PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION — ATTORNEY WORK PRODUCT
MEMORANDUM
FROM: Kevin Ostrowski, Partner Privacy & Data Security Practice Group Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
TO: Audit & Risk Committee of the Board of Directors Cascade Retail Holdings Inc.
Attention: Ellen Marchetti, Chair
CC: Thomas R. Cavanaugh, Chief Executive Officer Meredith Tanaka, General Counsel Diana Polk, Associate General Counsel / Interim Chief Privacy Officer
November 7, 2025
RE: Privacy Program Status Report for November 13, 2025 Board Meeting
MATTER NO.: 1038-00010
PRIVILEGE NOTICE: This memorandum is prepared by outside counsel at the direction of the General Counsel of Cascade Retail Holdings Inc. and is protected by the attorney-client privilege and the work-product doctrine. It is furnished to the Audit & Risk Committee of the Board of Directors in its governance-oversight capacity and should not be distributed beyond the Committee, the Board, and the identified executive recipients without the prior written approval of the General Counsel. Inadvertent disclosure of this memorandum to any third party does not constitute a waiver of any applicable privilege or protection.
I. Executive Summary
The purpose of this memorandum is to provide the Audit & Risk Committee of the Board of Directors of Cascade Retail Holdings Inc. ("Cascade" or the "Company") with a comprehensive status update on the Company's US State Privacy Compliance Program (the "Program") as of early November 2025, in advance of the regularly scheduled Board meeting on November 13, 2025. This memorandum summarizes the work performed to date, the current status of each Phase 1 milestone, the remediation of identified compliance gaps, key contract negotiations, budget matters, the regulatory risk landscape, and recommended Board actions.
Calderwood & Harkness LLP ("C&H") was engaged as outside privacy counsel on June 2, 2025, pursuant to an engagement letter executed by the General Counsel, to design, build, and implement a comprehensive privacy compliance program covering the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the expanding patchwork of state privacy statutes across all jurisdictions in which Cascade operates. The engagement was prompted by a combination of factors, including the rapid proliferation of state privacy legislation, Cascade's prior regulatory interactions with the Federal Trade Commission and the California Attorney General, and the Company's recognition that its existing privacy practices required substantial modernization to meet current legal requirements and industry best practices.
The Program addresses the full scope of Cascade's consumer-facing and enterprise data-processing activities, including:
• Cascade's direct-to-consumer retail operations across 186 brick-and-mortar stores located in 31 states;
• The Company's e-commerce platform (cascade.com and the Cascade mobile application), which processed approximately 94 million online transactions in FY2024;
• Cascade Digital Marketplace LLC, the Company's third-party marketplace subsidiary, which hosts approximately 3,800 active third-party sellers;
• The Cascade Rewards loyalty program, operated through Cascade Rewards Corp., with approximately 41.2 million registered members as of the date of this memorandum;
• The Company's advertising-technology stack, operated principally through Peakview Analytics Inc., which processes approximately 2.1 billion consumer-event data records per month; and
• Key vendor and partner data practices, including data-sharing arrangements with 47 third-party advertising and analytics partners.
As of the date of this memorandum, Phase 1 of the Program is on track for completion by December 31, 2025, with the majority of deliverables either completed or in advanced stages of development. The remaining key milestones are as follows:
• DSR Workflow Go-Live: December 1, 2025 — Fieldhaven Consulting Group LLC is implementing automated data-subject-request ("DSR") processing with CCPA-compliant identity verification and statutory appeal-process functionality.
• Consent-Management Platform Deployment: December 15, 2025 — OnPoint Data Solutions Inc.'s consent-management platform ("CMP") is being configured for deployment across cascade.com and the Cascade mobile application, including recognition of Global Privacy Control ("GPC") signals.
• Compliance-Readiness Certification Memorandum: December 31, 2025 — C&H will issue a memorandum certifying Cascade's readiness to comply with all 19 currently applicable state privacy statutes upon completion of all Phase 1 deliverables.
Finally, and of particular importance for the November 13 meeting, the Committee is being asked to consider and recommend to the full Board the adoption of the Privacy Governance Charter, a draft of which has been circulated separately along with a proposed Board resolution. The Charter would formalize the Chief Privacy Officer role, establish quarterly reporting obligations to the Committee, and create a board-level governance framework for ongoing privacy-program oversight.
II. Background and Engagement Overview
A. Cascade's Data Processing Profile
Cascade Retail Holdings Inc. is a Delaware corporation (Nasdaq: CSRD; EIN: 84-3192057), headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Cascade is an omnichannel retailer with FY2024 revenue of approximately $3.87 billion and approximately 22,500 employees across its retail, e-commerce, fulfillment, analytics, and corporate operations.
The Company's data-processing activities are carried out through Cascade and the following key subsidiaries, each of which collects, processes, or shares personal information of consumers, employees, or business contacts:
• Cascade Digital Marketplace LLC (EIN: 85-4107638) — Operates the Company's third-party seller marketplace platform, which hosts approximately 3,800 active sellers and facilitates transactions between those sellers and Cascade's customer base.
• Ridgeline Fulfillment Services Inc. (EIN: 91-1647823) — Provides fulfillment, warehousing, and shipping logistics for both first-party Cascade orders and marketplace-seller orders, processing shipping address, payment, and delivery-preference data.
• Peakview Analytics Inc. (EIN: 87-2250194) — Operates the Company's advertising-technology stack, including audience segmentation, behavioral targeting, attribution modeling, and cross-device identity resolution, processing approximately 2.1 billion consumer-event data records per month.
• Cascade Rewards Corp. (EIN: 86-3381729) — Administers the Cascade Rewards loyalty program, which has approximately 41.2 million registered members and collects purchase history, preferences, demographic information, and engagement data.
Cascade's data-processing activities encompass the following categories of personal information, as classified under the CCPA/CPRA and other applicable state privacy statutes:
• Identifiers — Name, email address, postal address, telephone number, account number, IP address, device identifiers, and cookie identifiers.
• Commercial information — Records of products purchased, obtained, or considered; purchase history; shopping-cart contents; and return/exchange records.
• Internet or other electronic network activity information — Browsing history, search history, clickstream data, referral-source data, and information regarding interactions with cascade.com, the mobile application, and online advertisements.
• Precise geolocation data — Collected through the Cascade mobile application when location services are enabled by the consumer, used for store-locator, personalized-offer, and foot-traffic-analysis purposes.
• Inferences — Consumer profiles created from the above categories reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes, generated primarily by Peakview Analytics for advertising-targeting purposes.
• Sensitive personal information — Including payment-card data (processed through Cascade's PCI-DSS-compliant payment environment), precise geolocation data, and account login credentials (username in combination with password or security questions).
As documented in the data-mapping report prepared by Fieldhaven Consulting Group LLC dated May 19, 2025, Cascade shares personal information with 47 third-party advertising and analytics partners, encompassing demand-side platforms, data-management platforms, social-media advertising networks, retargeting providers, attribution-analytics firms, and audience-data aggregators. Additionally, Cascade deploys 12 categories of cookies and tracking technologies on cascade.com, including first-party analytics cookies, third-party advertising cookies, social-media pixels, session-replay tools, and cross-device-tracking technologies.
In FY2024, Cascade received approximately 38,400 data-subject requests across all channels, broken down as follows:
• Access requests: approximately 12,800
• Deletion requests: approximately 19,100
• Opt-out of sale/sharing requests: approximately 6,500
The Company's average response time for DSRs in FY2024 was 27 calendar days, which, while within the 45-calendar-day statutory deadline under the CCPA, exceeded internal best-practice targets and reflected manual processing inefficiencies that the current Program is designed to address.
B. Regulatory Drivers
At the time the engagement was opened in June 2025, 19 state privacy statutes were identified as applicable to Cascade's operations based on the Company's physical presence, e-commerce activity, and consumer-data-processing thresholds. These statutes are:
1. California — California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
2. Virginia — Virginia Consumer Data Protection Act (VCDPA)
3. Colorado — Colorado Privacy Act (CPA)
4. Connecticut — Connecticut Data Privacy Act (CTDPA)
5. Utah — Utah Consumer Privacy Act (UCPA)
6. Iowa — Iowa Consumer Data Protection Act (ICDPA)
7. Indiana — Indiana Consumer Data Protection Act (INCDPA)
8. Tennessee — Tennessee Information Protection Act (TIPA)
9. Montana — Montana Consumer Data Privacy Act (MCDPA)
10. Texas — Texas Data Privacy and Security Act (TDPSA)
11. Oregon — Oregon Consumer Privacy Act (OCPA)
12. Delaware — Delaware Personal Data Privacy Act (DPDPA)
13. New Jersey — New Jersey Data Privacy Act (NJDPA)
14. New Hampshire — New Hampshire Data Privacy Act (NHDPA)
15. Nebraska — Nebraska Data Privacy Act (NDPA)
16. Minnesota — Minnesota Consumer Data Privacy Act (MCDPA)
17. Maryland — Maryland Online Data Privacy Act (MODPA)
18. Kentucky — Kentucky Consumer Data Privacy Act (KYDPA)
19. Additional enacted statutes with effective dates falling within the Program period
The Program is designed to be scalable so that additional state privacy statutes—several of which are pending in state legislatures or have been enacted with future effective dates—can be incorporated into the compliance framework as they take effect, without requiring fundamental restructuring.
In addition to the breadth of the statutory landscape, two prior regulatory interactions have directly informed the design and prioritization of the Program:
FTC Civil Investigative Demand (September 14, 2023). The Federal Trade Commission issued a Civil Investigative Demand to Cascade under File No. 232-0147, dated September 14, 2023, in connection with an investigation into allegations of dark-pattern design practices in the Cascade mobile application's account-management and marketing-preferences flows. Specifically, the FTC's inquiry focused on the multi-step process required for consumers to unsubscribe from promotional communications through the mobile app, which the Commission identified as potentially deceptive under Section 5 of the FTC Act. Cascade cooperated with the investigation and implemented voluntary remedial changes to the mobile-app user interface in early 2024. The matter was closed by the FTC on April 3, 2024, with no enforcement action taken. However, the investigation underscored the importance of user-experience design review as a component of privacy compliance, and the Program incorporates ongoing UX-review protocols as part of its scope.
California Attorney General Informal Inquiry (February 6, 2024). The California Attorney General's office issued an informal inquiry letter to Cascade dated February 6, 2024, requesting information regarding the Company's sale-and-sharing disclosures on cascade.com, the functionality and accessibility of its "Do Not Sell or Share My Personal Information" link, and the status of its service-provider and contractor agreements under CCPA/CPRA requirements. Cascade responded to the inquiry on March 8, 2024, and no formal enforcement action was initiated. However, the Attorney General's inquiry highlighted two specific deficiencies that remain core drivers for this engagement: (i) the "Do Not Sell" link on cascade.com did not meet the accessibility and placement standards specified in the CPRA regulations, and (ii) a significant number of Cascade's service-provider and third-party-partner agreements lacked the contractual provisions required by CCPA sections 1798.100(d) and 1798.140(ag). Both of these deficiencies are being directly remediated through the Program, as discussed in Section IV below.
C. Engagement Structure
Calderwood & Harkness LLP was retained as outside privacy counsel effective June 2, 2025, pursuant to an engagement letter executed by Meredith Tanaka, General Counsel. The C&H engagement team consists of the following attorneys:
• Kevin Ostrowski — Responsible Partner, Privacy & Data Security Practice Group
• Rachel Bernstein — Billing Partner, Privacy & Data Security Practice Group
• Alan Burke — Lead Associate / Senior Associate
• Sara Hendricks — Working Associate
In addition to C&H, the following firms and service providers are integral to the engagement:
Whitfield Greaves LLP. Carolyn J. Marsden, Partner, Corporate & Securities, Whitfield Greaves LLP (1999 K Street NW, Suite 700, Washington, D.C. 20006), continues to serve as Cascade's securities and corporate governance counsel. Whitfield Greaves coordinates with C&H on SEC-disclosure implications of the privacy program and board-governance aspects, including the proposed Privacy Governance Charter. A Common-Interest Agreement between C&H and Whitfield Greaves was executed on June 10, 2025, to preserve the attorney-client privilege and work-product protection over communications shared between the two firms in connection with their respective representations of Cascade.
Fieldhaven Consulting Group LLC. Marcus Ellerby, Engagement Lead, Fieldhaven Consulting Group LLC, serves as the technical implementer for the Program. Fieldhaven's scope of work encompasses data-mapping tooling and analysis, consent-management platform deployment support, and DSR-workflow automation. Fieldhaven operates under the direction of C&H for purposes of preserving privilege over compliance-related analyses and recommendations.
OnPoint Data Solutions Inc. Danielle Ferrero, CEO, OnPoint Data Solutions Inc., provides the SaaS-based consent-management platform that will be deployed across cascade.com and the Cascade mobile application. OnPoint's platform supports cookie-consent management, opt-out-of-sale/sharing mechanisms, GPC signal detection, and preference-center functionality. OnPoint has been classified as a CCPA "service provider" under the DPA Rider/Amendment executed on September 25, 2025.
III. Phase 1 Milestone Status
A. Milestone Tracker
The following table summarizes the current status of all Phase 1 milestones as of the date of this memorandum. A more detailed milestone tracker is attached as Attachment B.
B. Key Deliverables Completed to Date
As of the date of this memorandum, C&H has completed and delivered the following work product in connection with Phase 1 of the Program. All deliverables listed below are protected by the attorney-client privilege and/or the work-product doctrine unless otherwise noted.
Legal Analyses and Assessments:
1. Multi-State Privacy Law Applicability Matrix — Comprehensive mapping of all 19 applicable state privacy statutes against Cascade's operations, identifying threshold applicability, consumer-rights obligations, opt-out-mechanism requirements, data-processing-agreement mandates, and enforcement and penalty provisions for each statute.
2. Data-Mapping Review Memorandum — Legal review and analysis of Fieldhaven Consulting Group LLC's data-mapping report dated May 19, 2025, evaluating data flows, processing purposes, and third-party sharing relationships against statutory requirements.
3. Comprehensive Gap-Analysis Report — Identification and analysis of seven major compliance gaps across all 19 statutes, with prioritized remediation recommendations. Delivered August 15, 2025.
4. Sensitive-PI Analysis Memorandum — Detailed analysis of Cascade's processing of sensitive personal information (precise geolocation, payment-card data, and account credentials) under CCPA/CPRA requirements and analogous provisions of other state statutes.
5. Third-Party Data-Sharing Risk Assessment — Classification and risk-ranking of all 47 advertising and analytics partners identified in the data-mapping report, with identification of 23 partners lacking required data-processing agreements.
6. FTC & CA AG Inquiry Summary Memorandum — Summary analysis of the FTC Civil Investigative Demand (File No. 232-0147) and the California Attorney General informal inquiry, with assessment of ongoing compliance implications and recommended remedial measures.
7. Children's Privacy / Age-Gating Analysis Memorandum — Analysis of Cascade's obligations under COPPA and state-level children's-privacy provisions, with recommendations regarding age-gating mechanisms and parental-consent requirements for the e-commerce platform and mobile application.
Consumer-Facing Privacy Notices:
8. Omnibus Privacy Policy — Comprehensive privacy notice for cascade.com and the mobile application, drafted to comply with all 19 applicable state privacy statutes.
9. California-Specific Addendum — Supplemental disclosures required by CCPA/CPRA, including categories of PI collected, disclosed, and sold/shared; CCPA consumer-rights notices; and financial-incentive disclosures for the Cascade Rewards program.
10. State-Specific Rights Supplement — Jurisdiction-specific disclosures of consumer rights and opt-out mechanisms for Virginia, Colorado, Connecticut, Texas, Oregon, and other applicable states.
11. Cookie & Tracking-Technology Notice — Detailed disclosure of the 12 categories of cookies and tracking technologies deployed on cascade.com, with descriptions of purpose, data collected, and retention periods.
12. Employee & Job-Applicant Privacy Notice — Privacy notice covering personal information collected from employees and job applicants, as required by CCPA/CPRA and other applicable state statutes.
13. Cascade Rewards Loyalty-Program Privacy Notice — Program-specific notice addressing the collection, use, and sharing of loyalty-member data, including financial-incentive disclosures required by CCPA/CPRA.
14. Marketplace Seller Privacy Notice — Privacy notice for third-party sellers on Cascade Digital Marketplace LLC, addressing the processing of seller personal information.
Contractual Documents:
15. Vendor DPA Templates — Service-provider and contractor data-processing agreement templates compliant with CCPA/CPRA sections 1798.100(d) and 1798.140(ag), and analogous requirements under other state statutes. Finalized September 30, 2025.
16. OnPoint DPA Rider/Amendment — Data-processing addendum to the OnPoint Data Solutions Inc. SaaS agreement, classifying OnPoint as a CCPA "service provider" and imposing required contractual obligations. Executed September 25, 2025.
17. Marketplace Seller Data-Use Terms Addendum — Contractual addendum to Cascade Digital Marketplace seller terms establishing data-segregation obligations and limiting seller access to first-party customer data.
18. Fieldhaven Data-Protection Terms Review Memorandum — Legal review of data-protection provisions in Fieldhaven's consulting engagement agreement.
19. Vendor DPA Rollout Plan Memorandum — Phased deployment plan for executing DPAs with all 23 identified partners lacking required agreements, prioritized by data volume and risk level.
20. Thornbridge Negotiation Issues List & Redline Commentary — Internal attorney work-product memorandum analyzing key negotiation issues in the Thornbridge Media Corp. data-sharing agreement restructuring.
Internal Policies and Procedures:
21. Internal Privacy Policy & Procedures Manual (draft) — Comprehensive internal policy document establishing enterprise-wide privacy standards, roles and responsibilities, and operational procedures.
22. Data Retention & Disposal Schedule (draft) — Category-specific retention periods and disposal protocols for all categories of personal information processed by Cascade and its subsidiaries.
23. DSR Standard Operating Procedures (draft, pre-go-live) — Step-by-step procedures for intake, identity verification, processing, appeal, and documentation of data-subject requests under all applicable state statutes.
24. Privacy Impact Assessment Framework & Template — Methodology and standardized template for conducting privacy impact assessments on new and modified data-processing activities.
25. Employee Privacy Training Program Materials — Training curriculum and presentation materials for enterprise-wide privacy-awareness training, with role-specific modules for customer-service, marketing, IT, and legal personnel.
IV. Compliance Gap Remediation Status
The Gap-Analysis Report delivered on August 15, 2025 identified seven major compliance gaps across Cascade's operations when measured against the requirements of all 19 applicable state privacy statutes. The following provides the current remediation status for each gap.
Gap 1: Outdated Online Privacy Policy
Finding: Cascade's online privacy policy, as published on cascade.com, was last updated in March 2022. The policy did not address 14 of the 19 applicable state privacy statutes that have been enacted or have taken effect since that date. Specifically, the policy lacked required disclosures under the VCDPA, CPA, CTDPA, UCPA, ICDPA, INCDPA, TIPA, MCDPA (Montana), TDPSA, OCPA, DPDPA, NJDPA, NHDPA, and NDPA. Additionally, the policy's CCPA disclosures did not reflect amendments made by the CPRA, including updated categories of sensitive personal information, right-to-correct disclosures, and contractor-versus-service-provider distinctions.
Status: Remediated. A complete suite of seven consumer-facing privacy notices was drafted and finalized as of September 12, 2025, as detailed in Section III.B above. The notices address all 19 applicable state privacy statutes and incorporate all required disclosures, consumer-rights notices, and opt-out mechanisms. Final review and publication of the updated notices on cascade.com and the mobile application is being coordinated with the CMP deployment (target: December 15, 2025) to enable a coordinated launch of the updated notices alongside the new consent-management mechanisms. This coordinated approach ensures that consumers encounter a unified and consistent experience upon their first visit after the updates go live.
Gap 2: No Universal Opt-Out Mechanism (Global Privacy Control)
Finding: Cascade did not honor the Global Privacy Control ("GPC") signal or any other universal opt-out mechanism. The CCPA/CPRA regulations require businesses to treat a GPC signal as a valid opt-out-of-sale/sharing request. Additionally, Colorado, Connecticut, Montana, Texas, Oregon, Delaware, and other state statutes require recognition of universal opt-out mechanisms. The "Do Not Sell or Share My Personal Information" link on cascade.com, which was the subject of the California Attorney General's February 2024 informal inquiry, did not comply with CPRA placement and accessibility standards and did not integrate with any automated opt-out processing system.
Status: In Progress (On Track for December 15, 2025). The OnPoint Data Solutions CMP is being configured to detect and honor GPC signals transmitted by consumer browsers and browser extensions. Upon detection of a GPC signal, the CMP will automatically suppress the firing of third-party advertising and analytics cookies and transmit opt-out signals to Peakview Analytics' ad-tech stack and to Cascade's 47 third-party advertising and analytics partners through standardized API integrations. Fieldhaven is coordinating the technical integration between the OnPoint CMP and Peakview Analytics' tag-management system. Testing of GPC signal recognition is currently underway in Cascade's staging environment, with results to date indicating successful detection and suppression in approximately 97% of tested browser configurations. The remaining 3% relates to certain legacy mobile-browser environments that require additional configuration, which Fieldhaven expects to resolve prior to the December 15, 2025 deployment date.
Gap 3: Commingled Marketplace Seller and First-Party Data
Finding: Third-party seller data generated through the Cascade Digital Marketplace was commingled with Cascade's first-party customer data in a single enterprise data lake, without role-based access controls to prevent marketplace sellers from accessing first-party customer personal information or Cascade employees from accessing seller-customer data outside of legitimate business purposes. This commingling created a risk that data-sharing relationships between Cascade and marketplace sellers could be classified as "sales" under the CCPA/CPRA, and that Cascade could be deemed a joint controller with marketplace sellers under other state statutes, with resulting compliance obligations that the Company was not structured to fulfill.
Status: In Progress (On Track for December 15, 2025). Remediation of this gap involves both technical and contractual components. On the technical side, Fieldhaven Consulting Group LLC is implementing data-segregation controls within the enterprise data lake, including logical partitioning of seller-specific data, role-based access controls restricting access based on business function, and audit logging of all cross-partition data access. Gregory Farris, Cascade's Chief Information Security Officer, is overseeing the technical implementation and has confirmed that the segregation architecture is on track for deployment by mid-December. On the contractual side, the Marketplace Seller Data-Use Terms Addendum has been drafted and establishes binding contractual obligations on marketplace sellers regarding the use, retention, and onward sharing of customer data generated through the Marketplace platform. The addendum restricts seller access to customer data to the minimum necessary for order fulfillment and customer service, prohibits sellers from using customer data for independent marketing purposes, and requires sellers to comply with applicable state privacy laws. The addendum will be incorporated into the Marketplace Seller Agreement for all existing and new sellers.
Gap 4: 23 of 47 Ad/Analytics Partners Lacking Data-Processing Agreements
Finding: Of the 47 third-party advertising and analytics partners identified in the Fieldhaven data-mapping report, 23 did not have executed data-processing agreements containing the provisions required by CCPA/CPRA sections 1798.100(d) and 1798.140(ag) for service providers and contractors, or analogous provisions under other state statutes. The absence of these contractual provisions exposed Cascade to the risk that data disclosures to these partners could be classified as "sales" or "sharing" under the CCPA/CPRA, triggering additional consumer-rights obligations and potential enforcement exposure. This deficiency was also highlighted in the California Attorney General's February 2024 informal inquiry.
Status: In Progress (On Track for December 31, 2025). The Vendor DPA Rollout Plan Memorandum was delivered on September 30, 2025, establishing a phased deployment schedule for executing data-processing agreements with all 23 identified partners. The partners have been prioritized into three tiers based on data volume and risk level:
• Tier 1 (High Priority — 8 partners): Partners receiving the largest volumes of personal information and/or engaged in behavioral-targeting or cross-device-tracking activities. DPA negotiations are in progress with all eight Tier 1 partners; five DPAs have been executed as of the date of this memorandum, and the remaining three are in advanced draft stages.
• Tier 2 (Medium Priority — 9 partners): Partners receiving moderate volumes of personal information, primarily for analytics and attribution purposes. DPA templates have been transmitted to all nine Tier 2 partners, and negotiations are underway.
• Tier 3 (Lower Priority — 6 partners): Partners receiving limited volumes of personal information or engaged in narrowly scoped analytics activities. DPA templates will be transmitted during November 2025.
The target for full execution of all 23 DPAs is December 31, 2025. Based on the pace of negotiations to date, C&H believes this target is achievable, although some Tier 3 partners may require follow-up into early January 2026.
Gap 5: Sensitive PI Processing Without Required Consent
Finding: Cascade's mobile application collects precise geolocation data from consumers who enable location services, and this data is processed by Peakview Analytics for store-traffic analysis, personalized-offer targeting, and foot-traffic attribution. Under the CCPA/CPRA, precise geolocation data is classified as "sensitive personal information," and a business must provide consumers with a right to limit the use and disclosure of their sensitive personal information. Other state statutes (including those in Virginia, Colorado, Connecticut, and Oregon) require affirmative opt-in consent before processing sensitive data categories. Cascade's mobile application did not obtain separate opt-in consent for the collection and processing of precise geolocation data, and did not provide a mechanism for consumers to limit the use and disclosure of this data as required by the CCPA/CPRA.
Status: In Progress (On Track for December 15, 2025). A separate consent flow for precise-geolocation data collection is being integrated into the Cascade mobile application. The new consent flow will present consumers with a clear and conspicuous disclosure of the purposes for which geolocation data is collected and processed, and will require affirmative opt-in before geolocation tracking is activated. Consumers who have previously enabled location services will be presented with the new consent flow upon their next app session following deployment. Additionally, a "right to limit" mechanism for sensitive personal information is being implemented in coordination with the CMP deployment, which will allow consumers to restrict Cascade's use and disclosure of their sensitive personal information to purposes permitted under the CCPA/CPRA. The geolocation-consent flow and right-to-limit mechanism are being coordinated with the CMP deployment scheduled for December 15, 2025.
Gap 6: No Documented Data-Retention Schedule
Finding: Cascade did not maintain a documented, enterprise-wide data-retention-and-disposal schedule establishing specific retention periods for each category of personal information. Several state privacy statutes (including the CCPA/CPRA) require businesses to disclose the retention periods for each category of personal information collected, or, if specific periods are not established, the criteria used to determine retention periods. The absence of a documented schedule also impeded Cascade's ability to respond accurately to consumer access and deletion requests.
Status: Remediated (Draft Stage). A comprehensive Data Retention & Disposal Schedule was prepared in October 2025, establishing specific retention periods for each category of personal information processed by Cascade and its subsidiaries:
• Customer-transaction data: 7 years from date of transaction (aligned with tax and financial-reporting requirements)
• Loyalty-program data: Duration of membership plus 3 years following account closure
• Employee data: Duration of employment plus 7 years (aligned with employment-law record-keeping requirements)
• Marketing and advertising data: 24 months from date of collection (with anonymization or deletion at expiration)
• Marketplace-seller data: Duration of seller agreement plus 3 years
• Website analytics data: 13 months from date of collection (aligned with industry best practices)
The schedule also establishes legal-hold triggers and exception procedures for data subject to litigation holds or regulatory inquiries, as well as destruction protocols specifying the methods of secure deletion or de-identification to be used upon expiration of the applicable retention period. The draft schedule is currently under review by Diana Polk and the relevant business-unit owners and is expected to be finalized prior to December 31, 2025.
Gap 7: DSR Portal Deficiencies
Finding: Cascade's existing data-subject-request intake process exhibited three significant deficiencies. First, the identity-verification procedures applied to DSR requestors did not meet CCPA standards, which require "reasonable security measures to verify the identity of the consumer making the request" and set forth specific requirements based on the type of request (access, deletion, or opt-out). Second, Cascade did not offer an appeal-process mechanism, as required by the VCDPA, CPA, CTDPA, and other state statutes, for consumers whose DSRs are denied in whole or in part. Third, Cascade's average DSR response time of 27 calendar days, while within the CCPA's 45-calendar-day statutory deadline, reflected manual processing inefficiencies and did not position the Company to meet the shorter response deadlines or higher volumes that may result from increased consumer awareness and additional state statutes taking effect.
Status: In Progress (On Track for December 1, 2025). DSR Standard Operating Procedures have been drafted, establishing detailed intake, verification, processing, response, appeal, and documentation protocols for each type of DSR (access, deletion, correction, opt-out of sale/sharing, right to limit, and portability) under each applicable state statute. Fieldhaven Consulting Group LLC is implementing an automated DSR workflow that integrates with Cascade's customer-identity systems and data stores. Key features of the automated workflow include:
• CCPA-Compliant Identity Verification: A tiered verification process that adjusts the level of identity assurance required based on the type of request and the sensitivity of the data involved, consistent with CCPA regulations and CPPA guidance.
• Appeal-Process Functionality: An integrated appeal mechanism allowing consumers to appeal a denied DSR, with automatic routing to a designated privacy-team reviewer and tracking of appeal timelines against statutory deadlines.
• Automated Data-discovery and Retrieval: Integration with Cascade's customer databases, the Peakview Analytics data warehouse, and the Cascade Rewards system to automate the identification and retrieval of personal information responsive to access and portability requests.
• Response-Time Tracking: Automated deadline calculation and escalation notifications to ensure responses are issued within statutory timeframes, with a target average response time of 15 business days or less.
The DSR workflow go-live is targeted for December 1, 2025. Fieldhaven reports that build and integration work is on schedule, with user-acceptance testing planned for the week of November 17, 2025.
V. Thornbridge Media Corp. Data-Sharing Agreement Restructuring
Thornbridge Media Corp. ("Thornbridge") is a Nevada corporation (CEO: Robert Shin; General Counsel: Leah Voss) that serves as Cascade's primary programmatic-advertising and audience-targeting partner. In FY2024, Cascade's advertising spend with Thornbridge totaled approximately $18.4 million, making it Cascade's largest single advertising-partner relationship by dollar volume.
The existing data-sharing arrangement between Cascade and Thornbridge was identified as the highest-priority item in the Third-Party Data-Sharing Risk Assessment delivered on August 4, 2025. This prioritization was driven by several factors:
• Volume of behavioral data exchanged: Thornbridge receives high-volume feeds of consumer browsing behavior, purchase history, and audience-segment data from Peakview Analytics for use in programmatic-advertising campaigns and audience-targeting activities.
• Classification risk: Under the CCPA/CPRA, the nature of the data exchange and the extent of Thornbridge's independent use of the data creates a significant risk that the arrangement constitutes a "sale" or "sharing" of personal information, which would trigger opt-out-of-sale/sharing obligations, "Do Not Sell or Share" link requirements, and restrictions on the processing of personal information of consumers who have opted out.
• Absence of contractual protections: The existing agreement between Cascade and Thornbridge did not contain the data-processing provisions required by the CCPA/CPRA for service-provider or contractor relationships, and did not address consumer-rights obligations, opt-out compliance, or data-minimization requirements.
C&H drafted a comprehensive restructured data-sharing agreement designed to address each of these risk areas. The restructured agreement covers the following key provisions:
• CCPA sale/sharing classification and corresponding contractual obligations
• Opt-out-of-sale/sharing compliance, including GPC signal honoring and pass-through of consumer opt-out preferences
• Data-minimization and purpose-limitation restrictions on Thornbridge's use of Cascade consumer data
• Consumer-rights assistance obligations, requiring Thornbridge to cooperate with Cascade in responding to DSRs
• Audit rights allowing Cascade to verify Thornbridge's compliance with the agreement's data-protection provisions
• Breach-notification obligations with specified notification timelines
• Indemnification provisions allocating liability for regulatory fines and penalties arising from non-compliance
Negotiations with Kellner Park & Associates LLP (Victor Sandoval, Partner, 555 Mission Street, 32nd Floor, San Francisco, CA 94105), Thornbridge's outside counsel, commenced in September 2025 and are currently in their final stages. The parties have reached agreement on the majority of the contract provisions, but four key issues remain under negotiation:
1. Combined-Data Rights. Thornbridge has requested the right to retain and use "combined data" — i.e., data that combines Cascade consumer data with data from Thornbridge's other sources — for Thornbridge's independent business purposes, including providing services to other Thornbridge clients. C&H has recommended a firm position against this request, as permitting combined-data rights would make it significantly more difficult to classify the arrangement as a service-provider relationship under the CCPA/CPRA and would likely constitute a "sale" or "sharing" of personal information.
2. Real-Time GPC Signal Pass-Through. Thornbridge has expressed resistance to implementing real-time pass-through of GPC signals, asserting that its systems are not currently configured to process opt-out signals on a real-time, per-request basis and that a batch-processing approach (with daily synchronization) would be commercially reasonable. C&H has recommended a firm position requiring real-time or near-real-time GPC signal honoring, consistent with the CPPA's position that opt-out preference signals must be processed "as soon as feasibly possible" and the Company's own CMP architecture.
3. Audit-Rights Frequency. Thornbridge has proposed limiting Cascade's audit rights to once per calendar year, with 60 days' advance written notice. C&H has identified a potential compromise position on this issue: acceptance of an annual audit cadence under normal circumstances, with the right to conduct additional audits (a) upon reasonable suspicion of non-compliance, (b) following a data breach or security incident affecting Cascade data, or (c) in response to a regulatory inquiry or investigation.
4. Indemnification Scope for Regulatory Fines. Thornbridge has resisted full indemnification for regulatory fines and penalties attributable to Thornbridge's breach of the agreement's data-protection provisions, proposing instead a mutual-indemnification structure with a cap equal to twelve months of fees paid under the advertising services agreement. C&H has identified a potential compromise position: acceptance of a fee-based cap on general indemnification, with a carve-out providing uncapped indemnification for fines and penalties directly resulting from Thornbridge's willful or grossly negligent breach of the agreement's opt-out, data-minimization, or purpose-limitation provisions.
The original target for execution of the restructured agreement was October 31, 2025. Negotiations are currently on track, with a final exchange of redlines expected during the week of November 10, 2025. However, given the complexity of the remaining issues, execution may slip to mid-November 2025. C&H does not consider this delay to be material to the overall Phase 1 timeline, as the Thornbridge agreement does not gate other deliverables and is expected to be fully executed well in advance of the December 31, 2025 Phase 1 completion date.
VI. Budget and Financial Update
A. Calderwood & Harkness LLP Fees
The fee arrangement for Phase 1 of the engagement (June 2, 2025 through December 31, 2025) provides for blended hourly rates as follows:
• Partner: $1,175 per hour
• Senior Associate: $785 per hour
• Associate: $625 per hour
Phase 1 fees are subject to a rate cap of $2,600,000, which represents the maximum fees C&H will charge for Phase 1 deliverables regardless of actual hours incurred. Expenses (including travel, filing fees, and third-party research costs) are billed separately and are not included in the cap.
As of October 31, 2025, fees incurred under the Phase 1 engagement total approximately $1,900,000 (estimated range: $1,850,000 to $1,950,000) of the $2,600,000 cap, representing approximately 73% utilization of the Phase 1 budget. The remaining budget of approximately $700,000 is adequate to fund the completion of all remaining Phase 1 deliverables through December 31, 2025, including the Thornbridge negotiation, DSR-workflow legal support, CMP-deployment legal review, employee-training finalization, and the Phase 1 compliance-readiness certification memorandum.
For Phase 2 of the engagement (January 1, 2026 through June 30, 2026), C&H estimates fees in the range of $1,400,000 to $1,800,000, billed at the same hourly rates, without a fee cap. Phase 2 scope includes ongoing monitoring of regulatory developments across all applicable jurisdictions, deployment and delivery of the employee privacy-training program, regulatory-response support (including preparation for and response to any regulatory inquiries or enforcement actions), maintenance and updating of the privacy-policy suite and DPA templates, and the first annual privacy-program assessment, targeted for completion by June 30, 2026. The Committee is being asked to review and, if appropriate, recommend authorization of the Phase 2 budget, as discussed in Section XI.B below.
B. Fieldhaven Consulting Group LLC
Fieldhaven Consulting Group LLC is engaged under a fixed-fee statement of work with a total value of $3,150,000, payable in three milestone-based installments:
• Milestone 1 — Data Mapping Complete: $945,000 — Paid. Fieldhaven's comprehensive data-mapping report was delivered on May 19, 2025, and the milestone payment was remitted in accordance with the terms of the statement of work.
• Milestone 2 — CMP Deployed: $1,102,500 — Pending. Payment is due upon successful deployment of the consent-management platform on cascade.com and the Cascade mobile application. Target deployment date: December 15, 2025.
• Milestone 3 — DSR Automation Live: $1,102,500 — Pending. Payment is due upon successful go-live of the automated DSR workflow with CCPA-compliant identity verification and appeal-process functionality. Target go-live date: December 1, 2025.
Marcus Ellerby, Fieldhaven's Engagement Lead, reports that technical implementation across both the CMP deployment and DSR-automation workstreams is on schedule. No change orders or scope modifications have been requested.
C. OnPoint Data Solutions Inc. (Consent-Management Platform)
OnPoint Data Solutions Inc. provides the SaaS-based consent-management platform under a three-year contract with the following terms:
• Term: Three years from deployment date
• Annual License Fee: $480,000 per year
• Total Contract Value: $1,440,000
The DPA Rider/Amendment was executed on September 25, 2025, classifying OnPoint as a CCPA "service provider" and imposing contractual obligations regarding data use, retention, and security. OnPoint's platform configuration is currently underway, with deployment targeted for December 15, 2025. Year 1 license fees are committed and will become payable upon deployment.
D. Insurance Coverage
Cascade maintains cyber- and privacy-liability insurance coverage through Northcastle Indemnity Company, a Connecticut domestic insurer (100 Constitution Plaza, Hartford, CT 06103), brokered by Ridgepoint Insurance Brokers Inc. (Nathan Gilroy, Account Executive, 140 Broadway, 22nd Floor, New York, NY 10005).
The current policy provides the following coverage:
• Policy Period: July 1, 2025 through June 30, 2026
• Per-Occurrence Limit: $25,000,000