into which marketplace data flows.
• Fulfillment and logistics data: Ridgeline's order-management system, warehouse-management system, and carrier-integration platforms.
Within these environments, Fieldhaven catalogued seven core data-mapping elements as follows: (i) categories of personal information collected; (ii) sources of collection (direct from consumer, from consumer's device, or from third-party sources); (iii) purposes of processing; (iv) internal data flows between Cascade entities; (v) external data flows to third parties, including vendors, partners, and service providers; (vi) tracking technologies deployed on consumer-facing digital properties; and (vii) data storage locations and retention practices (to the extent documented or observable).
The resulting data map provides a comprehensive — though, as noted below, not complete — picture of how consumer personal information enters, moves through, and exits the Cascade ecosystem.
B. Methodology
Fieldhaven employed a multi-modal methodology combining automated and manual techniques to develop the data map. The methodology included the following components:
• Automated scanning tools: Fieldhaven deployed network-traffic analysis tools to observe data flows between Cascade systems and external endpoints. Cookie and tracker scanning was performed on cascade.com and the Cascade mobile application to identify all cookies, pixels, tags, and other tracking technologies deployed on consumer-facing surfaces.
• Manual system inventories: Fieldhaven's technical team conducted manual reviews of system configurations, database schemas, API integrations, and data-pipeline architectures across all five entities.
• Stakeholder interviews: Fieldhaven conducted structured interviews with key Cascade personnel, including Priya Nandakumar (Vice President, Data & Analytics), Jason Leclaire (Vice President, Marketing & Customer Engagement), and Gregory Farris (Chief Information Security Officer). These interviews supplemented the automated and manual findings with institutional knowledge of data practices, business purposes, and historical context.
• Documentation review: Fieldhaven reviewed existing privacy policies, vendor contracts, system architecture documentation, data-flow diagrams, and internal process documents provided by Cascade.
Calderwood & Harkness's review, as reflected in this memorandum, applies legal classification frameworks to Fieldhaven's factual findings. We have not independently verified the accuracy of Fieldhaven's technical observations but have accepted them as a reasonable basis for legal analysis, subject to the limitations noted in Section III.C below.
C. Limitations Noted
The following limitations were noted by Fieldhaven in the report and should be borne in mind when evaluating the completeness of the data map and the resulting legal analysis:
First, Fieldhaven noted that certain legacy systems — specifically, two legacy POS platforms used in approximately 28 retail locations that are scheduled for migration to the current POS platform during Q3–Q4 2025 — were not fully accessible during the mapping period due to system-access restrictions and incompatible data formats. Data flows associated with these legacy systems may include additional categories of personal information or additional external recipients not reflected in the current data map. We recommend that supplemental mapping be undertaken once the legacy POS migration is complete, or earlier if system access can be obtained.
Second, the Fieldhaven Report does not include employee or human-resources data flows. The employee privacy-notice workstream is being addressed separately and will involve a distinct data-mapping exercise focused on employee, applicant, and contractor personal information. This is consistent with the engagement scope and the phased approach to Cascade's compliance program.
Third, the Fieldhaven Report is a factual and technical document. It does not contain legal analysis, legal classifications, or compliance conclusions. The application of legal frameworks to Fieldhaven's factual findings is the purpose of this memorandum and the broader Calderwood & Harkness engagement.
IV. Categories of Personal Information Collected
A. Overview of PI Categories Identified
The Fieldhaven Report identifies the following categories of personal information collected by Cascade across its five entities and consumer-facing platforms. We present these categories using the CCPA/CPRA statutory taxonomy (Cal. Civ. Code § 1798.140(v)), which provides the most granular and widely referenced classification framework among the applicable state statutes.
Identifiers. Cascade collects a broad range of identifiers from consumers, including: real name, email address, postal/mailing address, phone number, unique account identification number, Cascade Rewards member identification number, Internet Protocol ("IP") address, mobile device identifiers (including advertising identifiers such as IDFA and GAID), and cookie identifiers. Identifiers are collected directly from consumers during account creation, purchase transactions, and loyalty-program enrollment, as well as automatically from consumer devices during browsing and mobile-app interactions.
Commercial Information. Cascade collects commercial information including records of products and services purchased, obtained, or considered; purchase transaction amounts; payment method type (credit card, debit card, digital wallet, stored-value card); purchase frequency and recency data; product return and exchange records; and shopping-cart contents (including abandoned-cart data). Commercial information is collected through cascade.com, the Cascade mobile app, and in-store POS systems, and is aggregated within the Peakview analytics environment.
Internet or Other Electronic Network Activity Information. Cascade collects detailed records of consumer interactions with its digital properties, including: browsing history on cascade.com, search queries entered on the site and in the mobile app, click-stream data (recording the sequence of pages visited and interactions with page elements), page-view records, time-on-page metrics, interaction with advertisements displayed on cascade.com or served through third-party advertising partners, referral source data, and session metadata. This category also encompasses data collected through the twelve categories of cookies and tracking technologies catalogued by Fieldhaven (see Section VI below).
Geolocation Data. Cascade collects geolocation data in two forms. First, approximate geolocation data is derived from IP addresses associated with consumer browsing sessions. Second — and of greater legal significance — precise geolocation data (latitude and longitude coordinates) is collected from the Cascade mobile application when location services are enabled on the consumer's device. Precise geolocation data is transmitted to Peakview for analytics, ad targeting, and personalization purposes. The collection and processing of precise geolocation data triggers sensitive personal information provisions under multiple state statutes, as discussed in Section IV.B below.
Inferences. Peakview draws inferences from the foregoing categories of personal information to create consumer profiles, including: purchasing propensity scores (predicting likelihood of purchase in specific product categories), lifestyle segment assignments, ad-targeting profiles, brand-affinity scores, price-sensitivity indicators, and churn-risk scores. These inferred attributes constitute personal information under CCPA/CPRA and are used internally for personalization and externally for audience-segment targeting through third-party advertising partners.
Sensitive Personal Information. As detailed in Section IV.B below, the data map confirms that Cascade collects and processes the following categories of sensitive personal information: (i) precise geolocation data, (ii) payment-card data (card number, expiration date, and CVV — tokenized post-collection), and (iii) account login credentials (username and password hashes).
B. Legal Significance — Sensitive Personal Information
The identification of sensitive personal information in Cascade's data ecosystem carries heightened legal significance under CCPA/CPRA and multiple other state statutes. Each of the three categories identified warrants specific attention.
Precise Geolocation Data. Precise geolocation data — defined under CCPA/CPRA as any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet (Cal. Civ. Code § 1798.140(w)) — is collected through the Cascade mobile application and processed by Peakview for ad targeting and personalization. Precise geolocation constitutes "sensitive personal information" under CCPA/CPRA Section 1798.140(ae)(1)(G) and is subject to the consumer's right to limit its use and disclosure under Section 1798.121.
Payment-Card Data. Payment-card data, including card number, expiration date, and CVV, is collected during purchase transactions. Fieldhaven confirmed that payment-card data is tokenized post-collection, which reduces breach-related risk, but the initial collection of full payment-card data constitutes sensitive personal information under CCPA/CPRA Section 1798.140(ae)(1)(D) (financial account information combined with any required security code, access code, or password that would permit access to an account). The tokenization architecture should be documented and verified as part of the data-security workstream.
Account Login Credentials. Consumer account login credentials — specifically, username and password hashes — are stored in Cascade's account-management system. Login credentials constitute sensitive personal information under CCPA/CPRA Section 1798.140(ae)(1)(D) (account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account).
Under CCPA/CPRA Section 1798.121, consumers have the right to limit the use and disclosure of sensitive personal information to that which is necessary to perform the services or provide the goods reasonably expected by an average consumer. To honor this right, Cascade must provide a clear and conspicuous link on its homepage titled "Limit the Use of My Sensitive Personal Information" (or a combined link with the opt-out-of-sale/sharing mechanism). No such mechanism currently exists on cascade.com or in the Cascade mobile app.
Beyond CCPA/CPRA, multiple other state statutes impose affirmative opt-in consent requirements for the processing of sensitive data, including the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, Oregon OCPA, Montana MCDPA, and others. The requirement for opt-in consent under these statutes is more stringent than CCPA/CPRA's limitation mechanism and will require a consent-flow implementation that addresses the most protective standard across all applicable jurisdictions.
Current State and Compliance Gap. The Fieldhaven Report confirms that precise geolocation is collected through the Cascade mobile app and processed by Peakview for ad targeting and personalization without any separate consent flow, opt-in mechanism, or right-to-limit functionality. This is a significant compliance gap requiring remediation. A separate Sensitive Personal Information Analysis Memorandum is forthcoming and will address this issue in greater detail, including recommended consent architectures and implementation timelines.
V. Legally Significant Data Flows — Detailed Analysis
This Section provides a detailed analysis of each legally significant data flow identified in the Fieldhaven Report. For each data flow, we describe the factual findings from the Fieldhaven Report, apply the relevant CCPA/CPRA classification framework, note additional state-statute implications where material, and provide remediation recommendations.
A. Peakview Analytics Inc. — Consumer-Event Data Processing
1. Factual Findings
Peakview Analytics Inc. is the most data-intensive entity within the Cascade corporate family. The Fieldhaven Report documents that Peakview processes approximately 2.1 billion consumer-event data records per month. This volume reflects the aggregation of consumer interactions from across the Cascade ecosystem, including:
• Click-stream data from cascade.com browsing sessions;
• Product-view events and search queries from the website and mobile app;
• Purchase-event records from cascade.com and in-store POS systems;
• Ad impressions and ad-click events from advertising served on cascade.com and through external advertising networks;
• Precise geolocation pings from the Cascade mobile application; and
• Inferred profile attributes derived from the foregoing data through Peakview's audience-segmentation and predictive-modeling engines.
The data types processed by Peakview span nearly all categories of personal information identified in Section IV above. Peakview's processing activities include: real-time event ingestion and normalization; consumer-identity resolution (matching events across devices and sessions to unified consumer profiles); audience segmentation and cluster analysis; predictive scoring (purchasing propensity, churn risk, price sensitivity); ad-targeting profile construction; and campaign-performance measurement and attribution.
2. CCPA Classification
Peakview is a wholly owned subsidiary of Cascade Retail Holdings Inc. For CCPA purposes, the relevant question is whether Peakview's receipt and processing of consumer personal information from Cascade constitutes a disclosure to a "third party" or, alternatively, falls within the intra-business-family treatment.
Under CCPA/CPRA Section 1798.140(c), "business" includes an entity that controls or is controlled by a business and that shares common branding with the business. All five Cascade entities share common branding under the "Cascade" name and are under the common ownership and control of Cascade Retail Holdings Inc. Accordingly, Peakview's receipt of consumer data from Cascade Retail Holdings (or from other Cascade entities) does not, in itself, constitute a "sale" or "sharing" under CCPA/CPRA, because the transfer occurs within the same "business" as defined by the statute.
However, Peakview's role does not end with internal processing. The Fieldhaven Report confirms that Peakview's outputs — specifically, audience segments, targeting profiles, and ad-delivery decisions — are transmitted to external third-party advertising partners. These downstream transmissions from Peakview to external recipients trigger the sale/sharing analysis discussed in Section V.B below. The fact that the data originates from within the Cascade corporate family does not immunize the subsequent disclosure to an unaffiliated third party from CCPA classification.
3. Recommendations.
(a) Confirm and document that Peakview's data processing falls within the "common branding" business-family exception under CCPA/CPRA Section 1798.140(c), and maintain records sufficient to demonstrate common branding and common ownership/control. This documentation should be included in Cascade's record-of-processing-activities.
(b) Ensure that Peakview's downstream transmissions to third parties are fully captured in the DPA and data-sharing framework under development. Each external recipient of Peakview-generated audience segments, targeting data, or other outputs containing or derived from consumer personal information must be subject to an appropriate contractual arrangement (service-provider, contractor, or sale/sharing agreement with opt-out pass-through).
(c) Evaluate whether the volume and nature of Peakview's processing activities warrant a separate data-protection impact assessment ("DPIA") under state statutes that require DPIAs for processing activities presenting a heightened risk of harm to consumers (e.g., Colorado CPA § 6-1-1309; Connecticut CTDPA § 42-520).
B. Third-Party Advertising and Analytics Partners — 47 External Recipients
1. Overview. The Fieldhaven Report identifies a total of forty-seven (47) third-party advertising and analytics partners to whom Cascade discloses consumer personal information. These partners span a range of functional categories, including demand-side platforms, data-management platforms, social-media advertising platforms, programmatic-advertising exchanges, retargeting/remarketing service providers, attribution and measurement providers, and site-analytics providers.
The data shared with these partners includes, depending on the specific partner relationship: hashed email addresses, mobile-device identifiers (IDFA, GAID), cookie identifiers, browsing and purchase behavioral signals, audience-segment memberships, product-interaction data, and in some cases precise geolocation data. The purposes of the data sharing include programmatic advertising, retargeting and remarketing, lookalike-audience modeling, campaign attribution and measurement, and site analytics. A complete listing of all 47 partners, together with data types shared, estimated volumes, DPA status, preliminary CCPA classification, and risk rating, is set forth in Appendix B to this memorandum.
2. CCPA Classification of Data Flows
The CCPA/CPRA provides four principal categories under which a disclosure of personal information to an external party may be classified: sale, sharing, service-provider processing, and contractor processing. The classification of each of the 47 partner relationships determines the applicable consumer rights and business obligations.
"Sharing" (Cross-Context Behavioral Advertising). The majority of the 47 partner relationships involve the disclosure of consumer personal information for cross-context behavioral advertising — that is, the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses, distinctly branded websites, applications, or services other than the business, distinctly branded website, application, or service with which the consumer intentionally interacts. Under CCPA/CPRA Section 1798.140(ah), such disclosure constitutes "sharing" regardless of whether monetary or other valuable consideration is exchanged.
The classification of these data flows as "sharing" triggers two critical obligations: (i) the obligation to provide consumers with the right to opt out of sharing through a "Do Not Share My Personal Information" link (which may be combined with the opt-out-of-sale link) (§ 1798.120(a)); and (ii) the obligation to honor the Global Privacy Control (GPC) signal as a valid opt-out-of-sharing mechanism (Cal. Code Regs. tit. 11, § 7025). Cascade currently implements neither of these mechanisms. This is a compliance gap of the first order.
"Sale." Certain partner arrangements involve Cascade receiving monetary or other valuable consideration in exchange for the disclosure of consumer personal information. Under CCPA/CPRA Section 1798.140(ad), "sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer's personal information for monetary or other valuable consideration. Unlike several other state statutes (e.g., Virginia's VCDPA, which limits "sale" to exchanges for monetary consideration), the CCPA/CPRA's definition of "sale" extends to exchanges for "other valuable consideration," which may include advertising services, data enrichment, or other non-monetary benefits received by the business.
The Thornbridge Media Corp. relationship, discussed in detail in Section V.C below, is the most significant example of a data flow that constitutes a "sale" under CCPA/CPRA. Other partner relationships may also constitute sales depending on the consideration flowing from the partner to Cascade; this determination requires a partner-by-partner analysis that will be completed in the Third-Party Data-Sharing Risk Assessment Memorandum (target: August 4, 2025).
"Service Provider" Processing. A subset of the 47 partners may qualify as CCPA "service providers" if their contracts contain the restrictions required by Section 1798.140(ag), including: (i) a prohibition on selling or sharing the personal information received from or on behalf of the business; (ii) a requirement that the service provider use the personal information only for the specified business purposes set forth in the contract; (iii) a prohibition on retaining, using, or disclosing the personal information for any commercial purpose other than the specified business purposes; (iv) a prohibition on retaining, using, or disclosing the personal information outside of the direct business relationship between the service provider and the business; and (v) a certification that the service provider understands and will comply with these restrictions.
Currently, only twenty-four (24) of the 47 partners have executed DPAs with Cascade. Of those 24, the legal sufficiency of the existing agreements under the CCPA/CPRA service-provider requirements has not yet been assessed; many of these agreements predate the CPRA amendments and may lack required provisions. We will conduct a detailed review of the 24 existing DPAs as part of the immediate-priority workstream described in Section X.A.
"Contractor" Processing. Partners receiving personal information subject to written contracts with contractor-level restrictions may qualify as "contractors" under CCPA/CPRA Section 1798.140(j). The contractor classification requires, in addition to the service-provider restrictions, that the contract prohibit the contractor from combining the personal information received from or on behalf of the business with personal information that it receives from or on behalf of another person or persons, or that it collects from its own interaction with the consumer. The contractor classification may be appropriate for certain partners that process data exclusively for Cascade's benefit and do not commingle Cascade data with other clients' data.
3. DPA Coverage Gap
The DPA coverage gap is among the most significant compliance deficiencies identified through the data map. Twenty-three (23) of the 47 third-party advertising and analytics partners lack executed data-processing agreements with Cascade. Without DPAs containing the contractual provisions required by CCPA/CPRA Sections 1798.140(ag) and (j), disclosures to these partners cannot qualify as service-provider or contractor processing and must be classified as sales or sharing. This classification triggers the full panoply of consumer opt-out rights, including the right to opt out of sale and sharing, and creates regulatory enforcement risk under CCPA/CPRA and other state statutes that require contractual safeguards for data disclosures.
Recommendation: Prioritize the DPA rollout to the 23 uncovered partners, using the service-provider and contractor DPA templates currently under development by Calderwood & Harkness. Target finalization of DPA templates: September 30, 2025. Target execution of DPAs with all 23 uncovered partners: December 31, 2025. The Third-Party Data-Sharing Risk Assessment Memorandum (forthcoming, target August 4, 2025) will provide a detailed partner-by-partner classification and a recommended order of priority for DPA negotiations based on data volume, data sensitivity, and risk rating. A summary table of all 47 partners is provided in Appendix B.
C. Thornbridge Media Corp. — Primary Advertising/Data-Sharing Partner
1. Factual Findings
Thornbridge Media Corp. ("Thornbridge"), a Nevada corporation headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117, is Cascade's primary programmatic-advertising and audience-targeting partner. The Thornbridge relationship is the single largest external data-sharing arrangement identified in the Fieldhaven Report, both in terms of data volume and financial magnitude.
Cascade's FY2024 spend with Thornbridge totaled approximately $18.4 million, encompassing programmatic ad buying, audience targeting and optimization services, campaign attribution and measurement, and related advertising technology services. The financial scale of this relationship reflects Thornbridge's central role in Cascade's digital-advertising operations.
The data flows between Cascade and Thornbridge, as documented in the Fieldhaven Report, include the following: Cascade transmits to Thornbridge customer behavioral data consisting of browsing activity on cascade.com, purchase-history records, device identifiers (IDFA, GAID, cookie IDs), audience-segment memberships generated by Peakview, and in some cases precise geolocation data from the Cascade mobile app. Thornbridge uses this data for programmatic ad buying on Cascade's behalf, audience targeting and lookalike-audience modeling, retargeting and remarketing across third-party publisher inventory, and campaign-performance measurement and attribution.
2. Current Contractual Framework
The existing Cascade-Thornbridge agreement was executed prior to the effective date of the CPRA amendments and does not contain CCPA/CPRA-compliant data-processing terms. Specifically, the existing agreement:
(a) Does not include the contractual restrictions required for service-provider or contractor classification under CCPA/CPRA (including prohibition on selling/sharing, use-limitation to specified business purposes, prohibition on retention outside the direct business relationship, and compliance certification);
(b) Does not include opt-out-of-sale/sharing pass-through mechanisms obligating Thornbridge to honor consumer opt-out requests forwarded by Cascade;
(c) Does not include GPC signal-honoring requirements;
(d) Does not address consumer-rights assistance obligations (cooperation with access, deletion, and correction requests);
(e) Does not include audit-rights provisions permitting Cascade to verify Thornbridge's compliance with data-use restrictions; and
(f) Does not include breach-notification provisions requiring Thornbridge to notify Cascade promptly in the event of a data breach affecting Cascade consumer data.
3. CCPA Classification
The Thornbridge relationship involves both "sale" and "sharing" under CCPA/CPRA, as follows:
Sale. Cascade receives advertising services, technology platform access, and a revenue-share arrangement in exchange for the disclosure of consumer personal information to Thornbridge. The advertising services and revenue-share constitute "monetary or other valuable consideration" under Section 1798.140(ad), and the exchange of consumer data for these benefits constitutes a "sale."
Sharing. Thornbridge uses the consumer data received from Cascade for cross-context behavioral advertising — specifically, targeting advertising to Cascade customers across third-party publisher inventory based on behavioral data collected from the customers' interactions with cascade.com. This constitutes "sharing" under Section 1798.140(ah).
The dual classification of the Thornbridge relationship as both a sale and a sharing triggers the full complement of consumer opt-out rights under CCPA/CPRA, including the right to opt out of sale and the right to opt out of sharing, and requires the implementation of opt-out mechanisms and GPC signal honoring. As noted above, Cascade currently implements none of these mechanisms.
4. Risk Assessment
The Thornbridge relationship is the highest-risk third-party data relationship identified in the data map. The combination of (i) the volume and sensitivity of data shared, (ii) the absence of CCPA-compliant contractual terms, (iii) the dual sale/sharing classification, (iv) the financial magnitude of the relationship, and (v) the involvement of precise geolocation data (a category of sensitive personal information) creates substantial regulatory enforcement risk and potential consumer-litigation exposure.
5. Counterparty Information
Thornbridge is represented by Kellner Park & Associates LLP, with lead attorney Victor Sandoval located at 555 Mission Street, 32nd Floor, San Francisco, California 94105. Thornbridge's General Counsel is Leah Voss, and its Chief Executive Officer is Robert Shin. Calderwood & Harkness should expect that Thornbridge will be represented by experienced privacy counsel and that the restructuring negotiation will involve substantive legal engagement on data-classification and risk-allocation issues.
6. Recommendation. The Thornbridge data-sharing agreement must be restructured as a matter of the highest priority. We recommend the following approach:
(a) Negotiate and execute a restructured Cascade-Thornbridge data-sharing agreement that addresses CCPA sale/sharing classification, includes appropriate data-use limitations, and incorporates the contractual provisions required for any data flows that are to be treated as service-provider or contractor processing.
(b) Include GPC signal pass-through provisions obligating Thornbridge to honor opt-out-of-sale/sharing signals forwarded by Cascade.
(c) Include consumer-rights assistance provisions obligating Thornbridge to cooperate with Cascade in responding to consumer access, deletion, correction, and opt-out requests.
(d) Include audit-rights provisions permitting Cascade (or its designated auditor) to verify Thornbridge's compliance with data-use restrictions.
(e) Include breach-notification provisions requiring Thornbridge to notify Cascade within a specified timeframe (recommended: 48 hours) of discovering a data breach affecting Cascade consumer data.
(f) Target execution date: October 31, 2025.
We anticipate that this negotiation will be complex given the financial scale of the relationship and the likelihood that Thornbridge will resist classification of certain data flows as sales or sharing. Calderwood & Harkness should be prepared to engage directly with Victor Sandoval at Kellner Park & Associates on these issues.
D. Cascade Digital Marketplace LLC — Third-Party Seller Data Commingling
1. Factual Findings
CDM hosts approximately 3,800 third-party sellers on cascade.com/marketplace. The marketplace platform enables third-party sellers to list products, process transactions with consumers, and access fulfillment and logistics services through Ridgeline.
The Fieldhaven Report reveals a significant architectural concern: seller-originated data — including seller account information, seller transaction data, and consumer data generated through marketplace transactions (consumer name, shipping address, order details, payment information) — is commingled with Cascade's first-party customer data in a single unified data lake. The unified data lake does not employ role-based access controls ("RBAC") or logical segregation mechanisms to distinguish seller-originated data from Cascade-originated data, or to restrict access based on the source or authorized use of the data.
2. Legal Concerns
The data-commingling issue raises several interconnected legal concerns:
Cross-Contamination Risk. If seller data includes personal information collected under different privacy notices or with different consumer consents than Cascade's first-party data, commingling creates unauthorized secondary uses. For example, a consumer who purchases a product from a third-party seller on cascade.com/marketplace may reasonably expect that the personal information provided for that transaction is subject to the seller's privacy notice, or to a marketplace-specific privacy notice, rather than to Cascade's broader data-use practices. If that consumer's data is commingled with Cascade's first-party customer data and used for Peakview analytics, audience segmentation, or third-party advertising — purposes that were not disclosed or consented to in connection with the marketplace transaction — Cascade may be processing the data in a manner that exceeds the scope of the consumer's reasonable expectations and the applicable privacy notice.
CCPA Service-Provider/Business Distinction. The legal relationship between CDM and its third-party sellers must be clearly defined. CDM may function as a "business" independently (if it determines the purposes and means of processing for marketplace transactions), or it may function as a "service provider" to its sellers (if it processes personal information on behalf of and at the direction of the sellers). The current commingled architecture prevents clean legal classification, because the absence of data segregation makes it impossible to demonstrate that CDM processes seller-originated consumer data only for specified business purposes and at the direction of the sellers. This ambiguity creates risk under CCPA and other state statutes that require clear delineation of controller and processor roles.
Multi-State Data Minimization and Purpose Limitation. Several state statutes impose data-minimization and purpose-limitation requirements that are directly implicated by the commingling issue. The Colorado CPA (§ 6-1-1308(4)) requires controllers to limit the collection of personal data to what is adequate, relevant, and reasonably necessary in relation to the purposes for which the data is processed. The Connecticut CTDPA (§ 42-517(a)(1)) and Virginia VCDPA (§ 59.1-578(A)(1)) impose similar requirements. The commingling of seller-originated consumer data with Cascade's first-party data — and the use of commingled data for purposes beyond those disclosed in connection with the marketplace transaction — inherently conflicts with these data-minimization and purpose-limitation principles.
3. Recommendation.
(a) Implement data segregation — either logical or physical — between marketplace seller/consumer data and Cascade first-party customer data. Logical segregation (through tagging, access controls, and data-classification metadata) may be sufficient if properly implemented and enforced, and is likely more cost-effective than physical segregation.
(b) Establish role-based access controls restricting access to seller-originated consumer data to authorized personnel and systems with a legitimate, disclosed purpose for accessing that data.
(c) Develop marketplace seller data-use terms governing data responsibilities between CDM and its approximately 3,800 third-party sellers. These terms should define the respective roles of CDM and each seller as controller, processor, or joint controller for marketplace transaction data, and should specify the purposes for which CDM may process seller-originated consumer data.
(d) This remediation should be coordinated with Fieldhaven's technical implementation workstream and is a prerequisite for establishing compliant DPA structures with marketplace sellers. Gregory Farris (CISO) should be engaged on the data-segregation and RBAC implementation requirements.
E. Cascade Rewards Corp. — Loyalty Program Data
1. Factual Findings
Cascade Rewards Corp. manages the Cascade Rewards loyalty program, which currently has approximately 41.2 million registered members across all fifty US states and the District of Columbia. The program is one of the largest consumer-data repositories in the Cascade ecosystem.
Personal information collected through the loyalty program includes: member name, email address, mailing address, phone number, date of birth, purchase history (linked to the member's Cascade Rewards account), points balance, stored-value card data, product preferences, and marketing communication preferences. Loyalty-program data is stored in Cascade Rewards Corp.'s member database and is shared internally with Peakview for analytics and audience segmentation and with certain third-party advertising partners for targeted marketing campaigns.
2. CCPA Financial Incentive Analysis
The Cascade Rewards program constitutes a "financial incentive" program under CCPA/CPRA Section 1798.125(b). A "financial incentive" includes a program that provides the consumer with a price or service difference in exchange for the consumer's provision of personal information. The Cascade Rewards program offers members points-based rewards, exclusive discounts, early access to sales, and stored-value card benefits in exchange for the collection and use of member personal information (including purchase history, preferences, and behavioral data).
Under Section 1798.125(b)(2), a business offering a financial incentive must notify consumers of the financial incentive and its material terms before the consumer opts in. The notice must also explain the method by which the business calculates the value of the consumer's personal information and the consumer's right to withdraw from the program at any time.
Cascade's current privacy policy does not include a financial-incentive notice, does not disclose the method for calculating the value of consumer data in connection with the Cascade Rewards program, and does not clearly describe the consumer's right to withdraw from the program. This is a compliance gap that must be addressed in the omnibus privacy-policy drafting workstream (target: September 12, 2025).
3. Data Sharing Concerns
The sharing of loyalty-program data with Peakview for analytics and audience segmentation is an intra-entity transfer within the Cascade business family and does not independently trigger sale/sharing classification. However, the subsequent use of loyalty-program-derived audience segments and targeting profiles for third-party advertising — including disclosure to external partners — does trigger the sale/sharing analysis discussed in Section V.B.
The sharing of loyalty-program data with third-party advertising partners for targeted marketing purposes creates heightened risk given the volume and richness of the data (41.2 million members, with detailed purchase history and preferences) and the sensitivity of certain data elements (e.g., date of birth). These data flows must be included in the DPA framework and subject to appropriate contractual restrictions.
4. Data Retention
The Fieldhaven Report confirms that no documented retention schedule currently exists for loyalty-program data. Member records, including those of inactive members who have not engaged with the program for multiple years, are retained indefinitely. This practice is inconsistent with data-minimization requirements under CCPA/CPRA and multiple other state statutes and must be addressed as part of the Data Retention & Disposal Schedule workstream (target: October 2025).
F. Ridgeline Fulfillment Services Inc. — Logistics Data
1. Factual Findings