1038-00010 · Cascade Retail Holdings · Contracts & Vendor Management

fieldhaven-data-protection-review-memo.docx DOCUMENT Finance & Banking

12 / 38 ← → ✕

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT

MEMORANDUM

PRIVILEGE DESIGNATION: This memorandum is a privileged and confidential attorney work-product communication prepared in connection with Calderwood & Harkness LLP's representation of Cascade Retail Holdings Inc. It is not intended for disclosure to third parties and should not be shared outside of the attorney-client relationship without prior approval. This memorandum reflects the mental impressions, conclusions, opinions, and legal theories of the attorneys involved and is protected under Federal Rule of Civil Procedure 26(b)(3) and applicable state work-product doctrines. Distribution of this memorandum outside of the Calderwood & Harkness engagement team and authorized Cascade personnel may constitute a waiver of privilege.

I. Executive Summary

This memorandum sets forth the results of our review of the data-handling, confidentiality, and data-protection provisions contained in the existing Statement of Work ("SOW") between Cascade Retail Holdings Inc. ("Cascade" or "CRH") and Fieldhaven Consulting Group LLC ("Fieldhaven") for the privacy-program technical implementation engagement. The purpose of this review is to identify gaps in the current contractual framework that may expose Cascade to regulatory, operational, and litigation risk under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"), and the analogous privacy statutes of the 18 other states in which Cascade has compliance obligations.

Fieldhaven is a Delaware limited liability company headquartered at 350 Sansome Street, Suite 400, San Francisco, California 94104. Marcus Ellerby serves as the engagement lead for the Fieldhaven team. Fieldhaven was retained by Cascade to serve as the primary technical implementer for three critical workstreams within Cascade's US state-privacy compliance program:

1. Enterprise data mapping and inventory — a comprehensive identification and cataloging of all personal information collected, processed, stored, and shared by Cascade across its retail, e-commerce, mobile, loyalty-program, marketplace, and advertising operations;

2. Deployment of the OnPoint Data Solutions Inc. consent-management platform ("CMP") — implementation and configuration of a centralized platform for obtaining, managing, and documenting consumer consent and opt-out preferences across Cascade's digital properties; and

3. Data-subject-request ("DSR") workflow automation — design, build, and deployment of automated workflows to receive, route, verify, fulfill, and document consumer privacy-rights requests across all applicable jurisdictions.

The total fixed-fee value of the Fieldhaven SOW is $3,150,000, payable in three milestone-based installments:

Summary Conclusion. The current Fieldhaven SOW contains general confidentiality language but lacks the specific data-protection provisions necessary to satisfy CCPA/CPRA service-provider requirements and analogous processor obligations under the 19 applicable state privacy statutes. In its present form, the SOW does not establish Fieldhaven as a "service provider" within the meaning of California Civil Code Section 1798.140(ag), does not impose adequate restrictions on Fieldhaven's use, retention, or disclosure of Cascade personal information, and does not contain sub-processor flow-down requirements, data-destruction obligations, breach-notification terms, compliance-assistance commitments, or audit rights. This memorandum identifies seven areas requiring amendment and provides specific recommendations for each.

This review is being coordinated with Calderwood & Harkness's broader vendor Data Processing Agreement ("DPA") rollout plan and the gap-analysis work currently underway for Cascade's US state-privacy compliance program, an engagement that was opened on June 2, 2025. The recommendations set forth herein are intended to be implemented on an expedited basis to address an identified gap, with a target execution date for an interim data-protection amendment of August 8, 2025, and a comprehensive DPA rider to follow upon finalization of the firm's Master DPA Template for service providers, which is targeted for September 30, 2025.

II. Background and Context

A. The Fieldhaven Engagement

Cascade retained Fieldhaven to serve as the primary technical implementer for its comprehensive US state-privacy compliance program. Fieldhaven's scope of work encompasses the three workstreams described above — enterprise data mapping and inventory, CMP deployment, and DSR workflow automation — each of which requires Fieldhaven personnel to access, process, analyze, and in certain cases temporarily store significant volumes of Cascade personal information.

The Fieldhaven SOW was executed prior to Calderwood & Harkness's engagement on this matter. Specifically, the SOW predates June 2, 2025, the date on which Cascade formally retained this firm to conduct the US state-privacy compliance program. The SOW was negotiated and executed by Cascade's in-house legal and information-security teams, primarily Diana Polk, Associate General Counsel and Interim Chief Privacy Officer, and Gregory Farris, Chief Information Security Officer. Outside privacy counsel was not consulted during the negotiation or drafting of the SOW's data-protection terms — an omission that Ms. Polk has acknowledged and that prompted the inclusion of the Fieldhaven SOW in the scope of our current engagement.

Marcus Ellerby, a principal at Fieldhaven and the designated engagement lead, has managed the Fieldhaven team's work to date, including the delivery of the enterprise data-mapping report on May 19, 2025. As of the date of this memorandum, Milestone 1 (enterprise data mapping and inventory) is substantially complete, and Fieldhaven has begun preliminary work on Milestone 2 (CMP deployment). Accordingly, Fieldhaven has already accessed — and continues to access — extensive categories and volumes of Cascade personal information.

The categories and sources of personal information to which Fieldhaven has access in the course of performing the SOW include, but are not limited to, the following:

• Consumer data from Cascade's e-commerce platform (cascade.com), mobile application, and 186 retail locations across 31 states. This includes consumer names, email addresses, mailing addresses, phone numbers, purchase histories, payment card information (in tokenized form), browsing behavior, device identifiers, geolocation data, and demographic data collected at the point of sale and through digital interactions.

• Loyalty-program data from Cascade Rewards Corp. Cascade Rewards Corp., a wholly owned subsidiary of Cascade, operates the Cascade Rewards loyalty program, which has approximately 41.2 million registered members as of Q1 FY2025. Loyalty-program data includes member names, contact information, transaction histories, reward-point balances, redemption records, and behavioral preference data derived from purchase patterns.

• Third-party marketplace seller data from Cascade Digital Marketplace LLC. Cascade Digital Marketplace LLC, another wholly owned subsidiary, operates an online marketplace through which approximately 3,800 third-party sellers offer products on cascade.com. Seller data includes business names, contact information, bank account and routing numbers (for payment settlement), tax identification numbers, and sales data.

• Advertising and analytics data processed by Peakview Analytics Inc. Peakview Analytics Inc. serves as Cascade's primary advertising-analytics partner and processes approximately 2.1 billion consumer-event data records per month across Cascade's digital properties. Fieldhaven's data-mapping work required access to the Peakview data feeds and associated consumer identifiers.

• Data from 47 third-party advertising and analytics partners identified in the Fieldhaven data-mapping report dated May 19, 2025. These partners include demand-side platforms, data management platforms, social media advertising platforms, and measurement and attribution providers, each of which receives or processes Cascade consumer data in various capacities.

• Cookie and tracking-technology data. Fieldhaven's CMP deployment workstream requires access to and analysis of 12 categories of cookies and tracking technologies deployed on cascade.com, including first-party analytics cookies, third-party advertising cookies, session-management cookies, and pixel tags.

The breadth and sensitivity of the personal information to which Fieldhaven has access makes the absence of adequate data-protection terms in the SOW a matter of significant concern. As discussed in Section VII below, the current contractual framework exposes Cascade to regulatory enforcement risk, operational risk, insurance risk, and potential civil liability.

B. Regulatory Framework Driving This Review

Cascade's retail, e-commerce, marketplace, and loyalty-program operations are subject to the privacy and data-protection requirements of 19 state privacy statutes that are either currently effective or will become effective during the term of the Fieldhaven engagement. These statutes are as follows:

1. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — Cal. Civ. Code §§ 1798.100–1798.199.100

2. Virginia Consumer Data Protection Act (VCDPA) — Va. Code §§ 59.1-575–59.1-585

3. Colorado Privacy Act (CPA) — Colo. Rev. Stat. §§ 6-1-1301–6-1-1313

4. Connecticut Data Privacy Act (CTDPA) — Conn. Gen. Stat. §§ 42-515–42-525

5. Utah Consumer Privacy Act (UCPA) — Utah Code §§ 13-61-101–13-61-404

6. Iowa Consumer Data Protection Act (ICDPA) — Iowa Code §§ 715D.1–715D.8

7. Indiana Consumer Data Protection Act (INCDPA) — Ind. Code §§ 24-15-1-1–24-15-9-2

8. Tennessee Information Protection Act (TIPA) — Tenn. Code §§ 47-18-3201–47-18-3213

9. Montana Consumer Data Privacy Act (MCDPA) — Mont. Code §§ 30-14-2801–30-14-2817

10. Texas Data Privacy and Security Act (TDPSA) — Tex. Bus. & Com. Code §§ 541.001–541.205

11. Oregon Consumer Privacy Act (OCPA) — Or. Rev. Stat. §§ 646A.570–646A.590

12. Delaware Personal Data Privacy Act (DPDPA) — Del. Code tit. 6, §§ 12D-101–12D-115

13. New Jersey Data Privacy Act (NJDPA) — N.J. Stat. §§ 56:8-166–56:8-187

14. New Hampshire Data Privacy Act (NHDPA) — N.H. Rev. Stat. §§ 507-H:1–507-H:18

15. Nebraska Data Privacy Act (NDPA) — Neb. Rev. Stat. §§ 87-1101–87-1116

16. Minnesota Consumer Data Privacy Act (MN MCDPA) — Minn. Stat. §§ 325O.01–325O.22

17. Maryland Online Data Privacy Act (MODPA) — Md. Code Com. Law §§ 14-4601–14-4618

18. Kentucky Consumer Data Protection Act (KYDPA) — Ky. Rev. Stat. §§ 367.400–367.460

19. Additional statutes becoming effective through 2025–2026 as identified in the Calderwood & Harkness Multi-State Privacy Law Applicability Matrix

Each of these statutes imposes contractual requirements on entities that process personal information on behalf of a business or controller. While the specific requirements vary from state to state, they generally require that businesses enter into written agreements with their processors or service providers that include provisions: (a) specifying the purposes for which personal information is processed; (b) restricting the processor's use of personal information to the purposes set forth in the agreement; (c) requiring deletion or return of personal information upon completion of services; (d) requiring the processor to cooperate with compliance audits or assessments; and (e) requiring flow-down of equivalent obligations to any sub-processors.

The CCPA/CPRA imposes particularly stringent requirements on service-provider relationships. Under California Civil Code Section 1798.140(ag), a "service provider" must be a person or entity that processes personal information on behalf of a business pursuant to a written contract that, among other things:

(i) prohibits the service provider from selling or sharing the personal information;

(ii) prohibits the service provider from retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract;

(iii) prohibits the service provider from retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business; and

(iv) includes a certification made by the service provider that it understands the restrictions in the contract and will comply with them.

Critically, failure to execute a CCPA-compliant written agreement with a service provider may cause the service provider's receipt and processing of personal information to be classified as a "sale" or "sharing" of personal information under the CCPA, triggering consumer opt-out rights, notice obligations, and potential enforcement exposure. This classification risk is of particular concern for Cascade given the volume of personal information that Fieldhaven accesses and the categories of data involved.

Additionally, the gap-analysis workstream currently underway (target delivery date of August 15, 2025) has already identified that 23 of 47 advertising and analytics partners lack executed DPAs. Fieldhaven's SOW falls into the same contractual gap — it lacks adequate data-protection terms that would establish Fieldhaven's status as a compliant service provider or processor under the applicable statutes.

C. Cascade's Regulatory History — Relevance

This review is informed by Cascade's recent regulatory history with the California Attorney General. On February 6, 2024, the California Attorney General's office issued an informal inquiry letter to Cascade that specifically highlighted deficiencies in Cascade's service-provider agreements as an area of concern. While the inquiry did not result in formal enforcement action and Cascade provided a responsive submission, the inquiry placed Cascade on notice that the California AG views the adequacy of service-provider contracts as a priority compliance area.

Ensuring that the Fieldhaven SOW meets CCPA/CPRA service-provider standards is directly responsive to this regulatory concern. If the California AG were to revisit Cascade's service-provider agreements — whether as a follow-up to the February 2024 inquiry or in connection with a new investigation — the absence of CCPA-compliant terms in the Fieldhaven SOW would be a conspicuous deficiency, particularly given that Fieldhaven is serving as the technical implementer for Cascade's own privacy compliance program. The optics of retaining a privacy-program implementer under a contract that itself fails to comply with privacy law would be difficult to defend.

III. Scope of Review

This memorandum is based on our review of the following documents and materials:

1. Fieldhaven Consulting Group LLC Statement of Work — the undated, pre-engagement version provided to Calderwood & Harkness by Diana Polk via email on June 5, 2025. The SOW is the operative agreement between Cascade and Fieldhaven governing the privacy-program technical implementation engagement and is the primary subject of this review.

2. Fieldhaven Standard Terms and Conditions — a set of general terms and conditions incorporated by reference in the SOW (referenced at Section 1.2 of the SOW as "Fieldhaven's Standard Terms and Conditions, Version 4.3, available at https://www.fieldhaven.com/legal/terms"). These terms contain additional provisions relating to limitation of liability, indemnification, intellectual-property ownership, and general contracting matters, but do not contain data-protection-specific provisions beyond those in the SOW itself.

3. Fieldhaven Data-Mapping Report dated May 19, 2025 — the enterprise data-mapping report delivered by Fieldhaven as the primary deliverable under Milestone 1. This report was reviewed not for the purpose of assessing its substantive adequacy, but rather to understand the scope and categories of personal information to which Fieldhaven has had access in performing the SOW. The report confirms that Fieldhaven accessed all of the data categories described in Section II.A above.

4. Calderwood & Harkness Multi-State Privacy Law Applicability Matrix (working draft, last updated June 30, 2025) — a matrix identifying the applicability of each of the 19 state privacy statutes to Cascade's operations and summarizing the contractual requirements imposed by each statute on service-provider and processor relationships. This matrix was used as the reference framework for evaluating the SOW's compliance with multi-state requirements.

5. Calderwood & Harkness Draft Master DPA Template — Service Providers (in progress, target finalization September 30, 2025) — the firm's draft form of Data Processing Agreement for service providers, which is being developed as part of the broader Cascade privacy-compliance engagement. The DPA template reflects best-practices provisions drawn from all 19 applicable state statutes and will serve as the baseline for the recommended Fieldhaven SOW amendments.

The focus of this review encompassed seven principal areas:

(1) Classification of Fieldhaven under applicable state privacy statutes (i.e., as a "service provider" under CCPA/CPRA and as a "processor" under analogous state laws);

(2) Adequacy of restrictions on Fieldhaven's use, retention, and disclosure of Cascade personal information;

(3) Sub-contractor and sub-processor provisions, including flow-down requirements;

(4) Data destruction and return obligations upon SOW completion or termination;

(5) Incident-response and breach-notification provisions;

(6) Compliance-assistance obligations, including DSR-fulfillment and regulatory-inquiry cooperation; and

(7) Audit and monitoring rights for Cascade with respect to Fieldhaven's data-handling practices and security controls.

Each of these areas is addressed in the analysis and recommendations that follow.

IV. Analysis of Current SOW Data-Protection Provisions

A. Existing Confidentiality Clause (Section 8 of SOW)

The SOW contains a general mutual confidentiality provision at Section 8, titled "Confidentiality." This provision defines "Confidential Information" broadly to include "all non-public information disclosed by either party to the other party in connection with this Statement of Work, whether disclosed orally, in writing, electronically, or by any other means, and whether or not marked as confidential." The clause imposes standard non-disclosure obligations on both parties, prohibiting disclosure of Confidential Information to third parties except to employees, agents, and advisors with a need to know, and requiring that such recipients be bound by confidentiality obligations no less restrictive than those in the SOW. The clause includes standard carve-outs for information that is or becomes publicly available, was previously known to the receiving party, is independently developed, or is disclosed pursuant to legal process.

The confidentiality clause uses a generic three-year survival period, providing that the confidentiality obligations survive expiration or termination of the SOW for a period of three years. While this survival period may be adequate for general business-confidentiality purposes, it is not tailored to the indefinite obligations that privacy statutes impose on the use and protection of personal information.

Deficiency. The confidentiality clause does not distinguish between general confidential business information and "personal information" as defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(o)) or equivalent terms under other state privacy statutes. There is no specific reference to personal data, consumer data, or any privacy-law construct within the clause. As a result, the clause does not:

• Impose purpose limitations on the use of personal information, as required by CCPA § 1798.100(d);

• Restrict Fieldhaven from combining Cascade personal information with personal information received from other sources or collected from Fieldhaven's own interactions with consumers, as required by CCPA § 1798.140(ag)(1)(A)(v);

• Contain any of the mandatory contractual elements required by CCPA § 1798.100(d) or § 1798.140(ag), including the prohibition on selling or sharing personal information, the restriction on use outside the direct business relationship, or the certification that the service provider understands and will comply with applicable restrictions;

• Address the distinct treatment of personal information that is required across the 19 applicable state privacy statutes, each of which imposes obligations on data processing that go beyond general confidentiality.

In short, while Section 8 provides a baseline level of protection for Cascade's proprietary business information, it is wholly inadequate to address the regulatory requirements applicable to the personal information that Fieldhaven processes on Cascade's behalf.

B. Existing Data-Handling Provision (Section 9 of SOW)

Section 9 of the SOW, titled "Data Handling," contains a brief paragraph — approximately four sentences in length — requiring Fieldhaven to "use commercially reasonable security measures to protect Client data in its possession or control" and to "handle Client data in accordance with applicable laws." The provision further states that Fieldhaven "will not use Client data for any purpose other than performing the services described in this Statement of Work" and that Fieldhaven will "promptly notify Client in the event of any unauthorized access to Client data." The provision does not define "Client data," does not reference any specific privacy statutes, and does not elaborate on the meaning of "commercially reasonable security measures" or "applicable laws."

Deficiency. While Section 9 contains the seed of a data-handling provision, it is insufficiently specific to satisfy the requirements of any of the 19 applicable state privacy statutes. The principal deficiencies are as follows:

• No reference to specific statutes or definitions. The phrase "applicable laws" is generic and does not create the affirmative certifications required by the CCPA. Under Section 1798.140(ag), a service-provider agreement must include a certification that the service provider "understands" the restrictions imposed by the CCPA and "will comply with them." A general reference to "applicable laws" does not constitute such a certification.

• No enumeration of permitted purposes. While Section 9 restricts Fieldhaven's use of "Client data" to "performing the services described in this Statement of Work," it does not enumerate the specific business purposes for which processing is permitted, as is required by CCPA § 1798.100(d)(1). The absence of an enumerated list of permitted purposes makes it difficult to determine whether a particular use by Fieldhaven is within or outside the scope of the agreement.

• No restrictions on retention beyond the engagement period. Section 9 contains no provision addressing the retention of Cascade data after the completion of the SOW, termination, or expiration. Absent such a provision, Fieldhaven could retain Cascade personal information indefinitely.

• No destruction or return obligations. Section 9 does not require Fieldhaven to delete or return Cascade data upon completion of services or upon Cascade's request. This omission is inconsistent with the data-destruction or return requirements found in the CCPA, VCDPA, Colorado CPA, CTDPA, and virtually all other applicable state statutes.

• Vague security standard. The "commercially reasonable security measures" standard is vague and potentially unenforceable. It does not reference any specific security framework, standard, or certification, and it provides no objective benchmark against which Fieldhaven's security practices can be measured or audited.

C. Absence of Key Provisions

Beyond the deficiencies in the existing Sections 8 and 9, the SOW is notable for the complete absence of several provisions that are either expressly required by applicable privacy statutes or represent industry best practices for service-provider and processor relationships. The following provisions are entirely missing from the SOW:

• CCPA service-provider certification (§ 1798.140(ag)) — The SOW does not contain the certification required by the CCPA that the service provider understands and will comply with the restrictions applicable to its processing of personal information.

• Sub-contractor/sub-processor restrictions or flow-down requirements — The SOW does not restrict Fieldhaven's use of sub-contractors, does not require prior notice to or consent from Cascade before sub-contractors are engaged, and does not require flow-down of data-protection obligations to sub-contractors.

• Data return or destruction obligations upon SOW completion or termination — As noted above, the SOW is silent on the disposition of Cascade personal information upon completion of services.

• Breach/incident notification clause with specified timelines — While Section 9 contains a general reference to "promptly notify" in the event of unauthorized access, it does not specify a timeline for notification, does not define "unauthorized access" or "security incident," and does not address Fieldhaven's obligations to cooperate with investigation and remediation.

• Audit or inspection rights — Cascade has no contractual right to audit or inspect Fieldhaven's data-handling practices, security controls, or compliance with the SOW.

• Compliance-assistance obligations — The SOW does not obligate Fieldhaven to assist Cascade in responding to consumer rights requests (DSRs), regulatory inquiries, or privacy impact assessments.

• Data-localization or transfer restrictions — The SOW does not address where Cascade personal information may be stored or processed, or whether Fieldhaven may transfer such information outside the United States.

• Restriction on combining Cascade PI with data from other sources — The SOW does not prohibit Fieldhaven from combining Cascade personal information with personal information obtained from other clients or sources.

• Defined list of permitted processing purposes — The SOW does not enumerate the specific purposes for which Fieldhaven is authorized to process Cascade personal information.

The cumulative effect of these omissions is that the SOW, in its current form, does not establish Fieldhaven as a "service provider" under the CCPA/CPRA or as a compliant "processor" under any of the other 18 applicable state privacy statutes. Remediation requires the execution of a comprehensive data-protection amendment or addendum addressing each of the deficiencies and omissions identified above.

V. Recommended Amendments

Based on the analysis set forth in Section IV, we recommend the following seven categories of amendments to the Fieldhaven SOW. These recommendations are designed to bring the SOW into compliance with the CCPA/CPRA and the other 18 applicable state privacy statutes, to align with industry best practices for service-provider and processor agreements, and to be consistent with the Calderwood & Harkness draft Master DPA Template for service providers currently under development.

A. CCPA Service-Provider Classification and Certification

Fieldhaven should be expressly classified as a "service provider" under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ag)) and as a "processor" under the VCDPA, Colorado CPA, CTDPA, and analogous state privacy statutes. The SOW amendment should include clear definitional language establishing this classification and incorporating the applicable statutory definitions by reference.

In connection with this classification, the SOW must include an express certification by Fieldhaven that it:

(a) Understands and will comply with the restrictions imposed by the CCPA/CPRA and other applicable state privacy laws on the processing of personal information on behalf of Cascade;

(b) Will not sell or share (as those terms are defined under the CCPA, Cal. Civ. Code §§ 1798.140(ad) and 1798.140(ah)) personal information received from or on behalf of Cascade;

(c) Will not retain, use, or disclose personal information received from or on behalf of Cascade for any purpose other than the specific business purposes set forth in the SOW, and will not retain, use, or disclose such personal information for any commercial purpose other than providing the services specified in the SOW;

(d) Will not retain, use, or disclose personal information received from or on behalf of Cascade outside of the direct business relationship between Fieldhaven and Cascade;

(e) Will not combine personal information received from or on behalf of Cascade with personal information received from, or on behalf of, another person or persons, or personal information collected from Fieldhaven's own interaction with consumers, except as expressly permitted by the CCPA (Cal. Civ. Code § 1798.140(ag)(1)(A)(v)); and

(f) Grants Cascade the right, upon notice, to take reasonable and appropriate steps to ensure that Fieldhaven uses personal information consistent with Cascade's obligations under the CCPA and other applicable statutes.

Implementation Recommendation. These certifications should be incorporated as a new Section 9A of the SOW or, alternatively, as a standalone addendum or rider to the SOW. The substance of these provisions should conform in all material respects to the corresponding provisions of the Calderwood & Harkness draft Master DPA Template — Service Providers, which is currently being developed and is targeted for finalization by September 30, 2025. However, given the urgency of the issue and the fact that Fieldhaven is already actively processing Cascade personal information, we recommend that an interim amendment incorporating these certifications be executed promptly — with a target date of August 8, 2025 — rather than waiting for the Master DPA Template to be finalized. The interim amendment can be structured to provide that it will be superseded by, or incorporated into, the comprehensive DPA rider upon finalization of the template.

B. Sub-Contractor / Sub-Processor Flow-Down Requirements

The current SOW permits Fieldhaven to engage sub-contractors in the performance of the SOW without providing prior notice to or obtaining prior consent from Cascade. Section 4.3 of the SOW states only that Fieldhaven "may engage qualified sub-contractors to assist in the delivery of services" and that "Fieldhaven remains responsible for the quality and timeliness of all deliverables." This provision is inadequate from a data-protection perspective.

Risk. If Fieldhaven engages sub-contractors who access, process, or store Cascade personal information without entering into CCPA-compliant sub-processing agreements, Cascade may lose the service-provider defense under the CCPA. Under Section 1798.140(ag)(1)(B), a service provider must enter into a written contract with any sub-contractor that receives personal information from the service provider, and that contract must prohibit the sub-contractor from retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the contract. If Fieldhaven fails to do so, Cascade could be deemed to have permitted the "sale" or "sharing" of personal information to the sub-contractor, with all of the regulatory consequences that follow.

Recommended Amendment. The SOW should be amended to include the following sub-contractor/sub-processor provisions:

(a) Prior Approval. Fieldhaven must provide Cascade with prior written notice of, and obtain Cascade's prior written approval before engaging, any sub-contractor that will access, process, or store Cascade personal information in connection with the performance of the SOW. Such notice must identify the proposed sub-contractor, describe the processing activities to be performed, and specify the categories of Cascade personal information to which the sub-contractor will have access.

(b) Flow-Down of Obligations. Fieldhaven must enter into a written agreement with each approved sub-contractor that imposes data-protection obligations on the sub-contractor that are no less protective of Cascade personal information than the obligations imposed on Fieldhaven under the amended SOW. Such agreements must include, at a minimum, the same restrictions on use, retention, and disclosure of personal information, the same data-destruction or return obligations, the same security requirements, and the same breach-notification obligations.

(c) Liability for Sub-Contractors. Fieldhaven remains fully responsible and liable for the acts and omissions of its sub-contractors with respect to Cascade personal information, to the same extent as if Fieldhaven had performed the acts or omissions itself. Fieldhaven's engagement of a sub-contractor does not relieve Fieldhaven of any obligation under the SOW.

(d) Sub-Contractor Registry. Fieldhaven must maintain and, upon Cascade's request, provide a current and complete list of all sub-contractors with access to Cascade personal information, including a description of the processing activities performed by each sub-contractor, the categories of personal information accessed, and the geographic locations where processing occurs.

C. Data Destruction and Return Upon Completion

The SOW does not address the disposition of Cascade personal information in Fieldhaven's possession, custody, or control upon completion of the SOW, termination, or expiration. This is a significant gap.

Risk. Indefinite retention of Cascade personal information by Fieldhaven after the conclusion of the engagement increases regulatory risk (by creating an ongoing processing relationship without a defined purpose), breach risk (by expanding the attack surface for Cascade personal information), and litigation risk (by potentially supporting a claim that Fieldhaven's continued possession of the data constitutes a "sale" or unauthorized use). The gap-analysis workstream has separately identified the absence of any documented data-retention schedule at Cascade itself as a compliance gap. The vendor relationship should not replicate this deficiency — indeed, the vendor context arguably presents a heightened risk, as Cascade has less direct control over the security and retention practices of an external party.

Recommended Amendment. The SOW should be amended to include the following data destruction and return provisions:

(a) Election to Return or Destroy. Upon completion of each milestone deliverable and upon final SOW completion, termination (for any reason), or expiration, Fieldhaven must, at Cascade's election, either (i) return to Cascade all Cascade personal information (and all copies, extracts, summaries, analyses, and derivatives thereof) in Fieldhaven's possession, custody, or control, or (ii) securely destroy all such information. Cascade's election must be communicated in writing within 15 days of the applicable trigger event; in the absence of such election, the default will be secure destruction.

(b) Certification of Destruction. Within 30 calendar days of the applicable trigger event, Fieldhaven must provide Cascade with a written certification, signed by an authorized officer of Fieldhaven, confirming that all Cascade personal information has been returned or destroyed in accordance with Cascade's election and that no copies, extracts, or derivatives remain in Fieldhaven's possession, custody, or control.

(c) Legal Hold Exception. A narrow exception to the destruction/return obligation may apply where Fieldhaven is required to retain specific categories of Cascade personal information pursuant to an applicable law, regulation, or legal-hold obligation. In such cases, Fieldhaven must (i) promptly notify Cascade in writing of the specific legal requirement compelling retention, identifying the categories and volume of data affected, (ii) continue to protect the retained data in accordance with all data-protection terms of the amended SOW, (iii) limit access to the retained data to those Fieldhaven personnel who require access to comply with the applicable legal requirement, and (iv) securely destroy the retained data promptly upon the expiration of the legal-retention requirement.

(d) Destruction Standards. All destruction of Cascade personal information must employ methods meeting NIST Special Publication 800-88, Revision 1 ("Guidelines for Media Sanitization") or equivalent industry standards. For electronic media, this includes, at a minimum, cryptographic erasure or overwriting techniques that render the data permanently unrecoverable. For physical media (if applicable), this includes cross-cut shredding or incineration. Fieldhaven's destruction certification must identify the methods used.

D. Incident-Response and Breach-Notification Obligations

The SOW's reference to "promptly notify" in the event of "unauthorized access" is wholly inadequate as a breach-notification provision. It does not define "unauthorized access," does not specify a notification timeline, does not identify notification recipients or channels, does not address Fieldhaven's obligations to cooperate with investigation and remediation, and does not allocate breach-related costs.

Risk. Fieldhaven has access to categories of personal information that, if compromised, could trigger notification obligations under multiple legal frameworks, including:

• The CCPA's requirement that businesses notify the California Attorney General of data breaches affecting 500 or more California residents (Cal. Civ. Code § 1798.82(f));

• State data-breach-notification statutes across all 50 states (and the District of Columbia), many of which impose notification timelines as short as 30 days from discovery;

• Potential federal notification obligations under FTC enforcement authority and, depending on the categories of data involved, sector-specific federal requirements; and

• Contractual notification obligations under Cascade's agreements with its payment-card processors and acquiring banks (PCI DSS-related requirements).

Additionally, Cascade maintains a cyber/privacy-liability insurance policy through Northcastle Indemnity Company with the following terms:

Timely notification of security incidents to the insurer is a condition precedent to coverage under the Northcastle policy. If a breach involving Cascade personal information occurs at Fieldhaven and Fieldhaven delays notification to Cascade, the resulting delay in Cascade's notification to Northcastle could jeopardize coverage for what could be a multi-million-dollar loss event.

Recommended Amendment. The SOW should be amended to include the following incident-response and breach-notification provisions:

(a) Notification Timeline. Fieldhaven must notify Cascade of any confirmed or reasonably suspected security incident involving Cascade personal information within 24 hours of discovery. For these purposes, "Discovery" means the point at which Fieldhaven has credible information indicating that a security incident has occurred or may have occurred, regardless of whether the full scope or nature of the incident has been determined.

(b) Notification Recipients and Channels. Notification must be directed to both Gregory Farris (CISO) and Diana Polk (Interim CPO) via (i) email to designated secure email addresses to be specified in the amendment and (ii) telephone to designated emergency contact numbers. Fieldhaven must also provide concurrent notice to Calderwood & Harkness LLP at a designated contact email address.

(c) Content of Notification. The initial notification must include, to the extent known at the time, the nature and scope of the incident, the categories and approximate volume of personal information affected, the date and time of discovery, the known or suspected cause, and the remediation steps taken or planned. Fieldhaven must provide supplemental information as it becomes available and must provide regular updates until the incident is resolved.

(d) Cooperation and Remediation. Fieldhaven must cooperate fully with Cascade's investigation of any security incident, including providing access to Fieldhaven systems, personnel, and records relevant to the investigation. Fieldhaven must preserve all evidence related to the incident, engage qualified forensic investigators (either its own or as designated by Cascade), and implement remediation measures as directed by Cascade or mutually agreed upon.

(e) Incident-Response Plan. Fieldhaven must maintain a written incident-response plan that addresses the identification, containment, investigation, remediation, and notification of security incidents. Fieldhaven must provide a copy of its incident-response plan to Cascade upon request and must promptly notify Cascade of any material changes to the plan.

(f) Allocation of Costs. Fieldhaven is responsible for all costs arising from a security incident to the extent the incident results from Fieldhaven's breach of its security obligations under the amended SOW, including but not limited to the costs of forensic investigation, legal fees, consumer notification, credit monitoring, regulatory fines or penalties, and claims by affected individuals. This cost-allocation provision is without prejudice to any indemnification obligations under the SOW or Fieldhaven's Standard Terms and Conditions.

E. Compliance-Assistance Obligations

The SOW does not address Fieldhaven's obligation to assist Cascade in fulfilling consumer privacy-rights requests (DSRs) or responding to regulatory inquiries. This omission is significant given both the volume of DSRs that Cascade receives and the regulatory attention that Cascade's service-provider practices have received.

Context. In fiscal year 2024, Cascade received approximately 38,400 data-subject requests across its operations, broken down as follows:

Cascade's average response time for DSRs in FY2024 was 27 calendar days, against an internal target of 15 business days or less. Improving DSR response times is one of the primary objectives of Fieldhaven's Milestone 3 workstream (DSR workflow automation, valued at $1,102,500). However, during the implementation period — which may extend several months — Fieldhaven itself will hold Cascade personal information and may need to search its own systems, return data to Cascade, or delete data in response to consumer requests directed to Cascade. Without a contractual obligation to provide this assistance, Fieldhaven could delay or refuse such requests, potentially causing Cascade to miss statutory response deadlines (typically 45 days under CCPA, with a 45-day extension available in certain circumstances; shorter deadlines apply under some other state statutes).

Recommended Amendment. The SOW should be amended to include the following compliance-assistance provisions:

(a) DSR Assistance. Fieldhaven must, upon Cascade's request and within timeframes specified by Cascade (which will be aligned with applicable statutory deadlines), assist Cascade in responding to consumer data-subject requests, including requests for access to personal information, deletion of personal information, correction of inaccurate personal information, and opt-out of the sale or sharing of personal information. Such assistance includes searching Fieldhaven's systems for Cascade personal information responsive to a DSR, providing copies of such information to Cascade (for access requests), deleting such information from Fieldhaven's systems (for deletion requests), and confirming completion of the requested action.

(b) Regulatory-Inquiry Assistance. Fieldhaven must assist Cascade in responding to inquiries, investigations, or enforcement actions by the Federal Trade Commission, the California Attorney General, the California Privacy Protection Agency, or any other state regulatory authority with jurisdiction over Cascade's data-processing practices. Such assistance includes providing information, documents, and access to Fieldhaven personnel as reasonably requested by Cascade, subject to appropriate confidentiality protections.

(c) Privacy Impact Assessments and Audits. Fieldhaven must provide reasonable cooperation with privacy impact assessments, data-protection impact assessments, and other assessments or audits that Cascade is required or elects to conduct in connection with its compliance obligations under applicable state privacy statutes.

F. Audit and Monitoring Rights

The SOW does not provide Cascade with any right to audit or inspect Fieldhaven's data-handling practices, security controls, or compliance with the SOW's data-protection terms (such as they are). This omission is inconsistent with industry best practices and with the expectations of multiple state privacy statutes.

Risk. The CCPA/CPRA and several other state privacy statutes contemplate that businesses will exercise oversight over their service providers' and processors' compliance with applicable data-protection requirements. Without audit rights, Cascade cannot demonstrate to regulators that it has taken reasonable steps to monitor and verify Fieldhaven's compliance. This could undermine Cascade's ability to rely on the service-provider defense under the CCPA or to demonstrate the "reasonable security" practices that are a prerequisite to avoiding private-right-of-action liability under California Civil Code Section 1798.150.

Recommended Amendment. The SOW should be amended to include the following audit and monitoring provisions:

(a) Right to Audit. Cascade, or its authorized designee (including Calderwood & Harkness LLP and any third-party auditor engaged by Cascade), has the right to audit Fieldhaven's data-handling practices, security controls, policies, procedures, and compliance with the data-protection terms of the amended SOW. Audits may be conducted upon reasonable prior written notice (not less than 15 business days except in the event of a suspected or confirmed security incident, in which case audit rights are immediate). Routine audits may be conducted no more than once per 12-month period; however, additional audits may be conducted in the event of a security incident, a material change in Fieldhaven's processing activities, or a regulatory inquiry directed at Cascade.

(b) Record-Keeping Obligations. Fieldhaven must maintain records sufficient to demonstrate its compliance with the data-protection terms of the amended SOW and with applicable privacy statutes. Such records must be maintained for the duration of the SOW and for a period of three years following SOW completion, termination, or expiration. Fieldhaven must make such records available to Cascade or its designee upon request in connection with any audit.

(c) Remediation of Deficiencies. If an audit identifies deficiencies in Fieldhaven's data-handling practices, security controls, or compliance with the SOW data-protection terms, Fieldhaven must promptly remediate such deficiencies at its own cost and must provide Cascade with a written remediation plan and timeline within 15 business days of receiving written notice of the deficiencies. Cascade retains the right to verify the adequacy of remediation through a follow-up audit.

(d) Third-Party Audit Reports. In lieu of, or in addition to, on-site audits, Cascade may elect to accept a current industry-standard audit report covering the relevant controls, such as a SOC 2 Type II report issued by an independent auditor in accordance with AICPA standards. To the extent that Fieldhaven obtains a SOC 2 Type II report, Fieldhaven must provide a copy to Cascade upon request. We note that coordination with Lakemont Audit Partners LLP, Cascade's independent auditor (engagement partner Sheila Brogan), will be advisable to ensure that the scope of any SOC 2 or privacy-controls audit of Fieldhaven is aligned with the controls being evaluated in Lakemont's broader audit of Cascade's privacy-compliance program.

G. Security Standards and Data Minimization

As noted in Section IV.B above, the SOW's "commercially reasonable security measures" standard is vague, provides no objective benchmark, and is potentially unenforceable in the event of a dispute. This standard should be replaced with specific, measurable security requirements.

Recommended Amendment. The SOW should be amended to include the following security and data-minimization provisions:

(a) Security Framework. Fieldhaven must implement and maintain an information-security program that is designed to protect the confidentiality, integrity, and availability of Cascade personal information and that is aligned with the NIST Cybersecurity Framework (CSF) 2.0 or an equivalent industry-recognized standard (e.g., ISO/IEC 27001:2022). Fieldhaven's security program must include, at a minimum, administrative, technical, and physical safeguards appropriate to the nature, scope, and sensitivity of the Cascade personal information processed.

(b) Encryption. All Cascade personal information must be encrypted both at rest and in transit using industry-standard encryption algorithms and key lengths (e.g., AES-256 for data at rest; TLS 1.2 or higher for data in transit). Encryption keys must be managed in accordance with industry best practices and must not be stored alongside the encrypted data.

(c) Access Controls. Fieldhaven must implement role-based access controls that limit access to Cascade personal information to those Fieldhaven personnel who have a demonstrated need-to-know for the purpose of performing the services specified in the SOW. Fieldhaven must enforce multi-factor authentication for all personnel accessing Cascade personal information or Cascade systems. Fieldhaven must promptly revoke access for any personnel whose role no longer requires access to Cascade personal information.

(d) Access Logging. Fieldhaven must maintain comprehensive access logs recording all access to Cascade personal information, including the identity of the accessing personnel, the date and time of access, and the nature of the access (e.g., read, write, delete, export). Access logs must be retained for a minimum of 12 months and must be made available to Cascade upon request.

(e) Data Minimization. Fieldhaven may access and process only the minimum categories and volume of Cascade personal information necessary for the performance of each milestone deliverable. Fieldhaven must not access, collect, or process Cascade personal information in excess of what is required for the specific tasks being performed at any given time. Upon completion of each milestone, Fieldhaven must review and, to the extent no longer needed, delete or return any Cascade personal information that was accessed or processed solely for the completed milestone.

VI. Interaction with Other Engagement Workstreams

The recommended amendments to the Fieldhaven SOW interact with several other workstreams within the broader Cascade US state-privacy compliance program. This section identifies the key coordination points.

A. Coordination with Master DPA Templates

Calderwood & Harkness is currently developing Master DPA Templates for use across Cascade's vendor relationships, including a service-provider template and a contractor template. These templates are being designed to incorporate the contractual requirements of all 19 applicable state privacy statutes into a single, comprehensive agreement form. The target date for finalization of the Master DPA Templates is September 30, 2025.

The Fieldhaven SOW amendment should be aligned with the draft Master DPA Template — Service Providers to the greatest extent practicable. However, given that the Master DPA Template is not yet finalized and the Fieldhaven SOW gap requires immediate remediation, we recommend a two-step approach:

Step 1 (Interim Amendment). Prepare and execute an interim data-protection amendment to the Fieldhaven SOW incorporating all recommendations set forth in Section V of this memorandum. The interim amendment should be based on the current working draft of the Master DPA Template and should include a provision stating that the interim amendment will be superseded by, or incorporated into, a comprehensive DPA rider upon finalization of the Master DPA Template. Target execution date: August 8, 2025 (30 days from the date of this memorandum).

Step 2 (Comprehensive DPA Rider). Upon finalization of the Master DPA Template — Service Providers on or about September 30, 2025, prepare and execute a formal DPA rider to the Fieldhaven SOW that replaces the interim amendment in its entirety. The comprehensive DPA rider will incorporate the final, vetted language of the Master DPA Template and will serve as the definitive data-protection agreement between Cascade and Fieldhaven for the remainder of the SOW term.

B. Coordination with Vendor DPA Rollout Plan

The third-party data-sharing risk assessment, which is targeted for delivery on August 4, 2025, has identified 23 of 47 advertising and analytics partners that lack executed DPAs. While Fieldhaven is not an advertising or analytics partner, it falls into the same contractual gap — a vendor with access to significant volumes of Cascade personal information operating without CCPA-compliant data-protection terms.

Remediation of the Fieldhaven SOW should be prioritized within the broader vendor DPA rollout plan given: (a) the sensitivity and volume of data to which Fieldhaven has access; (b) the fact that Fieldhaven's engagement specifically involves privacy-program implementation, making the absence of compliant data-protection terms particularly conspicuous; and (c) the fact that Fieldhaven has already accessed Cascade personal information in the course of performing the Milestone 1 data-mapping work. We recommend that the Fieldhaven SOW amendment be treated as the first vendor DPA remediation completed under the rollout plan.

C. Coordination with OnPoint Data Solutions

Fieldhaven's Milestone 2 workstream involves the deployment of the OnPoint Data Solutions Inc. consent-management platform. OnPoint's engagement with Cascade involves a three-year SaaS contract with an annual license fee of $480,000 per year (total contract value of $1,440,000 over the three-year term). In performing the CMP deployment, Fieldhaven will interact directly with OnPoint's systems and may access data processed by or through the OnPoint platform.

This interaction creates a sub-processor relationship in which OnPoint may function as a sub-processor to Fieldhaven with respect to certain categories of Cascade personal information. The sub-contractor flow-down provisions recommended in Section V.B above should expressly address this interaction and should require Fieldhaven to ensure that its agreement with OnPoint includes data-protection terms that are consistent with the amended Fieldhaven SOW. Additionally, a separate DPA Rider/Amendment is being prepared for the OnPoint contract (target execution date of September 25, 2025), and the terms of the Fieldhaven and OnPoint DPAs should be coordinated to avoid gaps or inconsistencies in the data-protection framework.

D. Fieldhaven Data-Mapping Report

As noted in Section II.A above, Fieldhaven's enterprise data-mapping report, delivered on May 19, 2025, involved Fieldhaven's access to and processing of extensive categories and volumes of Cascade personal information. This processing occurred prior to Calderwood & Harkness's engagement and prior to the execution of any CCPA-compliant data-protection terms. While this fact cannot be retroactively remedied — the processing has already occurred — it reinforces the urgency of executing compliant amendments now to govern Fieldhaven's ongoing and future processing of Cascade personal information in connection with Milestones 2 and 3.

We note that the data-mapping report deliverable may itself constitute Cascade personal information to the extent it contains or reflects personal information identified during the mapping exercise. The data-destruction and return provisions recommended in Section V.C should address the disposition of the data-mapping report and any underlying work papers, data extracts, or derivative analyses generated by Fieldhaven during the Milestone 1 work.

VII. Risk Assessment

The absence of adequate data-protection terms in the Fieldhaven SOW exposes Cascade to risk across multiple dimensions. We summarize the principal risk categories below.

Regulatory Risk. Without CCPA-compliant service-provider agreements, Fieldhaven's receipt and processing of Cascade personal information could be classified as a "sale" of personal information under CCPA Section 1798.140(ad), or as a "sharing" of personal information under CCPA Section 1798.140(ah). Either classification would trigger consumer opt-out rights, notice obligations (including updates to Cascade's online privacy policy and "Do Not Sell or Share My Personal Information" disclosures), and potential enforcement exposure. The California Attorney General has already demonstrated attention to the adequacy of Cascade's service-provider agreements through the February 6, 2024, informal inquiry letter. A finding that Cascade's privacy-program implementer is itself operating under a non-compliant agreement would likely be viewed as a significant aggravating factor in any enforcement proceeding. Additionally, Cascade could face enforcement actions by the California Privacy Protection Agency ("CPPA"), which has rulemaking and enforcement authority under the CPRA and has signaled service-provider contracts as a focus area. The risk is not limited to California; the other 18 applicable state statutes similarly impose contractual requirements on processor relationships, and deficiencies could expose Cascade to multi-state enforcement coordination.

Operational Risk. The absence of breach-notification obligations in the Fieldhaven SOW creates a gap in Cascade's incident-response chain. If a security incident occurs at Fieldhaven involving Cascade personal information, there is no contractual mechanism to ensure that Gregory Farris (CISO) and Diana Polk (Interim CPO) receive timely notification. This gap could delay Cascade's ability to contain the incident, conduct a forensic investigation, notify affected consumers, and satisfy regulatory-notification requirements. Given that many state breach-notification statutes impose notification deadlines measured from the date of discovery by the "owner" or "licensee" of the data (which, in the case of a vendor breach, may be triggered by the vendor's discovery rather than the business's discovery), any delay in vendor-to-business notification directly compresses the time available for Cascade to fulfill its own notification obligations.

Insurance Risk. Late notification of a data breach to Cascade's cyber/privacy-liability insurer, Northcastle Indemnity Company, could jeopardize coverage under the policy. The Northcastle policy, which provides $25 million per occurrence and $50 million annual aggregate coverage at an annual premium of $1,340,000, contains notice provisions that require prompt reporting of incidents. If a Fieldhaven breach goes unreported to Cascade for days or weeks — as is possible without a contractual notification timeline — the resulting delay in Cascade's notification to Northcastle could provide the insurer with a basis to deny or limit coverage. Given the volume and sensitivity of data at issue, a coverage denial could expose Cascade to substantial uninsured losses.

Contractual Risk. Without data-destruction or return obligations, Cascade personal information may persist indefinitely in Fieldhaven's systems, databases, backups, and work-product files after the SOW is completed. This c

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT
MEMORANDUM
PRIVILEGE DESIGNATION: This memorandum is a privileged and confidential attorney work-product communication prepared in connection with Calderwood & Harkness LLP's representation of Cascade Retail Holdings Inc. It is not intended for disclosure to third parties and should not be shared outside of the attorney-client relationship without prior approval. This memorandum reflects the mental impressions, conclusions, opinions, and legal theories of the attorneys involved and is protected under Federal Rule of Civil Procedure 26(b)(3) and applicable state work-product doctrines. Distribution of this memorandum outside of the Calderwood & Harkness engagement team and authorized Cascade personnel may constitute a waiver of privilege.
I. Executive Summary
This memorandum sets forth the results of our review of the data-handling, confidentiality, and data-protection provisions contained in the existing Statement of Work ("SOW") between Cascade Retail Holdings Inc. ("Cascade" or "CRH") and Fieldhaven Consulting Group LLC ("Fieldhaven") for the privacy-program technical implementation engagement. The purpose of this review is to identify gaps in the current contractual framework that may expose Cascade to regulatory, operational, and litigation risk under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA"), and the analogous privacy statutes of the 18 other states in which Cascade has compliance obligations.
Fieldhaven is a Delaware limited liability company headquartered at 350 Sansome Street, Suite 400, San Francisco, California 94104. Marcus Ellerby serves as the engagement lead for the Fieldhaven team. Fieldhaven was retained by Cascade to serve as the primary technical implementer for three critical workstreams within Cascade's US state-privacy compliance program:
1. Enterprise data mapping and inventory — a comprehensive identification and cataloging of all personal information collected, processed, stored, and shared by Cascade across its retail, e-commerce, mobile, loyalty-program, marketplace, and advertising operations;
2. Deployment of the OnPoint Data Solutions Inc. consent-management platform ("CMP") — implementation and configuration of a centralized platform for obtaining, managing, and documenting consumer consent and opt-out preferences across Cascade's digital properties; and
3. Data-subject-request ("DSR") workflow automation — design, build, and deployment of automated workflows to receive, route, verify, fulfill, and document consumer privacy-rights requests across all applicable jurisdictions.
The total fixed-fee value of the Fieldhaven SOW is $3,150,000, payable in three milestone-based installments:
Summary Conclusion. The current Fieldhaven SOW contains general confidentiality language but lacks the specific data-protection provisions necessary to satisfy CCPA/CPRA service-provider requirements and analogous processor obligations under the 19 applicable state privacy statutes. In its present form, the SOW does not establish Fieldhaven as a "service provider" within the meaning of California Civil Code Section 1798.140(ag), does not impose adequate restrictions on Fieldhaven's use, retention, or disclosure of Cascade personal information, and does not contain sub-processor flow-down requirements, data-destruction obligations, breach-notification terms, compliance-assistance commitments, or audit rights. This memorandum identifies seven areas requiring amendment and provides specific recommendations for each.
This review is being coordinated with Calderwood & Harkness's broader vendor Data Processing Agreement ("DPA") rollout plan and the gap-analysis work currently underway for Cascade's US state-privacy compliance program, an engagement that was opened on June 2, 2025. The recommendations set forth herein are intended to be implemented on an expedited basis to address an identified gap, with a target execution date for an interim data-protection amendment of August 8, 2025, and a comprehensive DPA rider to follow upon finalization of the firm's Master DPA Template for service providers, which is targeted for September 30, 2025.
II. Background and Context
A. The Fieldhaven Engagement
Cascade retained Fieldhaven to serve as the primary technical implementer for its comprehensive US state-privacy compliance program. Fieldhaven's scope of work encompasses the three workstreams described above — enterprise data mapping and inventory, CMP deployment, and DSR workflow automation — each of which requires Fieldhaven personnel to access, process, analyze, and in certain cases temporarily store significant volumes of Cascade personal information.
The Fieldhaven SOW was executed prior to Calderwood & Harkness's engagement on this matter. Specifically, the SOW predates June 2, 2025, the date on which Cascade formally retained this firm to conduct the US state-privacy compliance program. The SOW was negotiated and executed by Cascade's in-house legal and information-security teams, primarily Diana Polk, Associate General Counsel and Interim Chief Privacy Officer, and Gregory Farris, Chief Information Security Officer. Outside privacy counsel was not consulted during the negotiation or drafting of the SOW's data-protection terms — an omission that Ms. Polk has acknowledged and that prompted the inclusion of the Fieldhaven SOW in the scope of our current engagement.
Marcus Ellerby, a principal at Fieldhaven and the designated engagement lead, has managed the Fieldhaven team's work to date, including the delivery of the enterprise data-mapping report on May 19, 2025. As of the date of this memorandum, Milestone 1 (enterprise data mapping and inventory) is substantially complete, and Fieldhaven has begun preliminary work on Milestone 2 (CMP deployment). Accordingly, Fieldhaven has already accessed — and continues to access — extensive categories and volumes of Cascade personal information.
The categories and sources of personal information to which Fieldhaven has access in the course of performing the SOW include, but are not limited to, the following:
• Consumer data from Cascade's e-commerce platform (cascade.com), mobile application, and 186 retail locations across 31 states. This includes consumer names, email addresses, mailing addresses, phone numbers, purchase histories, payment card information (in tokenized form), browsing behavior, device identifiers, geolocation data, and demographic data collected at the point of sale and through digital interactions.
• Loyalty-program data from Cascade Rewards Corp. Cascade Rewards Corp., a wholly owned subsidiary of Cascade, operates the Cascade Rewards loyalty program, which has approximately 41.2 million registered members as of Q1 FY2025. Loyalty-program data includes member names, contact information, transaction histories, reward-point balances, redemption records, and behavioral preference data derived from purchase patterns.
• Third-party marketplace seller data from Cascade Digital Marketplace LLC. Cascade Digital Marketplace LLC, another wholly owned subsidiary, operates an online marketplace through which approximately 3,800 third-party sellers offer products on cascade.com. Seller data includes business names, contact information, bank account and routing numbers (for payment settlement), tax identification numbers, and sales data.
• Advertising and analytics data processed by Peakview Analytics Inc. Peakview Analytics Inc. serves as Cascade's primary advertising-analytics partner and processes approximately 2.1 billion consumer-event data records per month across Cascade's digital properties. Fieldhaven's data-mapping work required access to the Peakview data feeds and associated consumer identifiers.
• Data from 47 third-party advertising and analytics partners identified in the Fieldhaven data-mapping report dated May 19, 2025. These partners include demand-side platforms, data management platforms, social media advertising platforms, and measurement and attribution providers, each of which receives or processes Cascade consumer data in various capacities.
• Cookie and tracking-technology data. Fieldhaven's CMP deployment workstream requires access to and analysis of 12 categories of cookies and tracking technologies deployed on cascade.com, including first-party analytics cookies, third-party advertising cookies, session-management cookies, and pixel tags.
The breadth and sensitivity of the personal information to which Fieldhaven has access makes the absence of adequate data-protection terms in the SOW a matter of significant concern. As discussed in Section VII below, the current contractual framework exposes Cascade to regulatory enforcement risk, operational risk, insurance risk, and potential civil liability.
B. Regulatory Framework Driving This Review
Cascade's retail, e-commerce, marketplace, and loyalty-program operations are subject to the privacy and data-protection requirements of 19 state privacy statutes that are either currently effective or will become effective during the term of the Fieldhaven engagement. These statutes are as follows:
1. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA) — Cal. Civ. Code §§ 1798.100–1798.199.100
2. Virginia Consumer Data Protection Act (VCDPA) — Va. Code §§ 59.1-575–59.1-585
3. Colorado Privacy Act (CPA) — Colo. Rev. Stat. §§ 6-1-1301–6-1-1313
4. Connecticut Data Privacy Act (CTDPA) — Conn. Gen. Stat. §§ 42-515–42-525
5. Utah Consumer Privacy Act (UCPA) — Utah Code §§ 13-61-101–13-61-404
6. Iowa Consumer Data Protection Act (ICDPA) — Iowa Code §§ 715D.1–715D.8
7. Indiana Consumer Data Protection Act (INCDPA) — Ind. Code §§ 24-15-1-1–24-15-9-2
8. Tennessee Information Protection Act (TIPA) — Tenn. Code §§ 47-18-3201–47-18-3213
9. Montana Consumer Data Privacy Act (MCDPA) — Mont. Code §§ 30-14-2801–30-14-2817
10. Texas Data Privacy and Security Act (TDPSA) — Tex. Bus. & Com. Code §§ 541.001–541.205
11. Oregon Consumer Privacy Act (OCPA) — Or. Rev. Stat. §§ 646A.570–646A.590
12. Delaware Personal Data Privacy Act (DPDPA) — Del. Code tit. 6, §§ 12D-101–12D-115
13. New Jersey Data Privacy Act (NJDPA) — N.J. Stat. §§ 56:8-166–56:8-187
14. New Hampshire Data Privacy Act (NHDPA) — N.H. Rev. Stat. §§ 507-H:1–507-H:18
15. Nebraska Data Privacy Act (NDPA) — Neb. Rev. Stat. §§ 87-1101–87-1116
16. Minnesota Consumer Data Privacy Act (MN MCDPA) — Minn. Stat. §§ 325O.01–325O.22
17. Maryland Online Data Privacy Act (MODPA) — Md. Code Com. Law §§ 14-4601–14-4618
18. Kentucky Consumer Data Protection Act (KYDPA) — Ky. Rev. Stat. §§ 367.400–367.460
19. Additional statutes becoming effective through 2025–2026 as identified in the Calderwood & Harkness Multi-State Privacy Law Applicability Matrix
Each of these statutes imposes contractual requirements on entities that process personal information on behalf of a business or controller. While the specific requirements vary from state to state, they generally require that businesses enter into written agreements with their processors or service providers that include provisions: (a) specifying the purposes for which personal information is processed; (b) restricting the processor's use of personal information to the purposes set forth in the agreement; (c) requiring deletion or return of personal information upon completion of services; (d) requiring the processor to cooperate with compliance audits or assessments; and (e) requiring flow-down of equivalent obligations to any sub-processors.
The CCPA/CPRA imposes particularly stringent requirements on service-provider relationships. Under California Civil Code Section 1798.140(ag), a "service provider" must be a person or entity that processes personal information on behalf of a business pursuant to a written contract that, among other things:
(i) prohibits the service provider from selling or sharing the personal information;
(ii) prohibits the service provider from retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract;
(iii) prohibits the service provider from retaining, using, or disclosing the information outside of the direct business relationship between the service provider and the business; and
(iv) includes a certification made by the service provider that it understands the restrictions in the contract and will comply with them.
Critically, failure to execute a CCPA-compliant written agreement with a service provider may cause the service provider's receipt and processing of personal information to be classified as a "sale" or "sharing" of personal information under the CCPA, triggering consumer opt-out rights, notice obligations, and potential enforcement exposure. This classification risk is of particular concern for Cascade given the volume of personal information that Fieldhaven accesses and the categories of data involved.
Additionally, the gap-analysis workstream currently underway (target delivery date of August 15, 2025) has already identified that 23 of 47 advertising and analytics partners lack executed DPAs. Fieldhaven's SOW falls into the same contractual gap — it lacks adequate data-protection terms that would establish Fieldhaven's status as a compliant service provider or processor under the applicable statutes.
C. Cascade's Regulatory History — Relevance
This review is informed by Cascade's recent regulatory history with the California Attorney General. On February 6, 2024, the California Attorney General's office issued an informal inquiry letter to Cascade that specifically highlighted deficiencies in Cascade's service-provider agreements as an area of concern. While the inquiry did not result in formal enforcement action and Cascade provided a responsive submission, the inquiry placed Cascade on notice that the California AG views the adequacy of service-provider contracts as a priority compliance area.
Ensuring that the Fieldhaven SOW meets CCPA/CPRA service-provider standards is directly responsive to this regulatory concern. If the California AG were to revisit Cascade's service-provider agreements — whether as a follow-up to the February 2024 inquiry or in connection with a new investigation — the absence of CCPA-compliant terms in the Fieldhaven SOW would be a conspicuous deficiency, particularly given that Fieldhaven is serving as the technical implementer for Cascade's own privacy compliance program. The optics of retaining a privacy-program implementer under a contract that itself fails to comply with privacy law would be difficult to defend.
III. Scope of Review
This memorandum is based on our review of the following documents and materials:
1. Fieldhaven Consulting Group LLC Statement of Work — the undated, pre-engagement version provided to Calderwood & Harkness by Diana Polk via email on June 5, 2025. The SOW is the operative agreement between Cascade and Fieldhaven governing the privacy-program technical implementation engagement and is the primary subject of this review.
2. Fieldhaven Standard Terms and Conditions — a set of general terms and conditions incorporated by reference in the SOW (referenced at Section 1.2 of the SOW as "Fieldhaven's Standard Terms and Conditions, Version 4.3, available at https://www.fieldhaven.com/legal/terms"). These terms contain additional provisions relating to limitation of liability, indemnification, intellectual-property ownership, and general contracting matters, but do not contain data-protection-specific provisions beyond those in the SOW itself.
3. Fieldhaven Data-Mapping Report dated May 19, 2025 — the enterprise data-mapping report delivered by Fieldhaven as the primary deliverable under Milestone 1. This report was reviewed not for the purpose of assessing its substantive adequacy, but rather to understand the scope and categories of personal information to which Fieldhaven has had access in performing the SOW. The report confirms that Fieldhaven accessed all of the data categories described in Section II.A above.
4. Calderwood & Harkness Multi-State Privacy Law Applicability Matrix (working draft, last updated June 30, 2025) — a matrix identifying the applicability of each of the 19 state privacy statutes to Cascade's operations and summarizing the contractual requirements imposed by each statute on service-provider and processor relationships. This matrix was used as the reference framework for evaluating the SOW's compliance with multi-state requirements.
5. Calderwood & Harkness Draft Master DPA Template — Service Providers (in progress, target finalization September 30, 2025) — the firm's draft form of Data Processing Agreement for service providers, which is being developed as part of the broader Cascade privacy-compliance engagement. The DPA template reflects best-practices provisions drawn from all 19 applicable state statutes and will serve as the baseline for the recommended Fieldhaven SOW amendments.
The focus of this review encompassed seven principal areas:
(1) Classification of Fieldhaven under applicable state privacy statutes (i.e., as a "service provider" under CCPA/CPRA and as a "processor" under analogous state laws);
(2) Adequacy of restrictions on Fieldhaven's use, retention, and disclosure of Cascade personal information;
(3) Sub-contractor and sub-processor provisions, including flow-down requirements;
(4) Data destruction and return obligations upon SOW completion or termination;
(5) Incident-response and breach-notification provisions;
(6) Compliance-assistance obligations, including DSR-fulfillment and regulatory-inquiry cooperation; and
(7) Audit and monitoring rights for Cascade with respect to Fieldhaven's data-handling practices and security controls.
Each of these areas is addressed in the analysis and recommendations that follow.
IV. Analysis of Current SOW Data-Protection Provisions
A. Existing Confidentiality Clause (Section 8 of SOW)
The SOW contains a general mutual confidentiality provision at Section 8, titled "Confidentiality." This provision defines "Confidential Information" broadly to include "all non-public information disclosed by either party to the other party in connection with this Statement of Work, whether disclosed orally, in writing, electronically, or by any other means, and whether or not marked as confidential." The clause imposes standard non-disclosure obligations on both parties, prohibiting disclosure of Confidential Information to third parties except to employees, agents, and advisors with a need to know, and requiring that such recipients be bound by confidentiality obligations no less restrictive than those in the SOW. The clause includes standard carve-outs for information that is or becomes publicly available, was previously known to the receiving party, is independently developed, or is disclosed pursuant to legal process.
The confidentiality clause uses a generic three-year survival period, providing that the confidentiality obligations survive expiration or termination of the SOW for a period of three years. While this survival period may be adequate for general business-confidentiality purposes, it is not tailored to the indefinite obligations that privacy statutes impose on the use and protection of personal information.
Deficiency. The confidentiality clause does not distinguish between general confidential business information and "personal information" as defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(o)) or equivalent terms under other state privacy statutes. There is no specific reference to personal data, consumer data, or any privacy-law construct within the clause. As a result, the clause does not:
• Impose purpose limitations on the use of personal information, as required by CCPA § 1798.100(d);
• Restrict Fieldhaven from combining Cascade personal information with personal information received from other sources or collected from Fieldhaven's own interactions with consumers, as required by CCPA § 1798.140(ag)(1)(A)(v);
• Contain any of the mandatory contractual elements required by CCPA § 1798.100(d) or § 1798.140(ag), including the prohibition on selling or sharing personal information, the restriction on use outside the direct business relationship, or the certification that the service provider understands and will comply with applicable restrictions;
• Address the distinct treatment of personal information that is required across the 19 applicable state privacy statutes, each of which imposes obligations on data processing that go beyond general confidentiality.
In short, while Section 8 provides a baseline level of protection for Cascade's proprietary business information, it is wholly inadequate to address the regulatory requirements applicable to the personal information that Fieldhaven processes on Cascade's behalf.
B. Existing Data-Handling Provision (Section 9 of SOW)
Section 9 of the SOW, titled "Data Handling," contains a brief paragraph — approximately four sentences in length — requiring Fieldhaven to "use commercially reasonable security measures to protect Client data in its possession or control" and to "handle Client data in accordance with applicable laws." The provision further states that Fieldhaven "will not use Client data for any purpose other than performing the services described in this Statement of Work" and that Fieldhaven will "promptly notify Client in the event of any unauthorized access to Client data." The provision does not define "Client data," does not reference any specific privacy statutes, and does not elaborate on the meaning of "commercially reasonable security measures" or "applicable laws."
Deficiency. While Section 9 contains the seed of a data-handling provision, it is insufficiently specific to satisfy the requirements of any of the 19 applicable state privacy statutes. The principal deficiencies are as follows:
• No reference to specific statutes or definitions. The phrase "applicable laws" is generic and does not create the affirmative certifications required by the CCPA. Under Section 1798.140(ag), a service-provider agreement must include a certification that the service provider "understands" the restrictions imposed by the CCPA and "will comply with them." A general reference to "applicable laws" does not constitute such a certification.
• No enumeration of permitted purposes. While Section 9 restricts Fieldhaven's use of "Client data" to "performing the services described in this Statement of Work," it does not enumerate the specific business purposes for which processing is permitted, as is required by CCPA § 1798.100(d)(1). The absence of an enumerated list of permitted purposes makes it difficult to determine whether a particular use by Fieldhaven is within or outside the scope of the agreement.
• No restrictions on retention beyond the engagement period. Section 9 contains no provision addressing the retention of Cascade data after the completion of the SOW, termination, or expiration. Absent such a provision, Fieldhaven could retain Cascade personal information indefinitely.
• No destruction or return obligations. Section 9 does not require Fieldhaven to delete or return Cascade data upon completion of services or upon Cascade's request. This omission is inconsistent with the data-destruction or return requirements found in the CCPA, VCDPA, Colorado CPA, CTDPA, and virtually all other applicable state statutes.
• Vague security standard. The "commercially reasonable security measures" standard is vague and potentially unenforceable. It does not reference any specific security framework, standard, or certification, and it provides no objective benchmark against which Fieldhaven's security practices can be measured or audited.
C. Absence of Key Provisions
Beyond the deficiencies in the existing Sections 8 and 9, the SOW is notable for the complete absence of several provisions that are either expressly required by applicable privacy statutes or represent industry best practices for service-provider and processor relationships. The following provisions are entirely missing from the SOW:
• CCPA service-provider certification (§ 1798.140(ag)) — The SOW does not contain the certification required by the CCPA that the service provider understands and will comply with the restrictions applicable to its processing of personal information.
• Sub-contractor/sub-processor restrictions or flow-down requirements — The SOW does not restrict Fieldhaven's use of sub-contractors, does not require prior notice to or consent from Cascade before sub-contractors are engaged, and does not require flow-down of data-protection obligations to sub-contractors.
• Data return or destruction obligations upon SOW completion or termination — As noted above, the SOW is silent on the disposition of Cascade personal information upon completion of services.
• Breach/incident notification clause with specified timelines — While Section 9 contains a general reference to "promptly notify" in the event of unauthorized access, it does not specify a timeline for notification, does not define "unauthorized access" or "security incident," and does not address Fieldhaven's obligations to cooperate with investigation and remediation.
• Audit or inspection rights — Cascade has no contractual right to audit or inspect Fieldhaven's data-handling practices, security controls, or compliance with the SOW.
• Compliance-assistance obligations — The SOW does not obligate Fieldhaven to assist Cascade in responding to consumer rights requests (DSRs), regulatory inquiries, or privacy impact assessments.
• Data-localization or transfer restrictions — The SOW does not address where Cascade personal information may be stored or processed, or whether Fieldhaven may transfer such information outside the United States.
• Restriction on combining Cascade PI with data from other sources — The SOW does not prohibit Fieldhaven from combining Cascade personal information with personal information obtained from other clients or sources.
• Defined list of permitted processing purposes — The SOW does not enumerate the specific purposes for which Fieldhaven is authorized to process Cascade personal information.
The cumulative effect of these omissions is that the SOW, in its current form, does not establish Fieldhaven as a "service provider" under the CCPA/CPRA or as a compliant "processor" under any of the other 18 applicable state privacy statutes. Remediation requires the execution of a comprehensive data-protection amendment or addendum addressing each of the deficiencies and omissions identified above.
V. Recommended Amendments
Based on the analysis set forth in Section IV, we recommend the following seven categories of amendments to the Fieldhaven SOW. These recommendations are designed to bring the SOW into compliance with the CCPA/CPRA and the other 18 applicable state privacy statutes, to align with industry best practices for service-provider and processor agreements, and to be consistent with the Calderwood & Harkness draft Master DPA Template for service providers currently under development.
A. CCPA Service-Provider Classification and Certification
Fieldhaven should be expressly classified as a "service provider" under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ag)) and as a "processor" under the VCDPA, Colorado CPA, CTDPA, and analogous state privacy statutes. The SOW amendment should include clear definitional language establishing this classification and incorporating the applicable statutory definitions by reference.
In connection with this classification, the SOW must include an express certification by Fieldhaven that it:
(a) Understands and will comply with the restrictions imposed by the CCPA/CPRA and other applicable state privacy laws on the processing of personal information on behalf of Cascade;
(b) Will not sell or share (as those terms are defined under the CCPA, Cal. Civ. Code §§ 1798.140(ad) and 1798.140(ah)) personal information received from or on behalf of Cascade;
(c) Will not retain, use, or disclose personal information received from or on behalf of Cascade for any purpose other than the specific business purposes set forth in the SOW, and will not retain, use, or disclose such personal information for any commercial purpose other than providing the services specified in the SOW;
(d) Will not retain, use, or disclose personal information received from or on behalf of Cascade outside of the direct business relationship between Fieldhaven and Cascade;
(e) Will not combine personal information received from or on behalf of Cascade with personal information received from, or on behalf of, another person or persons, or personal information collected from Fieldhaven's own interaction with consumers, except as expressly permitted by the CCPA (Cal. Civ. Code § 1798.140(ag)(1)(A)(v)); and
(f) Grants Cascade the right, upon notice, to take reasonable and appropriate steps to ensure that Fieldhaven uses personal information consistent with Cascade's obligations under the CCPA and other applicable statutes.
Implementation Recommendation. These certifications should be incorporated as a new Section 9A of the SOW or, alternatively, as a standalone addendum or rider to the SOW. The substance of these provisions should conform in all material respects to the corresponding provisions of the Calderwood & Harkness draft Master DPA Template — Service Providers, which is currently being developed and is targeted for finalization by September 30, 2025. However, given the urgency of the issue and the fact that Fieldhaven is already actively processing Cascade personal information, we recommend that an interim amendment incorporating these certifications be executed promptly — with a target date of August 8, 2025 — rather than waiting for the Master DPA Template to be finalized. The interim amendment can be structured to provide that it will be superseded by, or incorporated into, the comprehensive DPA rider upon finalization of the template.
B. Sub-Contractor / Sub-Processor Flow-Down Requirements
The current SOW permits Fieldhaven to engage sub-contractors in the performance of the SOW without providing prior notice to or obtaining prior consent from Cascade. Section 4.3 of the SOW states only that Fieldhaven "may engage qualified sub-contractors to assist in the delivery of services" and that "Fieldhaven remains responsible for the quality and timeliness of all deliverables." This provision is inadequate from a data-protection perspective.
Risk. If Fieldhaven engages sub-contractors who access, process, or store Cascade personal information without entering into CCPA-compliant sub-processing agreements, Cascade may lose the service-provider defense under the CCPA. Under Section 1798.140(ag)(1)(B), a service provider must enter into a written contract with any sub-contractor that receives personal information from the service provider, and that contract must prohibit the sub-contractor from retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the contract. If Fieldhaven fails to do so, Cascade could be deemed to have permitted the "sale" or "sharing" of personal information to the sub-contractor, with all of the regulatory consequences that follow.
Recommended Amendment. The SOW should be amended to include the following sub-contractor/sub-processor provisions:
(a) Prior Approval. Fieldhaven must provide Cascade with prior written notice of, and obtain Cascade's prior written approval before engaging, any sub-contractor that will access, process, or store Cascade personal information in connection with the performance of the SOW. Such notice must identify the proposed sub-contractor, describe the processing activities to be performed, and specify the categories of Cascade personal information to which the sub-contractor will have access.
(b) Flow-Down of Obligations. Fieldhaven must enter into a written agreement with each approved sub-contractor that imposes data-protection obligations on the sub-contractor that are no less protective of Cascade personal information than the obligations imposed on Fieldhaven under the amended SOW. Such agreements must include, at a minimum, the same restrictions on use, retention, and disclosure of personal information, the same data-destruction or return obligations, the same security requirements, and the same breach-notification obligations.
(c) Liability for Sub-Contractors. Fieldhaven remains fully responsible and liable for the acts and omissions of its sub-contractors with respect to Cascade personal information, to the same extent as if Fieldhaven had performed the acts or omissions itself. Fieldhaven's engagement of a sub-contractor does not relieve Fieldhaven of any obligation under the SOW.
(d) Sub-Contractor Registry. Fieldhaven must maintain and, upon Cascade's request, provide a current and complete list of all sub-contractors with access to Cascade personal information, including a description of the processing activities performed by each sub-contractor, the categories of personal information accessed, and the geographic locations where processing occurs.
C. Data Destruction and Return Upon Completion
The SOW does not address the disposition of Cascade personal information in Fieldhaven's possession, custody, or control upon completion of the SOW, termination, or expiration. This is a significant gap.
Risk. Indefinite retention of Cascade personal information by Fieldhaven after the conclusion of the engagement increases regulatory risk (by creating an ongoing processing relationship without a defined purpose), breach risk (by expanding the attack surface for Cascade personal information), and litigation risk (by potentially supporting a claim that Fieldhaven's continued possession of the data constitutes a "sale" or unauthorized use). The gap-analysis workstream has separately identified the absence of any documented data-retention schedule at Cascade itself as a compliance gap. The vendor relationship should not replicate this deficiency — indeed, the vendor context arguably presents a heightened risk, as Cascade has less direct control over the security and retention practices of an external party.
Recommended Amendment. The SOW should be amended to include the following data destruction and return provisions:
(a) Election to Return or Destroy. Upon completion of each milestone deliverable and upon final SOW completion, termination (for any reason), or expiration, Fieldhaven must, at Cascade's election, either (i) return to Cascade all Cascade personal information (and all copies, extracts, summaries, analyses, and derivatives thereof) in Fieldhaven's possession, custody, or control, or (ii) securely destroy all such information. Cascade's election must be communicated in writing within 15 days of the applicable trigger event; in the absence of such election, the default will be secure destruction.
(b) Certification of Destruction. Within 30 calendar days of the applicable trigger event, Fieldhaven must provide Cascade with a written certification, signed by an authorized officer of Fieldhaven, confirming that all Cascade personal information has been returned or destroyed in accordance with Cascade's election and that no copies, extracts, or derivatives remain in Fieldhaven's possession, custody, or control.
(c) Legal Hold Exception. A narrow exception to the destruction/return obligation may apply where Fieldhaven is required to retain specific categories of Cascade personal information pursuant to an applicable law, regulation, or legal-hold obligation. In such cases, Fieldhaven must (i) promptly notify Cascade in writing of the specific legal requirement compelling retention, identifying the categories and volume of data affected, (ii) continue to protect the retained data in accordance with all data-protection terms of the amended SOW, (iii) limit access to the retained data to those Fieldhaven personnel who require access to comply with the applicable legal requirement, and (iv) securely destroy the retained data promptly upon the expiration of the legal-retention requirement.
(d) Destruction Standards. All destruction of Cascade personal information must employ methods meeting NIST Special Publication 800-88, Revision 1 ("Guidelines for Media Sanitization") or equivalent industry standards. For electronic media, this includes, at a minimum, cryptographic erasure or overwriting techniques that render the data permanently unrecoverable. For physical media (if applicable), this includes cross-cut shredding or incineration. Fieldhaven's destruction certification must identify the methods used.
D. Incident-Response and Breach-Notification Obligations
The SOW's reference to "promptly notify" in the event of "unauthorized access" is wholly inadequate as a breach-notification provision. It does not define "unauthorized access," does not specify a notification timeline, does not identify notification recipients or channels, does not address Fieldhaven's obligations to cooperate with investigation and remediation, and does not allocate breach-related costs.
Risk. Fieldhaven has access to categories of personal information that, if compromised, could trigger notification obligations under multiple legal frameworks, including:
• The CCPA's requirement that businesses notify the California Attorney General of data breaches affecting 500 or more California residents (Cal. Civ. Code § 1798.82(f));
• State data-breach-notification statutes across all 50 states (and the District of Columbia), many of which impose notification timelines as short as 30 days from discovery;
• Potential federal notification obligations under FTC enforcement authority and, depending on the categories of data involved, sector-specific federal requirements; and
• Contractual notification obligations under Cascade's agreements with its payment-card processors and acquiring banks (PCI DSS-related requirements).
Additionally, Cascade maintains a cyber/privacy-liability insurance policy through Northcastle Indemnity Company with the following terms:
Timely notification of security incidents to the insurer is a condition precedent to coverage under the Northcastle policy. If a breach involving Cascade personal information occurs at Fieldhaven and Fieldhaven delays notification to Cascade, the resulting delay in Cascade's notification to Northcastle could jeopardize coverage for what could be a multi-million-dollar loss event.
Recommended Amendment. The SOW should be amended to include the following incident-response and breach-notification provisions:
(a) Notification Timeline. Fieldhaven must notify Cascade of any confirmed or reasonably suspected security incident involving Cascade personal information within 24 hours of discovery. For these purposes, "Discovery" means the point at which Fieldhaven has credible information indicating that a security incident has occurred or may have occurred, regardless of whether the full scope or nature of the incident has been determined.
(b) Notification Recipients and Channels. Notification must be directed to both Gregory Farris (CISO) and Diana Polk (Interim CPO) via (i) email to designated secure email addresses to be specified in the amendment and (ii) telephone to designated emergency contact numbers. Fieldhaven must also provide concurrent notice to Calderwood & Harkness LLP at a designated contact email address.
(c) Content of Notification. The initial notification must include, to the extent known at the time, the nature and scope of the incident, the categories and approximate volume of personal information affected, the date and time of discovery, the known or suspected cause, and the remediation steps taken or planned. Fieldhaven must provide supplemental information as it becomes available and must provide regular updates until the incident is resolved.
(d) Cooperation and Remediation. Fieldhaven must cooperate fully with Cascade's investigation of any security incident, including providing access to Fieldhaven systems, personnel, and records relevant to the investigation. Fieldhaven must preserve all evidence related to the incident, engage qualified forensic investigators (either its own or as designated by Cascade), and implement remediation measures as directed by Cascade or mutually agreed upon.
(e) Incident-Response Plan. Fieldhaven must maintain a written incident-response plan that addresses the identification, containment, investigation, remediation, and notification of security incidents. Fieldhaven must provide a copy of its incident-response plan to Cascade upon request and must promptly notify Cascade of any material changes to the plan.
(f) Allocation of Costs. Fieldhaven is responsible for all costs arising from a security incident to the extent the incident results from Fieldhaven's breach of its security obligations under the amended SOW, including but not limited to the costs of forensic investigation, legal fees, consumer notification, credit monitoring, regulatory fines or penalties, and claims by affected individuals. This cost-allocation provision is without prejudice to any indemnification obligations under the SOW or Fieldhaven's Standard Terms and Conditions.
E. Compliance-Assistance Obligations
The SOW does not address Fieldhaven's obligation to assist Cascade in fulfilling consumer privacy-rights requests (DSRs) or responding to regulatory inquiries. This omission is significant given both the volume of DSRs that Cascade receives and the regulatory attention that Cascade's service-provider practices have received.
Context. In fiscal year 2024, Cascade received approximately 38,400 data-subject requests across its operations, broken down as follows:
Cascade's average response time for DSRs in FY2024 was 27 calendar days, against an internal target of 15 business days or less. Improving DSR response times is one of the primary objectives of Fieldhaven's Milestone 3 workstream (DSR workflow automation, valued at $1,102,500). However, during the implementation period — which may extend several months — Fieldhaven itself will hold Cascade personal information and may need to search its own systems, return data to Cascade, or delete data in response to consumer requests directed to Cascade. Without a contractual obligation to provide this assistance, Fieldhaven could delay or refuse such requests, potentially causing Cascade to miss statutory response deadlines (typically 45 days under CCPA, with a 45-day extension available in certain circumstances; shorter deadlines apply under some other state statutes).
Recommended Amendment. The SOW should be amended to include the following compliance-assistance provisions:
(a) DSR Assistance. Fieldhaven must, upon Cascade's request and within timeframes specified by Cascade (which will be aligned with applicable statutory deadlines), assist Cascade in responding to consumer data-subject requests, including requests for access to personal information, deletion of personal information, correction of inaccurate personal information, and opt-out of the sale or sharing of personal information. Such assistance includes searching Fieldhaven's systems for Cascade personal information responsive to a DSR, providing copies of such information to Cascade (for access requests), deleting such information from Fieldhaven's systems (for deletion requests), and confirming completion of the requested action.
(b) Regulatory-Inquiry Assistance. Fieldhaven must assist Cascade in responding to inquiries, investigations, or enforcement actions by the Federal Trade Commission, the California Attorney General, the California Privacy Protection Agency, or any other state regulatory authority with jurisdiction over Cascade's data-processing practices. Such assistance includes providing information, documents, and access to Fieldhaven personnel as reasonably requested by Cascade, subject to appropriate confidentiality protections.
(c) Privacy Impact Assessments and Audits. Fieldhaven must provide reasonable cooperation with privacy impact assessments, data-protection impact assessments, and other assessments or audits that Cascade is required or elects to conduct in connection with its compliance obligations under applicable state privacy statutes.
F. Audit and Monitoring Rights
The SOW does not provide Cascade with any right to audit or inspect Fieldhaven's data-handling practices, security controls, or compliance with the SOW's data-protection terms (such as they are). This omission is inconsistent with industry best practices and with the expectations of multiple state privacy statutes.
Risk. The CCPA/CPRA and several other state privacy statutes contemplate that businesses will exercise oversight over their service providers' and processors' compliance with applicable data-protection requirements. Without audit rights, Cascade cannot demonstrate to regulators that it has taken reasonable steps to monitor and verify Fieldhaven's compliance. This could undermine Cascade's ability to rely on the service-provider defense under the CCPA or to demonstrate the "reasonable security" practices that are a prerequisite to avoiding private-right-of-action liability under California Civil Code Section 1798.150.
Recommended Amendment. The SOW should be amended to include the following audit and monitoring provisions:
(a) Right to Audit. Cascade, or its authorized designee (including Calderwood & Harkness LLP and any third-party auditor engaged by Cascade), has the right to audit Fieldhaven's data-handling practices, security controls, policies, procedures, and compliance with the data-protection terms of the amended SOW. Audits may be conducted upon reasonable prior written notice (not less than 15 business days except in the event of a suspected or confirmed security incident, in which case audit rights are immediate). Routine audits may be conducted no more than once per 12-month period; however, additional audits may be conducted in the event of a security incident, a material change in Fieldhaven's processing activities, or a regulatory inquiry directed at Cascade.
(b) Record-Keeping Obligations. Fieldhaven must maintain records sufficient to demonstrate its compliance with the data-protection terms of the amended SOW and with applicable privacy statutes. Such records must be maintained for the duration of the SOW and for a period of three years following SOW completion, termination, or expiration. Fieldhaven must make such records available to Cascade or its designee upon request in connection with any audit.
(c) Remediation of Deficiencies. If an audit identifies deficiencies in Fieldhaven's data-handling practices, security controls, or compliance with the SOW data-protection terms, Fieldhaven must promptly remediate such deficiencies at its own cost and must provide Cascade with a written remediation plan and timeline within 15 business days of receiving written notice of the deficiencies. Cascade retains the right to verify the adequacy of remediation through a follow-up audit.
(d) Third-Party Audit Reports. In lieu of, or in addition to, on-site audits, Cascade may elect to accept a current industry-standard audit report covering the relevant controls, such as a SOC 2 Type II report issued by an independent auditor in accordance with AICPA standards. To the extent that Fieldhaven obtains a SOC 2 Type II report, Fieldhaven must provide a copy to Cascade upon request. We note that coordination with Lakemont Audit Partners LLP, Cascade's independent auditor (engagement partner Sheila Brogan), will be advisable to ensure that the scope of any SOC 2 or privacy-controls audit of Fieldhaven is aligned with the controls being evaluated in Lakemont's broader audit of Cascade's privacy-compliance program.
G. Security Standards and Data Minimization
As noted in Section IV.B above, the SOW's "commercially reasonable security measures" standard is vague, provides no objective benchmark, and is potentially unenforceable in the event of a dispute. This standard should be replaced with specific, measurable security requirements.
Recommended Amendment. The SOW should be amended to include the following security and data-minimization provisions:
(a) Security Framework. Fieldhaven must implement and maintain an information-security program that is designed to protect the confidentiality, integrity, and availability of Cascade personal information and that is aligned with the NIST Cybersecurity Framework (CSF) 2.0 or an equivalent industry-recognized standard (e.g., ISO/IEC 27001:2022). Fieldhaven's security program must include, at a minimum, administrative, technical, and physical safeguards appropriate to the nature, scope, and sensitivity of the Cascade personal information processed.
(b) Encryption. All Cascade personal information must be encrypted both at rest and in transit using industry-standard encryption algorithms and key lengths (e.g., AES-256 for data at rest; TLS 1.2 or higher for data in transit). Encryption keys must be managed in accordance with industry best practices and must not be stored alongside the encrypted data.
(c) Access Controls. Fieldhaven must implement role-based access controls that limit access to Cascade personal information to those Fieldhaven personnel who have a demonstrated need-to-know for the purpose of performing the services specified in the SOW. Fieldhaven must enforce multi-factor authentication for all personnel accessing Cascade personal information or Cascade systems. Fieldhaven must promptly revoke access for any personnel whose role no longer requires access to Cascade personal information.
(d) Access Logging. Fieldhaven must maintain comprehensive access logs recording all access to Cascade personal information, including the identity of the accessing personnel, the date and time of access, and the nature of the access (e.g., read, write, delete, export). Access logs must be retained for a minimum of 12 months and must be made available to Cascade upon request.
(e) Data Minimization. Fieldhaven may access and process only the minimum categories and volume of Cascade personal information necessary for the performance of each milestone deliverable. Fieldhaven must not access, collect, or process Cascade personal information in excess of what is required for the specific tasks being performed at any given time. Upon completion of each milestone, Fieldhaven must review and, to the extent no longer needed, delete or return any Cascade personal information that was accessed or processed solely for the completed milestone.
VI. Interaction with Other Engagement Workstreams
The recommended amendments to the Fieldhaven SOW interact with several other workstreams within the broader Cascade US state-privacy compliance program. This section identifies the key coordination points.
A. Coordination with Master DPA Templates
Calderwood & Harkness is currently developing Master DPA Templates for use across Cascade's vendor relationships, including a service-provider template and a contractor template. These templates are being designed to incorporate the contractual requirements of all 19 applicable state privacy statutes into a single, comprehensive agreement form. The target date for finalization of the Master DPA Templates is September 30, 2025.
The Fieldhaven SOW amendment should be aligned with the draft Master DPA Template — Service Providers to the greatest extent practicable. However, given that the Master DPA Template is not yet finalized and the Fieldhaven SOW gap requires immediate remediation, we recommend a two-step approach:
Step 1 (Interim Amendment). Prepare and execute an interim data-protection amendment to the Fieldhaven SOW incorporating all recommendations set forth in Section V of this memorandum. The interim amendment should be based on the current working draft of the Master DPA Template and should include a provision stating that the interim amendment will be superseded by, or incorporated into, a comprehensive DPA rider upon finalization of the Master DPA Template. Target execution date: August 8, 2025 (30 days from the date of this memorandum).
Step 2 (Comprehensive DPA Rider). Upon finalization of the Master DPA Template — Service Providers on or about September 30, 2025, prepare and execute a formal DPA rider to the Fieldhaven SOW that replaces the interim amendment in its entirety. The comprehensive DPA rider will incorporate the final, vetted language of the Master DPA Template and will serve as the definitive data-protection agreement between Cascade and Fieldhaven for the remainder of the SOW term.
B. Coordination with Vendor DPA Rollout Plan
The third-party data-sharing risk assessment, which is targeted for delivery on August 4, 2025, has identified 23 of 47 advertising and analytics partners that lack executed DPAs. While Fieldhaven is not an advertising or analytics partner, it falls into the same contractual gap — a vendor with access to significant volumes of Cascade personal information operating without CCPA-compliant data-protection terms.
Remediation of the Fieldhaven SOW should be prioritized within the broader vendor DPA rollout plan given: (a) the sensitivity and volume of data to which Fieldhaven has access; (b) the fact that Fieldhaven's engagement specifically involves privacy-program implementation, making the absence of compliant data-protection terms particularly conspicuous; and (c) the fact that Fieldhaven has already accessed Cascade personal information in the course of performing the Milestone 1 data-mapping work. We recommend that the Fieldhaven SOW amendment be treated as the first vendor DPA remediation completed under the rollout plan.
C. Coordination with OnPoint Data Solutions
Fieldhaven's Milestone 2 workstream involves the deployment of the OnPoint Data Solutions Inc. consent-management platform. OnPoint's engagement with Cascade involves a three-year SaaS contract with an annual license fee of $480,000 per year (total contract value of $1,440,000 over the three-year term). In performing the CMP deployment, Fieldhaven will interact directly with OnPoint's systems and may access data processed by or through the OnPoint platform.
This interaction creates a sub-processor relationship in which OnPoint may function as a sub-processor to Fieldhaven with respect to certain categories of Cascade personal information. The sub-contractor flow-down provisions recommended in Section V.B above should expressly address this interaction and should require Fieldhaven to ensure that its agreement with OnPoint includes data-protection terms that are consistent with the amended Fieldhaven SOW. Additionally, a separate DPA Rider/Amendment is being prepared for the OnPoint contract (target execution date of September 25, 2025), and the terms of the Fieldhaven and OnPoint DPAs should be coordinated to avoid gaps or inconsistencies in the data-protection framework.
D. Fieldhaven Data-Mapping Report
As noted in Section II.A above, Fieldhaven's enterprise data-mapping report, delivered on May 19, 2025, involved Fieldhaven's access to and processing of extensive categories and volumes of Cascade personal information. This processing occurred prior to Calderwood & Harkness's engagement and prior to the execution of any CCPA-compliant data-protection terms. While this fact cannot be retroactively remedied — the processing has already occurred — it reinforces the urgency of executing compliant amendments now to govern Fieldhaven's ongoing and future processing of Cascade personal information in connection with Milestones 2 and 3.
We note that the data-mapping report deliverable may itself constitute Cascade personal information to the extent it contains or reflects personal information identified during the mapping exercise. The data-destruction and return provisions recommended in Section V.C should address the disposition of the data-mapping report and any underlying work papers, data extracts, or derivative analyses generated by Fieldhaven during the Milestone 1 work.
VII. Risk Assessment
The absence of adequate data-protection terms in the Fieldhaven SOW exposes Cascade to risk across multiple dimensions. We summarize the principal risk categories below.
Regulatory Risk. Without CCPA-compliant service-provider agreements, Fieldhaven's receipt and processing of Cascade personal information could be classified as a "sale" of personal information under CCPA Section 1798.140(ad), or as a "sharing" of personal information under CCPA Section 1798.140(ah). Either classification would trigger consumer opt-out rights, notice obligations (including updates to Cascade's online privacy policy and "Do Not Sell or Share My Personal Information" disclosures), and potential enforcement exposure. The California Attorney General has already demonstrated attention to the adequacy of Cascade's service-provider agreements through the February 6, 2024, informal inquiry letter. A finding that Cascade's privacy-program implementer is itself operating under a non-compliant agreement would likely be viewed as a significant aggravating factor in any enforcement proceeding. Additionally, Cascade could face enforcement actions by the California Privacy Protection Agency ("CPPA"), which has rulemaking and enforcement authority under the CPRA and has signaled service-provider contracts as a focus area. The risk is not limited to California; the other 18 applicable state statutes similarly impose contractual requirements on processor relationships, and deficiencies could expose Cascade to multi-state enforcement coordination.
Operational Risk. The absence of breach-notification obligations in the Fieldhaven SOW creates a gap in Cascade's incident-response chain. If a security incident occurs at Fieldhaven involving Cascade personal information, there is no contractual mechanism to ensure that Gregory Farris (CISO) and Diana Polk (Interim CPO) receive timely notification. This gap could delay Cascade's ability to contain the incident, conduct a forensic investigation, notify affected consumers, and satisfy regulatory-notification requirements. Given that many state breach-notification statutes impose notification deadlines measured from the date of discovery by the "owner" or "licensee" of the data (which, in the case of a vendor breach, may be triggered by the vendor's discovery rather than the business's discovery), any delay in vendor-to-business notification directly compresses the time available for Cascade to fulfill its own notification obligations.
Insurance Risk. Late notification of a data breach to Cascade's cyber/privacy-liability insurer, Northcastle Indemnity Company, could jeopardize coverage under the policy. The Northcastle policy, which provides $25 million per occurrence and $50 million annual aggregate coverage at an annual premium of $1,340,000, contains notice provisions that require prompt reporting of incidents. If a Fieldhaven breach goes unreported to Cascade for days or weeks — as is possible without a contractual notification timeline — the resulting delay in Cascade's notification to Northcastle could provide the insurer with a basis to deny or limit coverage. Given the volume and sensitivity of data at issue, a coverage denial could expose Cascade to substantial uninsured losses.
Contractual Risk. Without data-destruction or return obligations, Cascade personal information may persist indefinitely in Fieldhaven's systems, databases, backups, and work-product files after the SOW is completed. This c

PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION ATTORNEY WORK PRODUCT

MEMORANDUM

Record

Parties

Dates

Amounts