MARKETPLACE SELLER DATA-USE TERMS ADDENDUM
Addendum to the Cascade Digital Marketplace Seller Terms of Service
Calderwood & Harkness LLP Matter No.: 1038-00010 Drafted by: Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP Reviewed by: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP
This Marketplace Seller Data-Use Terms Addendum (this "Addendum") is entered into as of October 31, 2025 (the "Effective Date"), by and between:
Cascade Digital Marketplace LLC, a Delaware limited liability company (EIN: 85-4107638), a wholly owned subsidiary of Cascade Retail Holdings Inc., a Delaware corporation (Nasdaq: CSRD), with its principal office at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119 ("CDM" or the "Marketplace Operator");
and
The Third-Party Seller executing or electronically accepting this Addendum through the Cascade Digital Marketplace Seller portal (the "Seller").
CDM and Seller are each referred to herein individually as a "Party" and collectively as the "Parties."
This Addendum supplements the Cascade Digital Marketplace Seller Terms of Service (as amended from time to time, the "Seller Terms of Service"). Capitalized terms not defined herein shall have the meanings ascribed to them in the Seller Terms of Service.
Right-click to update Table of Contents
RECITALS
WHEREAS, CDM operates a third-party seller marketplace accessible at cascade.com/marketplace (the "Marketplace"), which currently hosts approximately 3,800 third-party sellers offering goods and services to consumers across the United States;
WHEREAS, CDM is a wholly owned subsidiary of Cascade Retail Holdings Inc. ("Cascade" or "Cascade Retail Holdings"), headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, a publicly traded corporation listed on the Nasdaq Stock Market under the ticker symbol "CSRD";
WHEREAS, Cascade Retail Holdings Inc. processes consumer personal information in connection with its omnichannel retail operations, which include approximately 94 million annual online transactions, 186 retail locations operating in 31 United States states, and approximately 41.2 million registered members of the Cascade Rewards loyalty program, which is managed through Cascade Rewards Corp., a wholly owned subsidiary of Cascade Retail Holdings Inc.;
WHEREAS, CDM and Sellers each collect, process, and have access to personal information of consumers who interact with the Marketplace, as well as personal information of each other's personnel and representatives, through the Marketplace platform and associated systems;
WHEREAS, this Addendum is adopted to comply with applicable United States state privacy and data protection statutes, including but not limited to the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), and a total of nineteen (19) applicable state privacy statutes in effect or scheduled to take effect as of the Effective Date of this Addendum;
WHEREAS, a preliminary data-mapping audit completed by Fieldhaven Consulting Group LLC ("Fieldhaven") on May 19, 2025 (the "Fieldhaven Audit") identified that third-party seller data on the Marketplace was commingled with Cascade's first-party customer data in a single data lake architecture without adequate role-based access controls, thereby creating significant compliance risks under multiple Applicable Privacy Laws, and this Addendum establishes the contractual framework to remedy that condition and prevent its recurrence;
WHEREAS, Cascade has previously been the subject of a Federal Trade Commission Civil Investigative Demand (File No. 232-0147, issued September 14, 2023, closed April 3, 2024) and a California Attorney General informal inquiry (initiated February 6, 2024, responded to March 8, 2024), and the compliance program underlying this Addendum is designed in part to address deficiencies identified in connection with those regulatory interactions; and
WHEREAS, the Parties desire to set forth their respective obligations with respect to the collection, use, disclosure, retention, and security of personal information processed in connection with the Marketplace, and to establish data-segregation requirements, purpose limitations, data subject request cooperation procedures, and other data governance measures as described herein;
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the Parties agree as follows:
ARTICLE 1 — DEFINITIONS
1.1 "Consumer Personal Information" or "Consumer PI" means personal information (as defined under CCPA/CPRA, Cal. Civ. Code § 1798.140(v), and equivalent definitions under other Applicable Privacy Laws) relating to consumers who interact with the Marketplace, including but not limited to: identifiers (e.g., name, mailing address, email address, telephone number, unique personal identifier, online identifier, IP address); commercial and transaction information (e.g., records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies); internet or other electronic network activity information (e.g., browsing history, search history, and information regarding a consumer's interaction with the Marketplace); geolocation data; inferences drawn from any of the foregoing to create a profile about a consumer; and payment information associated with Marketplace transactions. Consumer PI includes both Marketplace Transaction Data and, where applicable, First-Party Customer Data, as those terms are defined below.
1.2 "Seller Data" means personal information relating to the Seller, its personnel, its representatives, or its beneficial owners that is collected, generated, or processed in connection with the Seller's participation in the Marketplace, including but not limited to: account registration data (e.g., business name, contact information, authorized user credentials); tax identification information (e.g., Employer Identification Numbers, Individual Taxpayer Identification Numbers, and IRS Form W-9 data); transaction records reflecting the Seller's sales activity, commission calculations, and payment disbursements; performance metrics and seller ratings; and communications processed through the Marketplace's internal messaging system between Seller and CDM or between Seller and consumers.
1.3 "First-Party Customer Data" means Consumer PI that CDM or Cascade Retail Holdings Inc. (including its subsidiaries and affiliates) collects in its capacity as an independent business or controller through its direct-to-consumer retail operations, including but not limited to: purchases made through cascade.com outside the Marketplace; in-store transactions at any of Cascade's 186 retail locations; enrollment, account, and transactional data associated with the Cascade Rewards loyalty program (managed by Cascade Rewards Corp.); and data generated through Cascade's proprietary e-commerce and mobile application platforms. First-Party Customer Data is distinct from Marketplace Transaction Data and shall not be made accessible to Sellers except as expressly authorized herein or in a separate written agreement.
1.4 "Marketplace Transaction Data" means Consumer PI generated in connection with a Seller's transactions on the Marketplace, including but not limited to: order details (e.g., order identification numbers, items purchased, quantities, pricing, discounts applied); customer shipping information (e.g., ship-to name, shipping address, delivery instructions); payment confirmation data (limited to transaction amount, confirmation of payment authorization, and the last four digits of the consumer's payment card, but expressly excluding full payment-card numbers, CVV codes, or other complete payment-card data, which are processed exclusively by CDM's designated payment processor); return and exchange records; and post-purchase communications between the consumer and the Seller conducted through the Marketplace's messaging system.
1.5 "Applicable Privacy Laws" means all applicable United States state privacy and data protection statutes, regulations, and binding guidance, as each may be amended, supplemented, or superseded from time to time, including the following nineteen (19) statutes identified as of the Effective Date:
(a) California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), Cal. Civ. Code §§ 1798.100–1798.199.100;
(b) Virginia Consumer Data Protection Act (VCDPA), Va. Code Ann. §§ 59.1-575–59.1-585;
(c) Colorado Privacy Act (CPA), Colo. Rev. Stat. §§ 6-1-1301–6-1-1313;
(d) Connecticut Data Privacy Act (CTDPA), Conn. Gen. Stat. §§ 42-515–42-525;
(e) Utah Consumer Privacy Act (UCPA), Utah Code Ann. §§ 13-61-101–13-61-404;
(f) Iowa Consumer Data Protection Act (ICDPA), Iowa Code ch. 715D;
(g) Indiana Consumer Data Protection Act (INCDPA), Ind. Code §§ 24-15-1-1–24-15-9-1;
(h) Tennessee Information Protection Act (TIPA), Tenn. Code Ann. §§ 47-18-3201–47-18-3213;
(i) Montana Consumer Data Privacy Act (MCDPA), Mont. Code Ann. §§ 30-14-2801–30-14-2817;
(j) Texas Data Privacy and Security Act (TDPSA), Tex. Bus. & Com. Code ch. 541;
(k) Oregon Consumer Privacy Act (OCPA), Or. Rev. Stat. §§ 646A.570–646A.589;
(l) Delaware Personal Data Privacy Act (DPDPA), Del. Code Ann. tit. 6, ch. 12C;
(m) New Jersey Data Privacy Act (NJDPA), N.J. Stat. Ann. §§ 56:8-166–56:8-188;
(n) New Hampshire Data Privacy Act (NHDPA), N.H. Rev. Stat. Ann. §§ 507-H:1–507-H:12;
(o) Nebraska Data Privacy Act (NDPA), Neb. Rev. Stat. §§ 87-1101–87-1116;
(p) Minnesota Consumer Data Privacy Act (Minnesota MCDPA), Minn. Stat. §§ 325O.01–325O.22;
(q) Maryland Online Data Privacy Act (MODPA), Md. Code Ann., Com. Law §§ 14-4601–14-4616;
(r) Kentucky Data Privacy Act (KYDPA), Ky. Rev. Stat. Ann. §§ 367.400–367.476; and
(s) Any other United States state privacy or data protection statute enacted or becoming effective through the 2025–2026 legislative cycle that is applicable to either Party's processing of Consumer PI or Seller Data in connection with the Marketplace.
The term "Applicable Privacy Laws" also includes all implementing regulations, rules, and binding guidance issued by any governmental authority with jurisdiction over the enforcement of the foregoing statutes, including without limitation the California Privacy Protection Agency ("CPPA") and the Federal Trade Commission ("FTC") to the extent the FTC exercises authority relevant to the data practices at issue.
1.6 "Sensitive Personal Information" means personal information falling within the definition of "sensitive personal information" under CCPA/CPRA, Cal. Civ. Code § 1798.140(ae), and equivalent or analogous definitions under other Applicable Privacy Laws, including but not limited to: social security numbers, driver's license numbers, state identification card numbers, and passport numbers; account log-in credentials (username or email address in combination with a password or security question and answer allowing access to an online account); financial account information including payment-card numbers, financial account numbers, and any associated security codes, access codes, or passwords; precise geolocation data (as defined under applicable state law); racial or ethnic origin; religious or philosophical beliefs; union membership; contents of mail, email, or text messages (where the business is not the intended recipient); genetic data; biometric information processed for the purpose of uniquely identifying a consumer; and health information. In the Marketplace context, Sensitive Personal Information most commonly encompasses precise geolocation data, payment-card data, and account login credentials.
1.7 "Sale" and "Sharing." "Sale" has the meaning set forth in CCPA/CPRA, Cal. Civ. Code § 1798.140(ad), and analogous definitions under other Applicable Privacy Laws. "Sharing" has the meaning set forth in CCPA/CPRA, Cal. Civ. Code § 1798.140(ah), including but not limited to the disclosure of personal information to a third party for cross-context behavioral advertising, whether or not for monetary consideration. References to "Sale" and "Sharing" in this Addendum shall also encompass analogous concepts under other Applicable Privacy Laws, including the processing of personal information for "targeted advertising" as that term is defined under the VCDPA, CPA, CTDPA, and other state statutes.
1.8 "Data Subject Request" or "DSR" means any verifiable consumer request submitted to either Party to exercise rights available under Applicable Privacy Laws, including but not limited to: the right to know/access personal information collected; the right to delete personal information; the right to correct inaccurate personal information; the right to opt out of the Sale or Sharing of personal information; the right to limit the use and disclosure of Sensitive Personal Information; the right to data portability; and the right to appeal a denial of any of the foregoing requests. A DSR includes requests transmitted through automated means, including Global Privacy Control signals.
1.9 "Global Privacy Control" or "GPC" means a universal opt-out mechanism, as described in the CCPA/CPRA implementing regulations promulgated by the California Privacy Protection Agency (Cal. Code Regs. tit. 11, § 7025), through which a consumer may communicate their preference to opt out of the Sale or Sharing of personal information via a browser-level or device-level signal. GPC also encompasses any analogous universal opt-out mechanism recognized under other Applicable Privacy Laws, including the Colorado Privacy Act's universal opt-out mechanism regulations.
1.10 "Peakview Analytics" means Peakview Analytics Inc., a Delaware corporation (EIN: 87-2250194), a wholly owned subsidiary of Cascade Retail Holdings Inc. that operates as Cascade's in-house advertising technology, measurement, and analytics business unit. Peakview Analytics provides ad-targeting, audience segmentation, campaign measurement, and personalization services across Cascade's owned-and-operated digital properties and, through its retail media network, to third-party advertisers.
1.11 Additional Definitions. As used in this Addendum, the following terms shall have the meanings set forth below, or, where a term is defined differently under different Applicable Privacy Laws, the most protective definition shall apply:
(a) "Controller" means the natural or legal person that determines the purposes and means of processing personal information, as defined under the VCDPA, CPA, CTDPA, and other Applicable Privacy Laws that employ the controller/processor framework. Under the CCPA/CPRA, the analogous concept is "Business."
(b) "Processor" means a natural or legal person that processes personal information on behalf of a Controller, as defined under the VCDPA, CPA, CTDPA, and other Applicable Privacy Laws. Under the CCPA/CPRA, the analogous concept is "Service Provider."
(c) "Service Provider" has the meaning set forth in CCPA/CPRA, Cal. Civ. Code § 1798.140(ag).
(d) "Business Purpose" has the meaning set forth in CCPA/CPRA, Cal. Civ. Code § 1798.140(e).
(e) "Commercial Purpose" has the meaning set forth in CCPA/CPRA, Cal. Civ. Code § 1798.140(f).
(f) "Third Party" has the meaning set forth in CCPA/CPRA, Cal. Civ. Code § 1798.140(ai), and equivalent definitions under other Applicable Privacy Laws.
(g) "De-identified" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer or household, provided that the entity maintaining the information has implemented technical safeguards and business processes to prevent re-identification, has implemented business processes specifically prohibiting re-identification, and has not attempted to re-identify the information, consistent with the requirements of CCPA/CPRA, Cal. Civ. Code § 1798.140(m), and equivalent standards under other Applicable Privacy Laws.
(h) "Aggregated Information" means information that relates to a group or category of consumers, from which individual consumer identities have been removed, and that is not linked or reasonably linkable to any individual consumer or household.
ARTICLE 2 — SCOPE AND APPLICABILITY
2.1 Scope. This Addendum applies to all Consumer PI and Seller Data processed by either Party, or by any sub-processor or agent of either Party, in connection with the Marketplace, including but not limited to Consumer PI and Seller Data collected, generated, transmitted, stored, used, disclosed, or otherwise processed through the Marketplace platform, the Seller portal, Marketplace APIs, the Marketplace messaging system, or any other system or service integrated with or ancillary to the Marketplace. This Addendum governs the data practices of both Parties with respect to all consumers who interact with the Marketplace, regardless of whether such consumers are also customers of Cascade's direct-to-consumer retail operations or members of the Cascade Rewards loyalty program.
2.2 Precedence. This Addendum supplements the Cascade Digital Marketplace Seller Terms of Service. To the extent of any conflict or inconsistency between this Addendum and the data-related provisions of the Seller Terms of Service (including, without limitation, any provisions relating to data collection, use, disclosure, retention, security, or consumer privacy rights), this Addendum shall control and supersede such conflicting provisions. All other provisions of the Seller Terms of Service that are not inconsistent with this Addendum shall remain in full force and effect.
2.3 Independent Controllers. Both CDM and Seller acknowledge and agree that each Party may act as an independent controller (or, under the CCPA/CPRA framework, an independent "Business") with respect to certain categories of Consumer PI. The relationship between the Parties with respect to Consumer PI is not that of joint controllers (or joint "Businesses") unless expressly stated otherwise in a separate written agreement executed by both Parties. Each Party is independently responsible for its own compliance with Applicable Privacy Laws with respect to Consumer PI that it controls. Nothing in this Addendum shall be construed to create a joint controller or joint Business relationship, and neither Party shall make any representation to consumers, regulators, or third parties suggesting the existence of such a relationship, except as may be required by Applicable Privacy Laws.
2.4 Multi-State Applicability. Seller acknowledges that Cascade operates 186 retail locations in 31 United States states and ships products to consumers in all 50 states and the District of Columbia. Consumer data generated through Marketplace transactions may therefore be subject to multiple overlapping state privacy statutes simultaneously. Seller further acknowledges that the determination of which Applicable Privacy Laws apply to a particular consumer's data depends on factors including the consumer's state of residence, the nature of the personal information processed, and the volume of consumer data processed by each Party, and that such determinations may change as new state privacy statutes are enacted or become effective. Each Party shall independently assess and comply with the Applicable Privacy Laws relevant to its processing activities, and neither Party's compliance obligations under this Addendum shall be limited to only those state statutes expressly enumerated herein.
ARTICLE 3 — DATA SEGREGATION REQUIREMENTS
3.1 Obligation to Segregate. CDM shall implement and maintain technical and organizational measures designed to segregate Marketplace Transaction Data and Seller Data from First-Party Customer Data. These measures shall include, at a minimum, the following:
(a) Logical Separation. CDM shall implement logical separation of Marketplace Transaction Data from First-Party Customer Data within CDM's data infrastructure. This obligation specifically addresses and is intended to remedy the commingled single-data-lake architecture identified in the Fieldhaven data-mapping audit of May 19, 2025, in which Marketplace Transaction Data and First-Party Customer Data were stored in a unified data lake environment without meaningful access controls distinguishing between data types or data sources. CDM shall ensure that Marketplace Transaction Data is stored in a logically distinct data environment, with clearly defined schema boundaries and metadata tagging, such that Marketplace Transaction Data cannot be queried, accessed, or processed in combination with First-Party Customer Data without an affirmative, logged, and authorized action. The technical specifications for this logical separation are described in further detail in Exhibit B.
(b) Role-Based Access Controls. CDM shall implement and enforce role-based access controls ("RBAC") ensuring that each Seller can access only its own Marketplace Transaction Data through the designated Seller portal and APIs. No Seller shall have access to First-Party Customer Data, to other Sellers' Marketplace Transaction Data, or to Seller Data belonging to other Sellers. CDM's internal personnel shall have access to Marketplace Transaction Data only on a need-to-know basis, consistent with the principle of least privilege, and all access shall be logged in an audit trail meeting the specifications described in Exhibit B.
(c) Peakview Analytics Restrictions. Peakview Analytics Inc. shall not ingest, process, or otherwise use Marketplace Transaction Data for ad-targeting, audience segmentation, campaign measurement, personalization, or any other advertising or analytics purpose on behalf of CDM's first-party retail operations, Cascade Retail Holdings Inc., or any third-party advertiser, without (i) a separate and lawful legal basis for such processing under all Applicable Privacy Laws (which may include, without limitation, consumer consent, a contractual necessity, or a recognized exemption), and (ii) prior written notification to the affected Seller(s) specifying the nature and scope of such processing. For the avoidance of doubt, this restriction does not prohibit Peakview Analytics from processing Aggregated Information or De-identified information derived from Marketplace Transaction Data, provided that such aggregation or de-identification meets the requirements of Section 1.11(g) and (h) above and all Applicable Privacy Laws.
3.2 Seller Access Restrictions. Seller shall access Consumer PI only through CDM's designated Seller portal (currently accessible at sellercentral.cascade.com) and through CDM's documented Marketplace APIs, and only to the extent necessary to fulfill the permitted purposes set forth in Article 4. Seller shall not attempt to circumvent, override, or defeat CDM's access controls, data-segregation measures, or any other technical or organizational security measures. Seller shall not engage in any automated data extraction, scraping, or harvesting of Consumer PI from the Marketplace, Cascade's consumer-facing websites, or any other Cascade platform or property. Seller shall not access, or attempt to access, First-Party Customer Data, Cascade Rewards loyalty program data, browsing or behavioral data collected by Cascade or Peakview Analytics, or Marketplace Transaction Data belonging to any other Seller. Any violation of this Section 3.2 shall constitute a material breach of this Addendum.
3.3 Implementation Timeline. CDM shall complete the implementation of the technical segregation measures described in Section 3.1 no later than December 15, 2025. This timeline is consistent with the planned deployment of CDM's new consent-management platform and DSR automation tools, which are being implemented concurrently as part of CDM's broader privacy compliance program. CDM shall provide Seller with written confirmation through the Marketplace Seller portal upon completion of the technical segregation measures. If CDM reasonably determines that the December 15, 2025 deadline cannot be met due to unforeseen technical circumstances, CDM shall (i) notify Seller of the delay and the revised timeline as soon as practicable, and (ii) implement interim compensating controls to mitigate the risks associated with the continued commingled data architecture until full segregation is achieved.
3.4 Audit and Verification. CDM reserves the right to audit Seller's compliance with the data-segregation requirements and access restrictions set forth in this Article 3, in accordance with the audit procedures described in Article 10. Seller reserves the right to submit a written request to CDM for confirmation that the data-segregation controls described in Section 3.1 are operational and functioning as intended. CDM shall respond to such requests within fifteen (15) business days, and shall provide Seller with a written statement confirming the operational status of the segregation controls or, if any deficiency has been identified, describing the nature of the deficiency and the remedial measures being taken.
ARTICLE 4 — PERMITTED USES AND PURPOSE LIMITATIONS
4.1 Seller's Permitted Uses of Consumer PI. Seller may process Marketplace Transaction Data solely for the following purposes (each a "Permitted Purpose"), and for no other purpose:
(a) Order Fulfillment. Processing Consumer PI as necessary to fulfill consumer orders placed through the Marketplace, including picking, packing, shipping, delivery, and delivery confirmation.
(b) Customer Service and Post-Purchase Support. Processing Consumer PI as necessary to provide customer service, respond to consumer inquiries, and provide post-purchase support in connection with specific Marketplace transactions, including troubleshooting product issues, tracking shipments, and addressing consumer complaints.
(c) Legal Compliance. Processing Consumer PI as necessary to comply with applicable legal obligations, including but not limited to tax reporting requirements, product-safety recall obligations, consumer protection laws, and court orders or lawful subpoenas.
(d) Returns, Exchanges, and Warranty Claims. Processing Consumer PI as necessary to manage returns, exchanges, refunds, and warranty claims arising from Marketplace transactions.
(e) Transactional Communications. Communicating with consumers regarding their specific Marketplace transactions, including order confirmations, shipping notifications, delivery updates, return authorizations, and post-purchase follow-up communications directly related to a completed transaction. For the avoidance of doubt, this Permitted Purpose does not authorize Seller to send marketing communications, promotional offers, newsletters, or solicitations to consumers using Consumer PI obtained through the Marketplace, unless Seller has obtained independent, direct consumer consent for such communications and has disclosed such use in Seller's own privacy notice in compliance with all Applicable Privacy Laws, including the requirements of Section 5.1 below.
4.2 Prohibited Uses. Seller shall NOT engage in any of the following activities with respect to Consumer PI obtained through the Marketplace:
(a) No Sale or Sharing. Seller shall not Sell or Share (as those terms are defined in Section 1.7 above) Consumer PI obtained through the Marketplace to or with any third party, for monetary or other valuable consideration, or for cross-context behavioral advertising purposes, under any circumstances. This prohibition applies regardless of whether the recipient of such Consumer PI is a parent company, affiliate, subsidiary, business partner, advertising network, data broker, or any other entity.
(b) No Targeted Advertising, Profiling, or Cross-Context Behavioral Advertising. Seller shall not use Consumer PI obtained through the Marketplace for cross-context behavioral advertising, profiling (as that term is defined under applicable state statutes), or targeted advertising (as that term is defined under the VCDPA, CPA, CTDPA, and analogous state statutes), unless Seller has (i) obtained independent, direct consent from the consumer (not derived from or bundled with any consent obtained by CDM or Cascade), and (ii) disclosed such use in Seller's own consumer-facing privacy notice in compliance with all Applicable Privacy Laws.
(c) No Commingling. Seller shall not combine, merge, link, or otherwise commingle Consumer PI obtained through the Marketplace with personal information obtained from any other source (including, without limitation, Seller's own direct-to-consumer channels, social media platforms, third-party data providers, or other marketplaces), except to the extent strictly necessary to fulfill a specific Marketplace transaction (e.g., linking a Marketplace order to an existing customer service ticket initiated by the same consumer regarding the same transaction).
(d) No Unauthorized Disclosure. Seller shall not disclose, transfer, make available, or otherwise provide Consumer PI to any third party, except as expressly permitted in this Addendum (including Article 8 regarding sub-processors) or as required by applicable law.
(e) No Unauthorized Processing of Sensitive Personal Information. Seller shall not process Sensitive Personal Information (including precise geolocation data, payment-card data, and account login credentials) for any purpose other than completing the specific Marketplace transaction for which such Sensitive Personal Information was provided, and shall not retain Sensitive Personal Information beyond the period necessary to complete such transaction, unless a longer retention period is required by applicable law.
4.3 CDM's Uses of Seller Data. CDM may process Seller Data for the following purposes:
(a) Marketplace Administration. Operating, administering, maintaining, and improving the Marketplace platform, including onboarding Sellers, managing Seller accounts, facilitating Seller-consumer communications, and providing Seller support services.
(b) Payment Processing and Tax Reporting. Processing Seller Data as necessary to facilitate payment disbursements to Sellers, calculate commissions and fees, and comply with tax reporting obligations, including the preparation and filing of IRS Forms 1099-K and other applicable tax information returns.
(c) Fraud Prevention and Platform Integrity. Processing Seller Data as necessary to detect, prevent, and investigate fraud, unauthorized access, policy violations, and other activities that threaten the security, integrity, or availability of the Marketplace or the safety of consumers and other Sellers.
(d) Legal and Regulatory Compliance. Processing Seller Data as necessary to comply with Applicable Privacy Laws, respond to regulatory inquiries, cooperate with law enforcement, and fulfill CDM's obligations under applicable statutes, regulations, and court orders.
(e) Internal Analytics. Using Seller Data for internal analytics regarding Marketplace performance, seller trends, and platform optimization. CDM shall use Aggregated Information or De-identified information for such analytics purposes where feasible, and shall not use individually identifiable Seller Data for analytics purposes except as necessary for the specific purposes described in subsections (a) through (d) above.
4.4 No Sale or Sharing of Seller Data. CDM shall not Sell or Share Seller Data to or with any third party for advertising, marketing, or promotional purposes. This prohibition extends to Peakview Analytics Inc. and any other advertising or analytics subsidiary or affiliate of Cascade Retail Holdings Inc. CDM may disclose Seller Data to its affiliates, service providers, and agents solely for the purposes described in Section 4.3, subject to the confidentiality and data protection requirements of the Seller Terms of Service and this Addendum.
ARTICLE 5 — SELLER OBLIGATIONS REGARDING CONSUMER PI
5.1 Privacy Notice. Seller shall maintain a consumer-facing privacy notice (a "Seller Privacy Notice") that is publicly accessible, written in clear and plain language, and that accurately and completely describes Seller's collection, use, disclosure, and retention of Consumer PI, consistent with the requirements of all Applicable Privacy Laws. The Seller Privacy Notice must, at a minimum, describe the categories of Consumer PI collected, the purposes for which each category is used, the categories of third parties to whom Consumer PI is disclosed, and the consumer rights available under Applicable Privacy Laws. The Seller Privacy Notice must not conflict with, contradict, or make representations inconsistent with CDM's or Cascade's consumer-facing privacy notices, including the Omnibus Privacy Policy published by Cascade Retail Holdings Inc. and the California-Specific Privacy Disclosures Addendum maintained by Cascade. Seller shall update its Seller Privacy Notice as necessary to reflect changes in Seller's data practices or changes in Applicable Privacy Laws, and shall provide CDM with a current link to its Seller Privacy Notice through the Marketplace Seller portal.
5.2 Lawful Processing. Seller represents and warrants that all of Seller's processing of Consumer PI obtained through the Marketplace complies with all Applicable Privacy Laws, including all requirements regarding notice, consent, purpose limitation, data minimization, storage limitation, and individual rights. Seller shall not process Consumer PI in a manner that would cause CDM or Cascade to violate any Applicable Privacy Law.
5.3 Opt-Out Requests. To the extent that Seller engages in any Sale or Sharing of personal information (whether involving Consumer PI obtained through the Marketplace or personal information obtained through other channels), Seller shall honor consumer opt-out-of-sale/sharing requests submitted through any method required by Applicable Privacy Laws, including the processing of Global Privacy Control (GPC) signals as a valid opt-out request. Seller shall implement technical capabilities to detect and honor GPC signals and shall maintain records of GPC signals received and honored. Seller shall treat GPC signals from consumers who interact with the Marketplace as a valid opt-out request pursuant to CCPA/CPRA and any other Applicable Privacy Law that recognizes such signals.
5.4 Sensitive Personal Information. If Seller collects or processes Sensitive Personal Information from consumers in connection with Marketplace transactions, Seller shall obtain any consents required under Applicable Privacy Laws prior to such collection or processing. Without limiting the foregoing, Seller shall comply with the CCPA/CPRA right to limit the use and disclosure of Sensitive Personal Information (Cal. Civ. Code § 1798.121), and shall provide consumers with a clear and conspicuous link titled "Limit the Use of My Sensitive Personal Information" (or equivalent language as required by applicable regulations) if Seller uses Sensitive Personal Information for purposes beyond those necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such services or goods.
5.5 Data Minimization. Seller shall collect and retain only the minimum amount of Consumer PI reasonably necessary for the Permitted Purposes set forth in Article 4. Seller shall not collect Consumer PI that is excessive, irrelevant, or unnecessary in relation to the Permitted Purposes. Seller shall periodically review its data collection and retention practices to ensure ongoing compliance with this data minimization requirement and with the data minimization principles set forth in Applicable Privacy Laws.
5.6 Data Security. Seller shall implement and maintain reasonable administrative, technical, and physical security measures appropriate to the nature, scope, context, and purposes of the Consumer PI processed, and to the risks to the rights and freedoms of the consumers whose data is processed. Such measures shall be consistent with industry standards, including but not limited to encryption of Consumer PI in transit and at rest, access controls, employee training, vulnerability management, and incident response planning. Seller's security measures shall, at a minimum, comply with the security requirements set forth in all Applicable Privacy Laws, including the CCPA/CPRA's reasonable security procedures and practices requirement (Cal. Civ. Code § 1798.150).
ARTICLE 6 — DATA SUBJECT REQUEST COOPERATION
6.1 Notification by Seller. If Seller receives a DSR directly from a consumer (whether submitted by email, mail, telephone, or any other means) and such DSR relates to Consumer PI processed through the Marketplace, Seller shall notify CDM of the DSR within three (3) business days of receipt. Such notification shall be submitted through the CDM DSR coordination portal (currently accessible at sellercentral.cascade.com/dsr) or, if the portal is unavailable, by email to privacy-ops@cascade.com, and shall include a copy or reasonable description of the DSR, the consumer's identity (to the extent known), and the categories of Consumer PI believed to be at issue.
6.2 Notification by CDM. If CDM receives a DSR from a consumer (including through Cascade's centralized DSR portal at cascade.com/privacy/request) and CDM determines that the DSR involves Marketplace Transaction Data held by or originating from a particular Seller, CDM shall notify the affected Seller(s) within three (3) business days of such determination. Notification shall be provided through the Marketplace Seller portal or by email to the Seller's designated privacy contact. The notification shall include a description of the request, the type of right being exercised, the consumer's verified identity (subject to the verification procedures described in Section 6.6), and the specific action required of the Seller.
6.3 Cooperation. Each Party shall reasonably cooperate with the other to respond to DSRs within the time periods required by Applicable Privacy Laws. For purposes of this Addendum, CDM's target response time for DSRs involving Marketplace Transaction Data is fifteen (15) business days or less from the date the DSR is verified, representing an improvement from the fiscal year 2024 average response time of twenty-seven (27) calendar days. Seller shall use commercially reasonable efforts to meet the same fifteen (15) business day target, and in no event shall either Party exceed the maximum response times mandated by Applicable Privacy Laws (e.g., 45 calendar days under CCPA/CPRA, subject to a 45-day extension where reasonably necessary). Each Party shall bear its own costs in responding to DSRs, except as otherwise agreed in writing.
6.4 Access, Deletion, and Correction. Upon receiving a verified consumer request for access to, deletion of, or correction of Consumer PI that has been forwarded by CDM pursuant to Section 6.2, Seller shall complete the requested action within ten (10) business days and shall confirm completion to CDM through the DSR coordination portal. If Seller is unable to complete the requested action within ten (10) business days due to technical limitations or legal constraints, Seller shall notify CDM of the delay within two (2) business days, provide an explanation of the reason for the delay, and provide an estimated completion date. For deletion requests, Seller shall delete the Consumer PI from all of Seller's active systems, databases, and records, and shall direct any sub-processors to do the same, except to the extent retention is permitted or required under Applicable Privacy Laws (e.g., for legal compliance, exercising or defending legal claims, or other recognized exceptions).
6.5 Appeal Process. Certain Applicable Privacy Laws, including the VCDPA (Va. Code Ann. § 59.1-577(A)(5)), the CPA (Colo. Rev. Stat. § 6-1-1306(3)), the CTDPA (Conn. Gen. Stat. § 42-520(a)(5)), and other state statutes, provide consumers with the right to appeal a business's or controller's denial of a DSR. Seller shall cooperate with CDM's appeal process by: (i) providing CDM with any information reasonably necessary to evaluate and respond to a consumer's appeal; (ii) taking corrective action within ten (10) business days if an appeal is determined to be meritorious; and (iii) maintaining records of appeals received, the reasons for the initial denial, the outcome of each appeal, and any corrective actions taken. CDM shall administer the appeal process and communicate directly with the consumer, unless Seller is required by Applicable Privacy Laws to respond independently.
6.6 Identity Verification. CDM's centralized DSR portal (cascade.com/privacy/request) will handle consumer identity verification to the standards required by the CCPA/CPRA and its implementing regulations, including the California Privacy Protection Agency's regulations regarding verification of consumer requests (Cal. Code Regs. tit. 11, § 7060 et seq.). Seller shall rely on CDM's identity verification determination and shall not independently collect additional personal information from the consumer for the purpose of re-verification, unless such independent verification is required by applicable law, in which case Seller shall collect only the minimum information necessary for verification purposes and shall delete such information promptly after verification is complete.
ARTICLE 7 — DATA RETENTION AND DISPOSAL
7.1 Retention Periods. Seller shall retain Marketplace Transaction Data containing Consumer PI only for so long as reasonably necessary to fulfill the Permitted Purposes set forth in Article 4 and to comply with applicable legal obligations (including, without limitation, tax record-keeping requirements, product-safety obligations, and litigation holds). Unless a longer retention period is specifically required by applicable law, Seller shall delete or De-identify Consumer PI no later than twenty-four (24) months after the date of the relevant Marketplace transaction (the "Maximum Retention Period"). Seller shall maintain a documented data retention schedule that specifies the retention periods for each category of Consumer PI that Seller processes in connection with the Marketplace, and shall make such schedule available to CDM upon request.
7.2 Disposal. Upon expiration of the applicable retention period or, if earlier, upon termination or expiration of Seller's Marketplace account (for any reason, including termination pursuant to Article 13), Seller shall securely delete or destroy all Consumer PI obtained through the Marketplace from all of Seller's systems, databases, records, backups, and archives, using methods consistent with NIST Special Publication 800-88 (Guidelines for Media Sanitization) or equivalent industry standards. Within thirty (30) days following the completion of such deletion or destruction, Seller shall provide CDM with a written certification, signed by an authorized officer or representative of Seller, confirming that all Consumer PI obtained through the Marketplace has been securely deleted or destroyed and specifying the date of deletion or destruction and the method used. This certification shall be submitted through the Marketplace Seller portal or by email to privacy-ops@cascade.com.
7.3 Legal Holds. If Seller places a legal hold on any Consumer PI obtained through the Marketplace (whether in connection with pending or reasonably anticipated litigation, a regulatory inquiry, or any other legal obligation), Seller shall notify CDM of the legal hold within five (5) business days. Such notification shall identify the categories of Consumer PI subject to the hold and the expected duration of the hold (to the extent known). The Parties shall cooperate in good faith to ensure that the legal hold does not result in a violation of any Applicable Privacy Law, including by implementing appropriate access restrictions, minimizing the scope of data subject to the hold, and resuming the normal retention and disposal schedule promptly upon the expiration or release of the hold.
ARTICLE 8 — SUB-PROCESSORS AND ONWARD TRANSFERS
8.1 Restrictions on Disclosure. Seller shall not disclose, transfer, make available, or otherwise provide Consumer PI obtained through the Marketplace to any sub-processor, agent, contractor, affiliate, or other third party (each, a "Downstream Recipient") without CDM's prior written consent. Requests for consent shall be submitted through the Marketplace Seller portal and shall include: (i) the identity and contact information of the proposed Downstream Recipient; (ii) the categories of Consumer PI to be disclosed; (iii) the purpose of the disclosure; (iv) the safeguards the Downstream Recipient will implement to protect Consumer PI; and (v) a copy of or reference to the written agreement between Seller and the Downstream Recipient governing the Downstream Recipient's processing of Consumer PI. CDM shall respond to such requests within fifteen (15) business days and shall not unreasonably withhold consent.
8.2 Flow-Down Obligations. Any Downstream Recipient that is authorized by CDM to receive Consumer PI pursuant to Section 8.1 must be bound by a written agreement containing data protection obligations that are at least as protective of Consumer PI as those set forth in this Addendum, including without limitation: (i) purpose limitations equivalent to those in Article 4; (ii) prohibitions on Sale and Sharing equivalent to those in Section 4.2(a); (iii) data security obligations equivalent to those in Section 5.6; (iv) DSR cooperation obligations equivalent to those in Article 6; (v) data retention and disposal obligations equivalent to those in Article 7; and (vi) breach notification obligations equivalent to those in Article 9. Seller shall provide CDM with a copy of the relevant data protection provisions of any such agreement upon request.
8.3 Seller Liability. Seller shall remain fully responsible and liable for the acts, omissions, and compliance of its Downstream Recipients with respect to Consumer PI obtained through the Marketplace. Any breach of this Addendum by a Downstream Recipient shall be deemed a breach by Seller for all purposes hereunder, including for purposes of the indemnification obligations in Article 12 and the termination provisions in Article 13.
ARTICLE 9 — SECURITY INCIDENTS AND BREACH NOTIFICATION
9.1 Notification Obligation. If Seller becomes aware of any unauthorized access to, acquisition of, use of, or disclosure of Consumer PI obtained through the Marketplace, or any other event that compromises the security, confidentiality, or integrity of such Consumer PI (each, a "Security Incident"), Seller shall notify CDM of the Security Incident within forty-eight (48) hours of Seller's discovery of the Security Incident. For purposes of this Section, "Discovery" means the moment at which Seller has a reasonable basis for believing that a Security Incident has occurred, whether or not Seller has completed a full investigation. Notification shall be provided to CDM's privacy operations team at privacy-ops@cascade.com and by telephone to CDM's designated security incident hotline, with a copy to the CDM legal team at legal-privacy@cascade.com.
9.2 Content of Notification. The Security Incident notification required by Section 9.1 shall include, to the extent known at the time of notification and subject to supplementation as additional information becomes available:
(a) A description of the nature of the Security Incident, including the date(s) of occurrence and the date of discovery;
(b) The categories and approximate number of consumers whose Consumer PI is or may be affected;
(c) The categories of Consumer PI involved in the Security Incident (e.g., names, email addresses, shipping addresses, payment confirmation data);
(d) A description of the likely consequences of the Security Incident;
(e) A description of the measures taken or proposed to be taken to address the Security Incident, including measures to mitigate its possible adverse effects; and
(f) The name and contact information of Seller's designated point of contact for communications regarding the Security Incident.
Seller shall provide CDM with updated information as Seller's investigation progresses, on a cadence of no less than every forty-eight (48) hours until the Security Incident has been contained and remediated.
9.3 Cooperation. Seller shall fully cooperate with CDM's incident-response procedures, including any investigation, containment, remediation, and communication activities undertaken by CDM in connection with the Security Incident. Seller acknowledges that CDM and Cascade Retail Holdings Inc. maintain a cyber and privacy liability insurance policy with Northcastle Indemnity Company (Policy No. NIC-CPL-2025-07741), and that CDM's incident-response procedures may require coordination with the insurer, insurer-appointed counsel, and insurer-appointed forensic investigators. Seller shall cooperate with such parties as reasonably directed by CDM, subject to any applicable attorney-client privilege or work product protections. Seller shall also cooperate with CDM in fulfilling any regulatory notification obligations arising from the Security Incident, including state data breach notification requirements and any notifications required by the FTC, state attorneys general, or the California Privacy Protection Agency.
9.4 No Independent Notification. Seller shall not independently notify affected consumers, regulators, media, or any other party of a Security Incident involving Consumer PI obtained through the Marketplace without CDM's prior written consent, unless Seller is independently required by applicable law to provide such notification in its capacity as a controller or business. In the event that Seller believes it is legally required to provide independent notification, Seller shall notify CDM of its intent to do so at least forty-eight (48) hours in advance (or, if applicable law requires notification on a shorter timeline, as soon as practicable), and shall coordinate the timing, content, and recipients of such notification with CDM to the extent permitted by law.
ARTICLE 10 — COMPLIANCE AND AUDIT RIGHTS
10.1 Compliance Representations. Seller represents and warrants that, as of the Effective Date and on an ongoing basis throughout the term of this Addendum, Seller is and will remain in compliance with the obligations set forth in this Addendum and with all Applicable Privacy Laws with respect to Seller's processing of Consumer PI and Seller Data in connection with the Marketplace. Seller acknowledges that this representation is material to CDM's willingness to permit Seller to participate in the Marketplace and to have access to Consumer PI.
10.2 CDM Audit Rights. CDM, or its authorized agent (which may include, without limitation, Calderwood & Harkness LLP, Fieldhaven Consulting Group LLC, or another qualified third-party auditor selected by CDM), may audit Seller's compliance with this Addendum upon not less than thirty (30) days' prior written notice to Seller. Audits shall be conducted during Seller's normal business hours and in a manner designed to minimize disruption to Seller's operations. CDM shall be entitled to conduct no more than one (1) audit per calendar year, unless (i) a Security Incident involving Consumer PI obtained through the Marketplace has occurred, (ii) CDM has received a credible complaint from a consumer, regulator, or other party regarding Seller's data practices, or (iii) CDM has a reasonable good-faith basis for believing that Seller is not in compliance with this Addendum, in which case CDM may conduct additional audits as reasonably necessary. Seller shall cooperate fully with any audit, including providing access to relevant records, systems, and personnel. The costs of any audit shall be borne by CDM, except that if an audit reveals a material non-compliance by Seller, Seller shall reimburse CDM for the reasonable costs of the audit.
10.3 Records. Seller shall maintain complete and accurate records of its processing activities involving Consumer PI obtained through the Marketplace, sufficient to demonstrate compliance with this Addendum and all Applicable Privacy Laws, for a period of at least three (3) years from the date of such processing. Such records shall include, at a minimum: (i) a description of the categories of Consumer PI processed; (ii) the purposes of processing; (iii) the categories of Downstream Recipients to whom Consumer PI has been disclosed; (iv) a description of the data security measures implemented; (v) records of DSRs received and the actions taken in response; and (vi) records of any Security Incidents, including the notification provided to CDM and the remedial measures taken.
10.4 Certifications. Upon CDM's reasonable request (which shall be made no more than twice per calendar year, absent extraordinary circumstances), Seller shall provide CDM with a written certification, signed by an authorized officer or authorized representative of Seller, confirming Seller's compliance with this Addendum. Such certification shall be provided within thirty (30) days of CDM's request and shall address, at a minimum, Seller's compliance with the purpose limitations in Article 4, the data security requirements in Section 5.6, the data retention requirements in Article 7, and the sub-processor restrictions in Article 8.
ARTICLE 11 — REGULATORY INQUIRIES AND COOPERATION
11.1 Notification of Regulatory Inquiries. Seller shall promptly notify CDM (and in no event later than five (5) business days after receipt) if Seller receives any regulatory inquiry, Civil Investigative Demand, subpoena, demand letter, notice of investigation, notice of enforcement action, or other communication from any governmental authority (including, without limitation, the Federal Trade Commission, any state attorney general, the California Privacy Protection Agency, or any other state or federal regulatory body) relating to or potentially affecting Consumer PI processed through the Marketplace or Seller's compliance with Applicable Privacy Laws in connection with the Marketplace. Such notification shall include a copy of the regulatory communication (to the extent Seller is not prohibited by law from disclosing it) and a description of Seller's proposed response.
11.2 Cooperation. Seller shall cooperate with CDM in responding to any regulatory inquiry described in Section 11.1, including by providing CDM with access to relevant records, documents, and information, and by coordinating the timing and content of any response with CDM. Seller acknowledges that Cascade Retail Holdings Inc. has previously been the subject of an FTC Civil Investigative Demand (File No. 232-0147, issued September 14, 2023, closed April 3, 2024) and a California Attorney General informal inquiry (initiated February 6, 2024, responded to March 8, 2024), and that the compliance program underlying this Addendum is designed in part to address deficiencies identified in connection with those regulatory interactions. Seller further acknowledges that any new regulatory inquiry relating to Marketplace data practices may implicate both Parties and that coordinated responses are essential to protecting the interests of both Parties and of the affected consumers.
11.3 Public Statements. Seller shall not make any public statement, press release, blog post, social media communication, or other public disclosure regarding CDM's or Cascade's data practices, privacy compliance program, or regulatory history, or regarding any Security Incident involving Consumer PI obtained through the Marketplace, without CDM's prior written consent. This restriction does not prohibit Seller from making truthful statements required by applicable law or in response to a lawful regulatory inquiry, provided that Seller notifies CDM in advance of such disclosure to the extent permitted by law.
ARTICLE 12 — INDEMNIFICATION
12.1 Seller Indemnification. Seller shall indemnify, defend, and hold harmless CDM, Cascade Retail Holdings Inc., Cascade Rewards Corp., Peakview Analytics Inc., and their respective affiliates, subsidiaries, parent companies, officers, directors, employees, agents, successors, and assigns (collectively, the "CDM Indemnified Parties") from and against any and all claims, demands, actions, suits, proceedings, losses, liabilities, damages, fines, penalties, costs, and expenses (including reasonable attorneys' fees, expert fees, court costs, and costs of investigation and remediation) (collectively, "Losses") arising out of or related to:
(a) Seller's breach of any representation, warranty, covenant, or obligation set forth in this Addendum;
(b) Seller's violation of any Applicable Privacy Law in connection with Consumer PI obtained through the Marketplace;
(c) Any DSR, consumer complaint, or regulatory action resulting from Seller's failure to comply with this Addendum or Applicable Privacy Laws;
(d) Any Security Incident caused by or arising from Seller's acts or omissions, or the acts or omissions of Seller's Downstream Recipients; or
(e) Any claim by a consumer, regulator, or third party arising from Seller's unauthorized use, disclosure, Sale, or Sharing of Consumer PI obtained through the Marketplace.
Seller's indemnification obligations under this Section 12.1 shall survive the termination or expiration of this Addendum and the Seller Terms of Service.
12.2 CDM Indemnification. CDM shall indemnify, defend, and hold harmless Seller and its officers, directors, employees, and agents (collectively, the "Seller Indemnified Parties") from and against any Losses arising out of or related to a claim to the extent such claim arises solely and directly from CDM's failure to implement or maintain the data-segregation measures described in Article 3, including but not limited to any claim resulting from the continued commingling of Marketplace Transaction Data and First-Party Customer Data after the December 15, 2025 implementation deadline. CDM's indemnification obligation under this Section 12.2 shall not apply to the extent that the Losses are attributable, in whole or in part, to Seller's own acts or omissions, including Seller's breach of this Addendum or Seller's violation of Applicable Privacy Laws. CDM's indemnification obligations under this Section 12.2 shall survive the termination or expiration of this Addendum and the Seller Terms of Service.
ARTICLE 13 — TERM AND TERMINATION
13.1 Term. This Addendum is effective as of October 31, 2025 and shall remain in full force and effect for so long as Seller maintains an active account on the Cascade Digital Marketplace, unless earlier terminated in accordance with this Article 13. Upon the termination or expiration of the Seller Terms of Service for any reason, this Addendum shall terminate concurrently, subject to the survival provisions of Section 13.3.
13.2 Termination for Breach. CDM may suspend or terminate Seller's Marketplace account and this Addendum upon written notice to Seller if Seller materially breaches any provision of this Addendum and fails to cure such breach within fifteen (15) days of receiving written notice from CDM specifying the nature of the breach and the actions required to cure it. Notwithstanding the foregoing, CDM may immediately suspend Seller's access to Consumer PI, without a cure period, if CDM reasonably determines that Seller's breach poses an imminent risk of harm to consumers or to the security of Consume