PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT This memorandum is a privileged and confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and for the purpose of providing legal advice. This document is protected from disclosure by the attorney-client privilege, the work-product doctrine, and any other applicable privilege or protection. Do not distribute, copy, or disclose this memorandum or its contents without the prior written consent of Calderwood & Harkness LLP.
MEMORANDUM
FROM: Kevin Ostrowski, Partner, Privacy & Data Security, and Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP, 600 Lexington Avenue, 28th Floor, New York, NY 10022
TO: Meredith Tanaka, General Counsel, Cascade Retail Holdings Inc., 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119
CC: Diana Polk, Associate General Counsel (Interim Chief Privacy Officer), Cascade Retail Holdings Inc.; Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP
DATE: December 31, 2025
RE: Phase 1 Compliance-Readiness Certification — US State Privacy Compliance Program
MATTER NO.: 1038-00010
Right-click to update Table of Contents
I. Executive Summary and Purpose
This memorandum certifies the completion of Phase 1 of the comprehensive US state privacy compliance program engagement opened by Calderwood & Harkness LLP on behalf of Cascade Retail Holdings Inc. ("Cascade" or the "Company") on June 2, 2025 (the "Engagement"). The Phase 1 period encompasses all work performed from the Engagement opening date through December 31, 2025.
The scope of Phase 1 included a comprehensive multi-state privacy law assessment, detailed gap analysis, drafting and deployment of consumer-facing and internal privacy policies and notices, development and finalization of vendor and data-processing contract templates, restructuring of key commercial data-sharing agreements, creation of employee privacy training materials, establishment of a board-level governance framework, and oversight of technical implementation activities — all as more fully described in the sections that follow.
Calderwood & Harkness LLP was retained to design, build, and implement a compliance program addressing the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and the full patchwork of state privacy statutes applicable to Cascade's operations across the United States. As of the Engagement opening, our analysis identified nineteen (19) applicable state privacy statutes, each with distinct requirements, effective dates, consumer-rights provisions, and enforcement mechanisms.
By way of background, Cascade is a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker symbol: CSRD) and headquartered in Seattle, Washington. For fiscal year 2024 ("FY2024"), Cascade reported revenue of approximately $3.87 billion. The Company employs approximately 22,500 individuals, operates 186 retail locations across 31 US states, processes approximately 94 million annual online transactions through its e-commerce platform (cascade.com) and mobile application, and maintains approximately 41.2 million registered members in its Cascade Rewards loyalty program. These operational characteristics place Cascade well above the applicability thresholds of every state privacy statute currently in effect or enacted through the 2025 legislative cycle.
The compliance program addresses the full range of Cascade's data-processing activities across its corporate family, including the Company's direct-to-consumer retail operations (both brick-and-mortar and e-commerce), its third-party marketplace operated by Cascade Digital Marketplace LLC ("CDM"), its loyalty program administered by Cascade Rewards Corp., its advertising technology stack operated through Peakview Analytics Inc. ("Peakview"), its fulfillment operations managed by Ridgeline Fulfillment Services Inc. ("Ridgeline"), and all related vendor and service-provider data practices.
We confirm that all Phase 1 deliverables have been completed or are in final implementation status as of the date of this memorandum, as detailed in the milestone completion summary and deliverable-by-deliverable certification set forth below. Cascade has achieved a substantial state of compliance-readiness across all nineteen applicable state privacy statutes.
Notwithstanding the significant progress achieved in Phase 1, certain residual risks and open items remain that are identified in Section VI of this memorandum. These items are recommended priorities for Phase 2 of the Engagement, which is proposed to run from January 1, 2026 through June 30, 2026. In particular, the hiring of a full-time Chief Privacy Officer, completion of data-lake segregation controls for marketplace data, finalization of vendor DPA rollout, and operationalization of the data-retention and disposal schedule are among the highest-priority items that require continued attention in Phase 2.
This memorandum is organized as follows: Section II provides an overview of the Engagement parameters, regulatory scope, and key client stakeholders. Section III presents a milestone-by-milestone completion summary. Section IV provides a detailed deliverable-by-deliverable certification. Section V summarizes the current state of compliance, including gap remediation status, technical implementation status, contractual coverage, and governance posture. Section VI identifies residual risks and open items. Section VII presents the Phase 1 budget summary. Section VIII sets forth recommendations and priorities for Phase 2. Section IX contains the formal certification statement. Appendix A provides a comprehensive index of all Phase 1 deliverables, and Appendix B presents a key metrics dashboard.
II. Engagement Overview and Scope
A. Engagement Parameters
The Engagement was opened on June 2, 2025, following execution of the engagement letter between Calderwood & Harkness LLP and Cascade Retail Holdings Inc. Phase 1 of the Engagement ran from June 2, 2025 through December 31, 2025, a period of approximately seven months encompassing all assessment, design, drafting, negotiation, and implementation oversight work described in this memorandum.
The Calderwood & Harkness LLP engagement team for Phase 1 consisted of the following attorneys:
• Kevin Ostrowski, Partner, Privacy & Data Security — Responsible Partner, with primary responsibility for engagement supervision, strategic direction, board-level advisory, and senior client relationship management.
• Rachel Bernstein, Partner, Privacy & Data Security — Billing Partner, with responsibility for engagement administration, staffing, and budget oversight.
• Alan Burke, Senior Associate, Privacy & Data Security — Lead Associate, with day-to-day management of all workstreams, primary drafting responsibility for policies, contracts, and governance documents, and direct coordination with Diana Polk and Fieldhaven Consulting Group LLC.
• Sara Hendricks, Associate, Privacy & Data Security — Working Associate, with primary responsibility for the multi-state applicability matrix, gap-analysis research, data-mapping review, and training-materials development.
The fee arrangement for Phase 1 was structured on a blended hourly-rate basis, with the following rates applicable during the Phase 1 period:
• Partner rate: $1,175 per hour
• Senior Associate rate: $785 per hour
• Associate rate: $625 per hour
These rates were subject to a Phase 1 rate cap of $2,600,000, inclusive of all attorney fees and exclusive of costs and disbursements. The budget summary set forth in Section VII confirms that Phase 1 fees remained within this cap.
Phase 2 of the Engagement, proposed to run from January 1, 2026 through June 30, 2026, is estimated at $1,400,000 to $1,800,000 on an hourly basis at the same blended rates, without a fee cap. The Phase 2 scope and priorities are described in Section VIII of this memorandum.
Throughout Phase 1, Calderwood & Harkness coordinated closely with Whitfield Greaves LLP ("Whitfield Greaves"), Cascade's corporate and securities counsel. The Whitfield Greaves engagement is led by Carolyn J. Marsden, Partner, and covers SEC-disclosure and board-governance aspects of the privacy compliance program, including risk-factor disclosures in the Company's periodic reports, proxy-statement disclosures, and board-committee charter amendments. This coordination is governed by a Common-Interest Agreement executed on June 10, 2025 between Calderwood & Harkness, Whitfield Greaves, and Cascade, establishing the framework for joint-privilege protections and information sharing in furtherance of the parties' common legal interests.
Calderwood & Harkness also provided legal oversight of the technical implementation work performed by Fieldhaven Consulting Group LLC ("Fieldhaven"), a privacy technology and data-governance consulting firm retained directly by Cascade under a separate fixed-fee Statement of Work ("SOW") with a total contract value of $3,150,000. The Fieldhaven engagement is led by Marcus Ellerby, Managing Director, and is structured around three payment milestones:
• Milestone 1 (data mapping and inventory): $945,000
• Milestone 2 (consent-management platform deployment): $1,102,500
• Milestone 3 (DSR automation and technical controls): $1,102,500
Calderwood & Harkness's role with respect to Fieldhaven's work was limited to legal oversight and review — specifically, ensuring that Fieldhaven's technical deliverables met the legal requirements of the applicable state privacy statutes, reviewing data-handling provisions in Fieldhaven's SOW, and coordinating on the design of consent flows, DSR workflows, and data-segregation architectures. Fieldhaven's technical work product, including its data-mapping report and technical implementation documentation, was reviewed by our team for legal compliance purposes and is referenced throughout this memorandum.
B. Regulatory Scope
The compliance program addresses nineteen (19) applicable US state privacy statutes as of the Engagement opening date. These statutes, together with their commonly used abbreviations, are as follows:
1. California — California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Cal. Civ. Code §§ 1798.100–1798.199.100
2. Virginia — Virginia Consumer Data Protection Act (VCDPA), Va. Code Ann. §§ 59.1-575 to 59.1-585
3. Colorado — Colorado Privacy Act (CPA), Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313
4. Connecticut — Connecticut Data Privacy Act (CTDPA), Conn. Gen. Stat. §§ 42-515 to 42-525
5. Utah — Utah Consumer Privacy Act (UCPA), Utah Code Ann. §§ 13-61-101 to 13-61-404
6. Iowa — Iowa Consumer Data Protection Act (ICDPA), Iowa Code §§ 715D.1 to 715D.9
7. Indiana — Indiana Consumer Data Protection Act (INCDPA), Ind. Code §§ 24-15-1-1 to 24-15-9-1
8. Tennessee — Tennessee Information Protection Act (TIPA), Tenn. Code Ann. §§ 47-18-3201 to 47-18-3213
9. Montana — Montana Consumer Data Privacy Act (MCDPA), Mont. Code Ann. §§ 30-14-2801 to 30-14-2817
10. Texas — Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code §§ 541.001 to 541.205
11. Oregon — Oregon Consumer Privacy Act (OCPA), Or. Rev. Stat. §§ 646A.570 to 646A.589
12. Delaware — Delaware Personal Data Privacy Act (DPDPA), Del. Code Ann. tit. 6, §§ 12D-101 to 12D-115
13. New Jersey — New Jersey Data Privacy Act (NJDPA), N.J. Stat. Ann. §§ 56:8-166 to 56:8-181
14. New Hampshire — New Hampshire Data Privacy Act (NHDPA), N.H. Rev. Stat. Ann. §§ 507-H:1 to 507-H:15
15. Nebraska — Nebraska Data Privacy Act (NDPA), Neb. Rev. Stat. §§ 87-1101 to 87-1116
16. Minnesota — Minnesota Consumer Data Privacy Act (MCDPA), Minn. Stat. §§ 325O.01 to 325O.20
17. Maryland — Maryland Online Data Privacy Act (MODPA), Md. Code Ann., Com. Law §§ 14-4601 to 14-4616
18. Kentucky — Kentucky Consumer Data Protection Act (KYDPA), Ky. Rev. Stat. Ann. §§ 367.400 to 367.475
19. Additional statutes enacted or becoming effective during the 2025–2026 legislative cycle, as identified in ongoing monitoring
The applicability of these statutes to Cascade's operations is driven by the Company's operational footprint: Cascade operates 186 retail locations in 31 US states and ships e-commerce orders to consumers in all 50 states plus the District of Columbia. Given Cascade's annual revenue of approximately $3.87 billion, its processing of personal information of approximately 41.2 million loyalty members and approximately 94 million annual online transactions, and its employee population of approximately 22,500, the Company exceeds the applicability thresholds of every enacted state privacy statute by a significant margin.
The Multi-State Privacy Law Applicability Matrix (Deliverable 1A-01), completed on June 30, 2025, provides a detailed analysis of each statute's applicability thresholds, consumer rights, opt-out mechanisms, sensitive-data provisions, data-protection assessment mandates, cure provisions, private rights of action (if any), and enforcement authorities. This matrix serves as the foundational reference document for the entire compliance program.
C. Key Client Stakeholders
The following individuals served as key client stakeholders during Phase 1:
• Thomas R. Cavanaugh, Chief Executive Officer — Executive Sponsor. Mr. Cavanaugh provided executive-level sponsorship of the privacy compliance program and participated in the November 13, 2025 board meeting at which the Privacy Governance Charter was adopted.
• Meredith Tanaka, General Counsel — Primary Client Contact. Ms. Tanaka served as the primary client contact for the Engagement, participated in all strategic decision-making, reviewed and approved all major deliverables, and served as the senior legal officer responsible for the compliance program.
• Diana Polk, Associate General Counsel / Interim Chief Privacy Officer — Day-to-Day Client Lead. Ms. Polk served as the day-to-day client lead, managing internal coordination across Cascade's business units, overseeing the Fieldhaven technical engagement, reviewing all deliverables, and assuming interim CPO responsibilities under the Privacy Governance Charter pending the hiring of a full-time CPO.
• Gregory Farris, Chief Information Security Officer — Information Security Coordination. Mr. Farris coordinated on all information-security aspects of the compliance program, including data-mapping review, technical controls design, incident-response procedures, and vendor security assessments.
• Priya Nandakumar, Vice President, Data & Analytics — Data-Mapping and Analytics Subject-Matter Expert. Ms. Nandakumar served as the principal business-unit subject-matter expert on data flows, data-lake architecture, analytics processing, and Peakview operations, and was instrumental in the data-mapping review and gap-analysis process.
• Jason Leclaire, Vice President, Marketing & Customer Engagement — AdTech and Loyalty-Program Subject-Matter Expert. Mr. Leclaire served as the principal business-unit subject-matter expert on advertising technology partnerships, cookie and tracking-technology deployments, the Cascade Rewards loyalty program, and the Thornbridge Media Corp. relationship.
• Ellen Marchetti, Director and Chair, Audit & Risk Committee of the Cascade Board of Directors — Board Oversight. Director Marchetti provided board-level oversight of the compliance program through the Audit & Risk Committee and presided over the November 13, 2025 board meeting at which the Privacy Governance Charter was adopted.
III. Phase 1 Milestone Completion Summary
The following table presents a comprehensive summary of all Phase 1 milestones, including target dates, actual completion dates, and current status. We are pleased to report that every milestone was achieved on or before the applicable target date.
The on-time completion of all Phase 1 milestones reflects the collaborative effort of the Calderwood & Harkness engagement team, the Cascade internal team led by Ms. Tanaka and Ms. Polk, the Fieldhaven technical implementation team, and the various business-unit stakeholders across the Cascade organization. We note in particular that certain milestones — notably the Thornbridge data-sharing agreement restructuring and the CMP deployment — involved significant coordination with third parties and technical dependencies that required careful project management.
IV. Deliverable-by-Deliverable Certification
This section provides a detailed description and certification of each Phase 1 deliverable, organized by functional category. Each deliverable is identified by its Deliverable Index reference number (as set forth in Appendix A), and its completion date and current status are confirmed.
A. Assessment and Gap Analysis Deliverables
1. Multi-State Privacy Law Applicability Matrix (Deliverable 1A-01). The Multi-State Privacy Law Applicability Matrix was completed on June 30, 2025 by Sara Hendricks and Alan Burke. This document constitutes the foundational legal analysis for the entire compliance program and maps all nineteen (19) applicable state privacy statutes against Cascade's specific operations, data-processing activities, and corporate structure.
The applicability matrix analyzes each statute across the following dimensions: (a) applicability thresholds (revenue, consumer-data volume, percentage of revenue derived from data sales, number of state residents whose data is processed); (b) consumer rights granted (access, deletion, correction, portability, opt-out of sale/sharing, opt-out of targeted advertising, opt-out of profiling, right to appeal); (c) opt-out requirements (sale, sharing, targeted advertising, profiling, universal opt-out mechanisms such as Global Privacy Control); (d) sensitive-data provisions (categories of sensitive data, consent requirements, restrictions on processing); (e) data-protection assessment mandates (risk assessments, PIAs, timing and frequency requirements); (f) private rights of action (if any, including the CCPA's limited private right of action for data breaches); and (g) enforcement authorities and cure provisions.
Key threshold inputs from Cascade's operations that informed the applicability analysis included the Company's 186 retail locations in 31 states, approximately 41.2 million registered Cascade Rewards loyalty members, approximately 94 million annual online transactions processed through cascade.com and the Cascade mobile application, FY2024 revenue of approximately $3.87 billion, and the processing activities of Cascade's subsidiaries including Peakview Analytics Inc., Cascade Digital Marketplace LLC, Cascade Rewards Corp., and Ridgeline Fulfillment Services Inc.
The matrix confirmed that Cascade exceeds the applicability thresholds of all nineteen identified statutes and is subject to the full range of obligations under each. This conclusion was communicated to Ms. Tanaka and Ms. Polk on July 1, 2025 and formed the basis for the subsequent gap analysis and remediation planning.
Status: Complete.
2. Data-Mapping Review Memorandum (Deliverable 1A-02). The Data-Mapping Review Memorandum was completed on July 14, 2025. This memorandum presents Calderwood & Harkness's legal review and analysis of the comprehensive data-mapping report prepared by Fieldhaven Consulting Group LLC (dated May 19, 2025), which was delivered to Cascade as part of Fieldhaven's Milestone 1 deliverables.
Fieldhaven's data-mapping report catalogued the categories of personal information collected, the sources of collection, the purposes of processing, the systems in which personal information is stored, the categories of recipients to whom personal information is disclosed, and the data flows between Cascade entities, vendors, and third parties. Calderwood & Harkness reviewed this report for legal compliance purposes, applying the definitional and classification frameworks of each of the nineteen applicable state privacy statutes.
Our review identified the following legally significant data flows and processing activities requiring attention in the compliance program:
(a) Peakview Analytics Processing Volume. Peakview Analytics Inc. processes approximately 2.1 billion consumer-event data records per month, including website clickstream data, mobile-app usage data, geolocation data, product-interaction data, and cross-device identifiers. This volume of processing, and the sensitivity of certain data categories (particularly precise geolocation data), placed Peakview at the center of multiple compliance obligations.
(b) Third-Party Advertising and Analytics Partners. Cascade shares consumer data with forty-seven (47) third-party advertising and analytics partners through a combination of cookie syncing, pixel-based data collection, server-to-server data transfers, and programmatic advertising data exchanges. The classification of these data flows under the CCPA/CPRA's "sale" and "sharing" definitions was a critical issue addressed in the gap analysis and subsequent remediation work.
(c) Marketplace Data Commingling. Consumer data from Cascade Digital Marketplace LLC's third-party seller transactions was commingled with Cascade's first-party customer data in a single enterprise data lake, without adequate role-based access controls or logical segregation to distinguish between the data sets or the distinct processing purposes applicable to each.
(d) Cookie and Tracking Technologies. Cascade's e-commerce platform (cascade.com) and mobile application deployed twelve (12) categories of cookies and tracking technologies, including essential cookies, analytics cookies, advertising cookies, social-media pixels, cross-device tracking identifiers, and retargeting tags. Several categories were deployed without prior user consent or adequate disclosure.
The data-mapping review further classified all identified data flows according to CCPA/CPRA categories: "sale" of personal information (as defined in Cal. Civ. Code § 1798.140(ad)), "sharing" of personal information for cross-context behavioral advertising (as defined in Cal. Civ. Code § 1798.140(ah)), "service provider" processing (as defined in Cal. Civ. Code § 1798.140(ag)), and "contractor" processing (as defined in Cal. Civ. Code § 1798.140(j)). This classification framework was applied to each of the 47 advertising/analytics partner relationships and each vendor relationship to determine the appropriate contractual and compliance treatment.
Status: Complete.
3. Comprehensive Gap-Analysis Report (Deliverable 1A-03). The Comprehensive Gap-Analysis Report was delivered on August 15, 2025 to Meredith Tanaka and Diana Polk. This report represents the core diagnostic document of the Phase 1 engagement and identified compliance deficiencies across all nineteen (19) applicable state privacy statutes, organized by functional area and assigned risk ratings (High, Medium, or Low) based on the likelihood and potential severity of enforcement action, financial exposure, and reputational harm.
The gap analysis documented seven (7) key compliance gaps requiring remediation during Phase 1:
Gap #1 — Outdated Online Privacy Policy. Cascade's consumer-facing online privacy policy was last updated in March 2022 and did not address fourteen (14) of the nineteen (19) applicable state privacy statutes. The policy lacked state-specific consumer-rights disclosures, failed to identify categories of personal information sold or shared, omitted required information about data-retention periods, and did not include the California-specific disclosures mandated by the CCPA/CPRA. Risk Rating: High.
Gap #2 — No Universal Opt-Out Mechanism. Cascade did not honor the Global Privacy Control ("GPC") signal or any other browser-based or device-based universal opt-out mechanism. The CCPA/CPRA and several other state statutes (including Colorado CPA, Connecticut CTDPA, Montana MCDPA, Texas TDPSA, and Oregon OCPA) require recognition of universal opt-out signals. Cascade's failure to honor GPC signals constituted a per-consumer, per-transaction violation exposure. Risk Rating: High.
Gap #3 — Commingled Marketplace and First-Party Data. Third-party seller data from Cascade Digital Marketplace LLC was commingled with first-party customer data in Cascade's enterprise data lake without role-based access controls or logical segregation. This commingling created risks of unauthorized cross-purpose processing, inaccurate consumer-rights responses, and potential violations of purpose-limitation and data-minimization requirements under multiple state statutes. Risk Rating: High.
Gap #4 — Missing Data-Processing Agreements. Twenty-three (23) of Cascade's forty-seven (47) third-party advertising and analytics partners lacked executed data-processing agreements. Under the CCPA/CPRA, personal information may be disclosed to service providers and contractors only pursuant to written contracts containing specified restrictive provisions. The absence of DPAs with nearly half of Cascade's advertising partners meant that certain data disclosures could not qualify for the service-provider or contractor exemptions and would be classified as "sales" subject to opt-out requirements. Risk Rating: High.
Gap #5 — Sensitive Personal Information Processed Without Opt-In Consent. The Cascade mobile application collected and processed precise geolocation data — a category of "sensitive personal information" under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ae)) — without obtaining separate opt-in consent as required by CCPA/CPRA § 1798.121 and analogous provisions of other state statutes. The mobile app's location-services permission flow was not configured to satisfy the heightened consent requirements applicable to sensitive personal information. Risk Rating: High.
Gap #6 — No Documented Data-Retention Schedule. Cascade had no enterprise-wide documented data-retention schedule governing the retention and disposal of customer-transaction data, loyalty-program data, employee data, marketing and advertising data, or marketplace-seller data. Several state statutes — including the CCPA/CPRA, Colorado CPA, and Connecticut CTDPA — impose data-minimization and storage-limitation obligations requiring that personal information be retained only as long as reasonably necessary for the disclosed purpose of processing. The absence of a documented retention schedule undermined Cascade's ability to demonstrate compliance with these requirements. Risk Rating: Medium.
Gap #7 — DSR Portal Lacking Identity Verification and Appeal Functionality. Cascade's existing consumer data-subject request ("DSR") portal lacked CCPA-standard identity verification procedures and did not include the appeal-process functionality required by Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), and several other state statutes. FY2024 DSR response times averaged 27 calendar days, exceeding the Company's internal target and approaching the 45-calendar-day response deadline under several state statutes. Risk Rating: Medium.
For each identified gap, the report prescribed specific remediation measures, assigned ownership to the responsible Calderwood & Harkness attorney and Cascade business-unit stakeholder, and aligned the remediation timeline with the Phase 1 milestone schedule. The remediation status of each gap is tracked in Section V.A of this memorandum.
Status: Complete.
4. Sensitive Personal Information Analysis Memorandum (Deliverable 1A-04). The Sensitive Personal Information Analysis Memorandum was completed on July 28, 2025. This memorandum provided a detailed legal analysis of Cascade's processing of categories of personal information that qualify as "sensitive personal information" or "sensitive data" under applicable state privacy statutes.
The analysis focused on three categories of sensitive personal information processed by Cascade:
(a) Precise Geolocation Data. The Cascade mobile application collects precise geolocation data (latitude and longitude coordinates accurate to within 1,750 feet or less) from consumers who enable location services. Precise geolocation data is classified as "sensitive personal information" under CCPA/CPRA § 1798.140(ae)(1)(G) and is treated as "sensitive data" under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other state statutes. Our analysis confirmed that Cascade's processing of precise geolocation data triggers the right to limit use and disclosure of sensitive personal information under CCPA/CPRA § 1798.121 and analogous consent requirements under other state statutes.
(b) Payment-Card Data. Cascade processes payment-card information (credit card numbers, debit card numbers, and associated security codes) in connection with e-commerce and in-store transactions. While payment-card data is subject to PCI DSS requirements and is generally excluded from certain state privacy statutes to the extent governed by the Gramm-Leach-Bliley Act, our analysis confirmed that Cascade's processing of payment-card data falls within the scope of the CCPA/CPRA and that certain payment-card data elements may constitute "sensitive personal information" depending on the manner of processing.
(c) Account Login Credentials. Cascade processes account login credentials (email address and password combinations) for cascade.com user accounts and Cascade Rewards loyalty accounts. Account login credentials combined with passwords or security questions constitute "sensitive personal information" under CCPA/CPRA § 1798.140(ae)(1)(I).
The memorandum recommended the implementation of a separate consent flow within the Cascade mobile application for precise geolocation data collection, configuration of the consent-management platform to manage sensitive-personal-information consent preferences, and inclusion of appropriate disclosures in the omnibus privacy policy regarding the right to limit use and disclosure of sensitive personal information.
Status: Complete.
5. Third-Party Data-Sharing Risk Assessment Memorandum (Deliverable 1A-05). The Third-Party Data-Sharing Risk Assessment Memorandum was completed on August 4, 2025. This memorandum presented a comprehensive risk assessment of Cascade's data-sharing relationships with its forty-seven (47) third-party advertising and analytics partners.
For each of the 47 partners, the memorandum analyzed the nature and scope of data exchanged, the technical mechanism of data transfer (cookie syncing, pixel-based collection, server-to-server transfer, or programmatic data exchange), the partner's use of the data, and the applicable CCPA/CPRA classification. Based on this analysis, each partner was classified as one of the following:
• CCPA "Service Provider" (Cal. Civ. Code § 1798.140(ag)): Partners that process personal information on behalf of Cascade pursuant to a written contract and are prohibited from using the data for any purpose other than performing the services specified in the contract.
• CCPA "Contractor" (Cal. Civ. Code § 1798.140(j)): Partners to whom Cascade makes personal information available pursuant to a written contract with heightened restrictions, including a prohibition on combining the personal information with data from other sources.
• CCPA "Third Party" (Cal. Civ. Code § 1798.140(ai)): Partners that receive personal information from Cascade and are not subject to service-provider or contractor restrictions, such that Cascade's disclosure constitutes a "sale" or "sharing" under the CCPA/CPRA.
The memorandum confirmed that twenty-three (23) of the 47 partners lacked executed data-processing agreements as of the Engagement opening, meaning that disclosures to those partners could not qualify for the service-provider or contractor exemptions and were presumptively classified as "sales" or "sharing" under the CCPA/CPRA.
Thornbridge Media Corp. was identified as the highest-priority partner for remediation due to the volume of behavioral data exchanged between Cascade and Thornbridge in connection with Cascade's programmatic advertising program, the breadth of Thornbridge's data use (including cross-publisher audience modeling and retargeting), and the magnitude of Cascade's FY2024 advertising spend with Thornbridge ($18.4 million). The restructuring of the Cascade-Thornbridge data-sharing agreement was prioritized as a standalone Phase 1 deliverable and milestone.
Status: Complete.
6. FTC & California AG Inquiry Summary Memorandum (Deliverable 1A-06). The FTC & California AG Inquiry Summary Memorandum was completed on June 20, 2025. This memorandum was prepared to ensure that the compliance program was designed with full awareness of Cascade's prior regulatory interactions.
The memorandum summarized two prior regulatory matters:
(a) FTC Civil Investigative Demand (File No. 232-0147). On September 14, 2023, the Federal Trade Commission issued a Civil Investigative Demand ("CID") to Cascade in connection with an investigation into alleged dark-pattern practices in the Cascade mobile application's unsubscribe and account-cancellation flow. The CID sought documents and information relating to the design, testing, and user-experience metrics of the mobile app's subscription-management and account-deletion interfaces. Cascade cooperated fully with the investigation, which was closed on April 3, 2024 with no enforcement action taken.
(b) California Attorney General Informal Inquiry. On February 6, 2024, the California Attorney General's office sent an informal inquiry letter to Cascade regarding the adequacy of Cascade's "Do Not Sell My Personal Information" link and the Company's service-provider agreements. Cascade responded on March 8, 2024 through outside counsel. No formal enforcement action was initiated; however, the inquiry identified deficiencies in Cascade's opt-out link placement and certain service-provider agreements that informed the design of the current compliance program — specifically, the remediation of Gap #2 (universal opt-out mechanism) and Gap #4 (missing DPAs).
While both matters were resolved without enforcement action, they underscore the importance of maintaining a robust compliance posture and the heightened regulatory scrutiny to which large consumer-facing retailers such as Cascade are subject. The compliance program was designed with these prior interactions in mind, and the remediation of the specific deficiencies identified in the California AG inquiry was incorporated into Phase 1 deliverables.
Status: Complete.
7. Children's Privacy & Age-Gating Analysis Memorandum (Deliverable 1A-07). The Children's Privacy & Age-Gating Analysis Memorandum was completed on July 21, 2025. This memorandum assessed Cascade's obligations under the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. §§ 6501–6506, and state-law age-gating requirements, including California's Age-Appropriate Design Code Act ("AADC"), Cal. Civ. Code §§ 1798.99.28–1798.99.40, and emerging state requirements for data processing involving minors.
The analysis concluded that Cascade does not operate a website or online service directed to children under 13, and Cascade does not have actual knowledge that it collects personal information from children under 13. Accordingly, Cascade is not subject to COPPA's verifiable-parental-consent requirements under current operations. However, the memorandum noted that certain features of cascade.com and the Cascade mobile application (including the Cascade Rewards loyalty program, which permits registration by individuals of any age) could attract users under 16, and that the California AADC and CCPA/CPRA impose distinct obligations regarding the personal information of consumers under 16.
The memorandum recommended the implementation of age-gate mechanisms on cascade.com and the Cascade mobile application to support compliance with the California AADC (to the extent enforceable following ongoing litigation) and emerging state requirements regarding minors' data. Additionally, the memorandum recommended enhanced disclosures in the omnibus privacy policy regarding Cascade's practices with respect to minors' personal information and the opt-in consent requirement under CCPA/CPRA § 1798.120(c) for the sale or sharing of personal information of consumers under 16.
Status: Complete.
B. Policy and Notice Deliverables
1. Omnibus Privacy Policy — Consumer-Facing (Deliverable 1B-01). The Omnibus Privacy Policy was delivered in draft form on September 12, 2025, was subsequently reviewed by Ms. Tanaka and Ms. Polk with input from business-unit stakeholders, and was finalized and deployed on cascade.com, the Cascade mobile application, and in-store kiosks prior to the consent-management platform go-live on December 15, 2025.
This comprehensive US privacy notice represents a complete replacement of Cascade's prior privacy policy, which had last been updated in March 2022 and failed to address fourteen (14) of the nineteen (19) applicable state privacy statutes. The deployment of the new Omnibus Privacy Policy cures Gap #1 as identified in the Comprehensive Gap-Analysis Report.
The Omnibus Privacy Policy addresses the following topics in a layered, consumer-friendly format designed to meet the disclosure requirements of all nineteen applicable state privacy statutes:
• Categories of personal information collected, including enumeration by CCPA/CPRA statutory categories
• Sources from which personal information is collected
• Business and commercial purposes for processing personal information
• Categories of third parties to whom personal information is disclosed, sold, or shared
• Consumer rights by state of residence, including specific disclosures for each state with an applicable privacy statute
• Right to opt out of the sale and sharing of personal information
• Right to limit use and disclosure of sensitive personal information
• Data-retention periods for each category of personal information
• Information about the Cascade Rewards loyalty program as a financial-incentive program
• Contact information for exercising consumer rights, including web form, toll-free telephone number, and email address
• Effective date and version history
The Omnibus Privacy Policy was drafted to be consistent across cascade.com (desktop and mobile web), the Cascade mobile application (iOS and Android), and in-store operations, with appropriate channel-specific variations where necessary.
Status: Complete. Deployed December 15, 2025.
2. California-Specific Privacy Disclosures Addendum (Deliverable 1B-02). The California-Specific Privacy Disclosures Addendum was delivered on September 12, 2025. This addendum supplements the Omnibus Privacy Policy with disclosures specifically required by the CCPA/CPRA, including:
• Categories of personal information collected in the preceding 12 months
• Categories of personal information sold or shared in the preceding 12 months, and the categories of third parties to whom such information was sold or shared
• Categories of personal information disclosed for a business purpose in the preceding 12 months, and the categories of recipients
• Business and commercial purposes for collecting, selling, or sharing personal information
• Retention periods for each category of personal information collected
• Full description of consumer rights under the CCPA/CPRA, including the right to know, right to delete, right to correct, right to opt out of sale/sharing, right to limit use of sensitive personal information, and right to non-discrimination
• Financial-incentive notice for the Cascade Rewards loyalty program, as required by CCPA/CPRA § 1798.125, including a description of the material terms of the program, a good-faith estimate of the value of the consumer's data to the business, and a description of the method used to calculate such value
The addendum includes a reference to FY2024 annual DSR metrics, as required by the CCPA/CPRA: approximately 38,400 total data-subject requests received (access requests: approximately 12,800; deletion requests: approximately 19,100; opt-out of sale/sharing requests: approximately 6,500). These metrics are published in accordance with the CCPA/CPRA's requirement that businesses report annually the number of requests received, complied with, and denied, along with median response times.
Status: Complete. Deployed December 15, 2025.
3. State-Specific Consumer Rights Supplement (Deliverable 1B-03). The State-Specific Consumer Rights Supplement was delivered on September 12, 2025. This supplement provides state-by-state descriptions of consumer rights for residents of Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Jersey, New Hampshire, Nebraska, Minnesota, Maryland, Kentucky, and any other state whose privacy statute is applicable to Cascade as of the deployment date.
Each state-specific section describes the consumer rights available under that state's law, the procedures for exercising those rights, applicable response timelines, and — where required by state law — the appeal process available to consumers whose requests are denied. The inclusion of appeal-process descriptions for Virginia, Colorado, Connecticut, and other states requiring such processes cures a portion of Gap #7 (DSR portal lacking appeal-process functionality).
The supplement was designed as a modular document that can be updated as additional state privacy statutes take effect, without requiring a comprehensive revision of the Omnibus Privacy Policy.
Status: Complete. Deployed December 15, 2025.
4. Cookie & Tracking-Technology Notice (Deliverable 1B-04). The Cookie & Tracking-Technology Notice was delivered on September 12, 2025. This notice describes all twelve (12) categories of cookies and tracking technologies deployed on cascade.com and the Cascade mobile application, including their purposes, data collected, duration, and the opt-out or opt-in mechanisms available to consumers.
The notice was integrated with the OnPoint Data Solutions consent-management platform ("CMP"), which presents consumers with a layered cookie-consent interface at the point of first visit and provides persistent preference-management functionality. The CMP is configured to recognize and honor Global Privacy Control ("GPC") signals transmitted by consumers' browsers or devices, treating such signals as valid opt-out-of-sale/sharing and opt-out-of-targeted-advertising requests under the CCPA/CPRA, Colorado CPA, Connecticut CTDPA, Montana MCDPA, Texas TDPSA, Oregon OCPA, and other applicable state statutes. The deployment of the CMP and the honoring of GPC signals cures Gap #2.
The twelve categories of cookies and tracking technologies covered by the notice include: (i) strictly necessary cookies; (ii) performance/analytics cookies; (iii) functionality cookies; (iv) first-party advertising cookies; (v) third-party advertising cookies; (vi) retargeting pixels; (vii) social-media widgets and pixels; (viii) cross-device tracking identifiers; (ix) session-replay tools; (x) A/B testing cookies; (xi) geolocation-related trackers; and (xii) affiliate and referral cookies.
Status: Complete. Deployed December 15, 2025.
5. Employee & Job-Applicant Privacy Notice (Deliverable 1B-05). The Employee & Job-Applicant Privacy Notice was delivered on September 12, 2025. This notice addresses Cascade's collection, use, and disclosure of personal information of the Company's approximately 22,500 employees and job applicants across all states in which Cascade operates.
The notice was drafted to comply with the CCPA/CPRA's requirements applicable to employee data, which were fully operative as of January 1, 2023 following the expiration of the CCPA's employee-data exemption. The notice also addresses analogous obligations under other state privacy statutes to the extent applicable to employee data. Topics covered include categories of employee and applicant personal information collected, purposes of processing, retention periods, employee rights under applicable state law, and the procedures for exercising those rights.
Status: Complete. Deployed December 15, 2025.
6. Cascade Rewards Loyalty-Program Privacy Notice (Deliverable 1B-06). The Cascade Rewards Loyalty-Program Privacy Notice was delivered on September 12, 2025. This supplemental notice addresses the privacy practices specific to Cascade's Rewards loyalty program, which serves approximately 41.2 million registered members.
The notice was drafted to satisfy the financial-incentive and loyalty-program disclosure requirements of CCPA/CPRA § 1798.125, including the material terms of the loyalty program, the categories of personal information collected in connection with the program (including purchase history, product preferences, browsing behavior, and demographic data), the good-faith estimate of the value of the consumer's data, the method used to calculate such value, and the consumer's right to opt in to, opt out of, or withdraw from the program at any time without being subject to discriminatory treatment.
The loyalty-program notice was coordinated with Mr. Leclaire's marketing team to ensure consistency with program terms and conditions and alignment with Cascade's customer-engagement strategy.
Status: Complete. Deployed December 15, 2025.
7. Third-Party Marketplace Seller Privacy Notice (Deliverable 1B-07). The Third-Party Marketplace Seller Privacy Notice was delivered on September 12, 2025. This notice is directed to the approximately 3,800 third-party sellers operating on the Cascade Digital Marketplace LLC platform and addresses Cascade's processing of seller personal information, including seller account information, transaction data, payment information, and communications data.
The notice was drafted to comply with the CCPA/CPRA and other applicable state privacy statutes to the extent that marketplace sellers qualify as "consumers" (i.e., natural persons identifiable through their personal information) under those statutes, including sole proprietors and individual sellers.
Status: Complete. Deployed December 15, 2025.
C. Contracts and Vendor Management Deliverables
1. Master DPA Template — Service Providers (Deliverable 1C-01). The Master Data Processing Agreement Template for Service Providers was finalized on September 30, 2025. This template is designed for use with vendors that qualify as "service providers" under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ag)) and equivalent roles under other state statutes (e.g., "processor" under the VCDPA, Colorado CPA, CTDPA, and other state laws modeled on the Virginia framework).
The template incorporates the following contractual provisions required by the CCPA/CPRA and analogous state statutes:
• Limitations on the service provider's use, retention, and disclosure of personal information to the extent necessary to perform the services specified in the agreement
• Prohibition on selling or sharing personal information received from Cascade
• Prohibition on retaining, using, or disclosing personal information outside of the direct business relationship between Cascade and the service provider
• Obligations to assist Cascade in responding to consumer rights requests, including access, deletion, correction, and opt-out requests
• Audit rights permitting Cascade (or its designee) to conduct annual compliance assessments
• Sub-processor requirements, including notice to Cascade before engaging new sub-processors and flow-down of equivalent contractual restrictions
• Obligations to delete or return personal information upon termination or expiration of the agreement
• Certification that the service provider understands and will comply with the applicable restrictions
• Data-security obligations, including implementation of reasonable security measures
• Breach-notification requirements, including a 48-hour notification timeline
The template was designed to be deployed across Cascade's vendor population through a standardized rollout process, with appropriate customization for vendor-specific circumstances.
Status: Complete.
2. Master DPA Template — Contractors (Deliverable 1C-02). The Master Data Processing Agreement Template for Contractors was finalized on September 30, 2025. This template is designed for use with vendors that qualify as "contractors" under the CCPA/CPRA (Cal. Civ. Code § 1798.140(j)), a classification that carries heightened restrictions compared to the service-provider classification.
In addition to the provisions included in the service-provider template, the contractor template includes:
• A prohibition on combining personal information received from or on behalf of Cascade with personal information received from or on behalf of another person, or collected from the contractor's own interaction with the consumer, except as expressly permitted by the CCPA/CPRA
• A requirement that the contractor certify that it understands the restrictions applicable to contractors and will comply with them
• Enhanced compliance-monitoring provisions, including the right to take reasonable and appropriate steps to help ensure that the contractor uses personal information in a manner consistent with Cascade's obligations under the CCPA/CPRA
• Provisions addressing the contractor's obligations in the event of a breach of the contractual restrictions, including notification, remediation, and indemnification obligations
Status: Complete.
3. Thornbridge Media Corp. Data-Sharing Agreement (Deliverable 1C-03). The restructured data-sharing agreement between Cascade Retail Holdings Inc. and Thornbridge Media Corp. ("Thornbridge") was executed on October 31, 2025, on target with the Phase 1 milestone schedule. This agreement governs the data-sharing relationship between Cascade and Thornbridge in connection with Cascade's programmatic advertising program and represents one of the most commercially significant deliverables of Phase 1, given Cascade's FY2024 advertising spend with Thornbridge of $18.4 million.
The agreement was negotiated with Victor Sandoval of Kellner Park & Associates LLP (outside counsel to Thornbridge) and Leah Voss, General Counsel of Thornbridge Media Corp. Negotiations extended over approximately eight weeks and involved multiple rounds of draft exchanges, culminating in the executed agreement.
The restructured agreement addresses the following key compliance requirements:
(a) CCPA Sale/Sharing Classification. The agreement establishes the proper classification of data flows between Cascade and Thornbridge under the CCPA/CPRA's "sale" and "sharing" definitions. Certain data flows that were previously unclassified are now governed by explicit contractual provisions ensuring compliance with opt-out requirements.
(b) Opt-Out Compliance and GPC Signal Honoring. The agreement requires Thornbridge to honor opt-out-of-sale/sharing requests transmitted by Cascade, including real-time pass-through of Global Privacy Control signals. This was a key negotiation issue, as Thornbridge initially proposed batch-processing of opt-out signals on a 24-hour cycle. The final agreement requires real-time GPC signal pass-through, which we consider essential for compliance with the CCPA/CPRA and the California Privacy Protection Agency's regulations.
(c) Data Minimization and Purpose Limitations. The agreement restricts Thornbridge's use of Cascade consumer data to the specific advertising purposes identified in the agreement and prohibits use for any other purpose without Cascade's prior written consent.
(d) Consumer-Rights Assistance. The agreement requires Thornbridge to cooperate with Cascade in responding to consumer rights requests, including access, deletion, and correction requests, within specified timelines.