PRIVILEGED & CONFIDENTIAL — SUBJECT TO ATTORNEY-CLIENT PRIVILEGE AND WORK-PRODUCT DOCTRINE
DATA PROCESSING ADDENDUM
Addendum Reference: DPA-2025-ONP-001
Date: September 25, 2025
This Data Processing Addendum (this "DPA" or "Addendum") is entered into as of September 25, 2025 (the "Effective Date"), and constitutes an addendum to that certain Master SaaS Services Agreement by and between Cascade Retail Holdings Inc. and OnPoint Data Solutions Inc. for consent-management platform services (the "Underlying Agreement"). This Addendum sets forth the terms and conditions under which OnPoint Data Solutions Inc. processes Personal Information on behalf of Cascade Retail Holdings Inc. in connection with the provision of CMP SaaS services under the Underlying Agreement. This Addendum is executed in connection with Calderwood & Harkness LLP Matter No. 1038-00010.
Right-click to update Table of Contents
SECTION 1: PARTIES
1.1 Customer / Controller.
"Cascade" or "Customer" means Cascade Retail Holdings Inc., a corporation organized and existing under the laws of the State of Delaware, with its principal place of business located at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and listed on the Nasdaq Stock Market under the ticker symbol CSRD (Employer Identification Number 84-3192057). For purposes of this Addendum, "Cascade" or "Customer" shall also include, and the obligations of OnPoint hereunder shall extend to, each of the following subsidiaries and affiliates of Cascade Retail Holdings Inc. for whose benefit the CMP services are provided under the Underlying Agreement:
(a) Cascade Digital Marketplace LLC, a Delaware limited liability company (EIN 85-4107638);
(b) Peakview Analytics Inc., a Delaware corporation (EIN 87-2250194);
(c) Cascade Rewards Corp., a Delaware corporation (EIN 86-3381729); and
(d) Ridgeline Fulfillment Services Inc., a Delaware corporation (EIN 91-1647823).
Each of the foregoing entities is a direct or indirect subsidiary of Cascade Retail Holdings Inc. and is a beneficiary of the CMP services provided by OnPoint under the Underlying Agreement. References to "Cascade" or "Customer" in this Addendum shall be construed to include all such subsidiaries and affiliates unless the context requires otherwise.
1.2 Vendor / Service Provider.
"OnPoint" or "Service Provider" means OnPoint Data Solutions Inc., a corporation organized and existing under the laws of the State of Delaware, with its principal offices located at 800 West El Camino Real, Suite 220, Mountain View, California 94040. OnPoint's Chief Executive Officer is Danielle Ferrero. OnPoint serves as the SaaS vendor providing Cascade's consent-management platform ("CMP") and cookie-consent technology, which is deployed on Cascade's primary consumer-facing website, cascade.com, and the Cascade mobile application available on iOS and Android platforms. OnPoint provides these services in its capacity as a service provider (under the California Consumer Privacy Act, as amended) and a processor (under other applicable state privacy laws), as further described in Section 5 of this Addendum.
SECTION 2: RECITALS
WHEREAS:
A. Cascade and OnPoint have entered into the Underlying Agreement, pursuant to which OnPoint provides consent-management platform SaaS services to Cascade, including the deployment and maintenance of cookie-consent technology, consent-preference storage and management, Global Privacy Control signal recognition, and consent-analytics reporting on cascade.com and the Cascade mobile application;
B. The Underlying Agreement provides for a three (3)-year term, with an annual license fee of Four Hundred Eighty Thousand Dollars ($480,000) per year, resulting in a total contract value of One Million Four Hundred Forty Thousand Dollars ($1,440,000) over the full term of the engagement;
C. In the course of providing the CMP services described in the Underlying Agreement, OnPoint will Process Personal Information of Cascade's Consumers, including data collected through twelve (12) categories of cookies and tracking technologies deployed on cascade.com and the Cascade mobile application, encompassing strictly necessary cookies, performance cookies, functional cookies, targeting and advertising cookies, analytics cookies, social media cookies, session cookies, persistent cookies, first-party cookies, third-party cookies, pixel tags, and local storage objects;
D. Cascade is a leading omnichannel retailer that operates one hundred eighty-six (186) retail locations across thirty-one (31) U.S. states, ships e-commerce orders to all fifty (50) states and the District of Columbia, maintains approximately 41.2 million registered Cascade Rewards loyalty-program members, and generates approximately ninety-four (94) million annual online transactions through cascade.com and the Cascade mobile application, thereby collecting and Processing substantial volumes of consumer Personal Information;
E. By virtue of the scope of its operations and consumer base, Cascade is subject to nineteen (19) applicable U.S. state privacy statutes, including but not limited to: the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"); the Virginia Consumer Data Protection Act ("VCDPA"); the Colorado Privacy Act ("Colorado CPA"); the Connecticut Data Privacy Act ("CTDPA"); the Utah Consumer Privacy Act ("UCPA"); the Iowa Consumer Data Protection Act ("ICDPA"); the Indiana Consumer Data Protection Act ("INCDPA"); the Tennessee Information Protection Act ("TIPA"); the Montana Consumer Data Privacy Act ("Montana MCDPA"); the Texas Data Privacy and Security Act ("TDPSA"); the Oregon Consumer Privacy Act ("OCPA"); the Delaware Personal Data Privacy Act ("DPDPA"); the New Jersey Data Privacy Act ("NJDPA"); the New Hampshire Data Privacy Act ("NHDPA"); the Nebraska Data Privacy Act ("NDPA"); the Minnesota Consumer Data Privacy Act ("Minnesota MCDPA"); the Maryland Online Data Privacy Act ("MODPA"); the Kentucky Consumer Data Protection Act ("KYDPA"); and such additional state privacy statutes as may become effective during the term of this Addendum;
F. This Addendum is intended to ensure that OnPoint's Processing of Personal Information in connection with the CMP services complies with all Applicable Privacy Laws and to memorialize OnPoint's obligations as a "service provider" under the CCPA/CPRA and as a "processor" under all other applicable state privacy laws, thereby safeguarding the rights of Cascade's Consumers and protecting Cascade from regulatory, litigation, and reputational risk;
G. This Addendum is entered into as part of Cascade's comprehensive U.S. state-privacy compliance program, which is overseen by Calderwood & Harkness LLP, 600 Lexington Avenue, 28th Floor, New York, New York 10022, serving as Cascade's outside privacy counsel, under Matter No. 1038-00010; and
H. This Addendum supersedes and replaces any prior data-processing, data-protection, or privacy-related terms, conditions, exhibits, schedules, or addenda contained in or appended to the Underlying Agreement, to the extent that such terms are inconsistent with the provisions of this Addendum.
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
SECTION 3: DEFINITIONS
For purposes of this Addendum, the following terms shall have the meanings set forth below. Capitalized terms used but not defined in this Addendum shall have the meanings ascribed to them in the Underlying Agreement. In the event of a conflict between a definition in this Addendum and a definition in the Underlying Agreement, the definition in this Addendum shall control with respect to the Processing of Personal Information.
3.1 "Applicable Privacy Laws" means all U.S. state privacy and data-protection statutes, regulations, rules, and binding regulatory guidance applicable to the Processing of Personal Information under this Addendum, including but not limited to the nineteen (19) statutes enumerated in Recital E above, as each may be amended, supplemented, or replaced from time to time, together with any implementing regulations promulgated thereunder (including, without limitation, regulations promulgated by the California Privacy Protection Agency).
3.2 "Business Purpose" has the meaning ascribed to such term in California Civil Code Section 1798.140(e), as amended by the CPRA, and includes the specific purposes set forth in Section 4 of this Addendum.
3.3 "Consumer" means a natural person who is a California resident, as defined in the CCPA/CPRA, or the equivalent term used under other Applicable Privacy Laws to describe an individual whose Personal Information is subject to protection under such laws, including "consumer" (as used in the VCDPA, CTDPA, UCPA, TDPSA, OCPA, DPDPA, NJDPA, NHDPA, NDPA, Minnesota MCDPA, MODPA, and KYDPA), "data subject," or any similar term.
3.4 "Controller" means Cascade Retail Holdings Inc. (and its subsidiaries and affiliates identified in Section 1.1), as the entity that, alone or jointly with others, determines the purposes and means of the Processing of Personal Information. For purposes of the CCPA/CPRA, "Controller" is equivalent to "business" as defined in California Civil Code Section 1798.140(d). Under other Applicable Privacy Laws, "Controller" has the meaning ascribed to such term in the relevant statute.
3.5 "Personal Information" or "PI" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a Consumer or a household, as defined under Applicable Privacy Laws. Without limiting the generality of the foregoing, "Personal Information" includes "personal data" as defined under the VCDPA, Colorado CPA, CTDPA, and other Applicable Privacy Laws. "Personal Information" excludes information that has been deidentified or aggregated in accordance with the requirements of Applicable Privacy Laws.
3.6 "Process" or "Processing" means any operation or set of operations performed on Personal Information or on sets of Personal Information, whether or not by automated means, including but not limited to collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment, combination, restriction, erasure, or destruction.
3.7 "Processor" means OnPoint Data Solutions Inc., as the entity that Processes Personal Information on behalf of the Controller pursuant to the Controller's instructions and the terms of the Underlying Agreement and this Addendum. For purposes of the CCPA/CPRA, "Processor" is equivalent to "service provider" as defined in California Civil Code Section 1798.140(ag). Under the VCDPA, Colorado CPA, CTDPA, and other Applicable Privacy Laws, "Processor" has the meaning ascribed to such term (or its equivalent) in the relevant statute.
3.8 "Sell" or "Sale" has the meaning ascribed to such term in California Civil Code Section 1798.140(ad), as amended by the CPRA, and includes the equivalent concept under any other Applicable Privacy Law.
3.9 "Share" or "Sharing" has the meaning ascribed to such term in California Civil Code Section 1798.140(ah), as amended by the CPRA, which generally means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's Personal Information to a third party for cross-context behavioral advertising purposes, whether or not for monetary or other valuable consideration. "Sharing" also encompasses the equivalent concept under any other Applicable Privacy Law that restricts the disclosure of Personal Information for targeted advertising or similar purposes.
3.10 "Sensitive Personal Information" has the meaning ascribed to such term in California Civil Code Section 1798.140(ae), as amended by the CPRA, and includes the equivalent categories of sensitive data or sensitive personal data defined under other Applicable Privacy Laws, including but not limited to precise geolocation data, account log-in credentials (in combination with any required security or access code, password, or credentials allowing access to an account), racial or ethnic origin, religious beliefs, health data, biometric data used for unique identification, and other categories designated as sensitive under each applicable statute.
3.11 "Service Provider" has the meaning ascribed to such term in California Civil Code Section 1798.140(ag), as amended by the CPRA. OnPoint is classified as a Service Provider under the CCPA/CPRA with respect to all Personal Information Processed under this Addendum.
3.12 "Sub-processor" means any third party (including any OnPoint affiliate or subcontractor) engaged by OnPoint that Processes Personal Information on behalf of Cascade in connection with the CMP services, excluding individual employees or contractors of OnPoint who are subject to OnPoint's direct supervision and bound by confidentiality obligations.
3.13 "Data Subject Request" or "DSR" means a verifiable request from a Consumer (or the Consumer's authorized agent) exercising one or more rights under Applicable Privacy Laws, including but not limited to: (a) the right to know or access Personal Information; (b) the right to delete Personal Information; (c) the right to correct inaccurate Personal Information; (d) the right to opt out of the Sale or Sharing of Personal Information; (e) the right to limit the use and disclosure of Sensitive Personal Information; and (f) the right to appeal a denial of a consumer-rights request.
3.14 "Security Incident" means any unauthorized access to, acquisition of, use of, or disclosure of Personal Information, including any event that compromises the confidentiality, integrity, or availability of Personal Information Processed by OnPoint or its Sub-processors in connection with this Addendum, whether or not such event constitutes a "breach of the security of the system" or similar term under Applicable Privacy Laws.
SECTION 4: SCOPE AND PURPOSE OF PROCESSING
4.1 Services Covered.
OnPoint Processes Personal Information solely in connection with providing the CMP SaaS services under the Underlying Agreement. The specific Processing activities include, without limitation:
(a) deployment, configuration, and maintenance of cookie-consent collection mechanisms on cascade.com and the Cascade mobile application;
(b) collection and recording of Consumer consent preferences with respect to cookies and tracking technologies;
(c) storage and management of consent-preference records in OnPoint's CMP platform;
(d) transmission and management of consent signals across Cascade's advertising and analytics technology stack;
(e) recognition and pass-through of Global Privacy Control ("GPC") signals received from Consumer browsers and devices;
(f) generation and delivery of consent-analytics reports and dashboards to Cascade; and
(g) provision of technical support and platform maintenance related to the foregoing activities.
OnPoint shall not Process Personal Information for any purpose other than those expressly set forth in this Section 4.1 and as otherwise documented in Cascade's written instructions, except where required by applicable law. In the event that OnPoint is required by applicable law to Process Personal Information for a purpose not described in this Section, OnPoint shall promptly inform Cascade of such legal requirement prior to commencing such Processing, unless prohibited from doing so by applicable law.
4.2 Categories of Personal Information Processed.
The categories of Personal Information Processed by OnPoint in connection with the CMP services include, but are not limited to:
(a) Online Identifiers: cookie identifiers, device identifiers, advertising identifiers, and Internet Protocol (IP) addresses;
(b) Consent Preferences: records of Consumer choices regarding the acceptance or rejection of specific cookie categories and tracking technologies, including the date, time, and method of each consent action;
(c) Browsing Session Data: information about the Consumer's interaction with the CMP interface, including pages visited at the time of consent interaction, browser type and version, operating system, and referral source;
(d) Non-Precise Geolocation Data: geolocation information derived from IP addresses, limited to the state, metropolitan area, or postal-code level (OnPoint does not Process precise geolocation data, defined as latitude/longitude coordinates capable of identifying a Consumer's location within a radius of 1,850 feet or less, unless expressly authorized by Cascade in writing); and
(e) Consumer CMP-Interaction Records: records of Consumer interactions with the consent-management interface, including banner impressions, preference-center visits, and consent-modification events.
4.3 Categories of Consumers.
The categories of Consumers whose Personal Information is Processed by OnPoint under this Addendum include:
(a) visitors to cascade.com, including both authenticated and unauthenticated users;
(b) users of the Cascade mobile application on iOS and Android platforms;
(c) Cascade Rewards loyalty-program members, comprising a population of approximately 41.2 million registered members as of the Effective Date; and
(d) consumers interacting with the Cascade Digital Marketplace, including third-party marketplace buyers and sellers.
4.4 Duration of Processing.
OnPoint's Processing of Personal Information under this Addendum shall be co-extensive with the three (3)-year term of the Underlying Agreement, commencing on the Effective Date of this Addendum and continuing until the expiration or earlier termination of the Underlying Agreement, subject in all cases to OnPoint's obligations regarding deletion and return of Personal Information set forth in Section 12 of this Addendum. Following expiration or termination, OnPoint shall cease all Processing of Personal Information except as expressly permitted under Section 12.3.
SECTION 5: ONPOINT'S ROLE AND CCPA CLASSIFICATION
5.1 CCPA/CPRA Classification.
OnPoint is classified as a "service provider" under the CCPA/CPRA (California Civil Code Section 1798.140(ag)) with respect to all Personal Information received from or Processed on behalf of Cascade under this Addendum. OnPoint acknowledges that, as a service provider under the CCPA/CPRA, it receives Personal Information from Cascade for a Business Purpose pursuant to a written contract (this Addendum) and is prohibited from retaining, using, or disclosing such Personal Information for any purpose other than the Business Purposes specified in this Addendum and the Underlying Agreement, including retaining, using, or disclosing such Personal Information for a commercial purpose other than providing the CMP services.
5.2 Classification Under Other Applicable Privacy Laws.
Under all other Applicable Privacy Laws, including but not limited to the VCDPA, Colorado CPA, CTDPA, UCPA, ICDPA, INCDPA, TIPA, Montana MCDPA, TDPSA, OCPA, DPDPA, NJDPA, NHDPA, NDPA, Minnesota MCDPA, MODPA, and KYDPA, OnPoint is classified as a "processor" acting on behalf of Cascade as the "controller." OnPoint shall comply with all obligations and restrictions imposed on processors under each such statute.
5.3 Certification of Understanding.
OnPoint hereby acknowledges and certifies that it understands the restrictions and obligations applicable to service providers under the CCPA/CPRA and to processors under all other Applicable Privacy Laws. OnPoint further certifies that it will comply with all such restrictions and obligations in connection with its Processing of Personal Information under this Addendum. This certification is made pursuant to California Civil Code Section 1798.100(d) and is intended to satisfy the contractual certification requirement applicable to service-provider agreements under the CCPA/CPRA.
5.4 Non-Third-Party Status.
OnPoint shall not be deemed a "third party" (as defined in California Civil Code Section 1798.140(ai)) or a "business" (as defined in California Civil Code Section 1798.140(d)) with respect to Personal Information received from or on behalf of Cascade. OnPoint shall not engage in any conduct that would cause it to be reclassified as a third party or business under the CCPA/CPRA or any other Applicable Privacy Law.
SECTION 6: RESTRICTIONS ON USE, RETENTION, AND DISCLOSURE
6.1 Purpose Limitation.
OnPoint shall Process Personal Information only for the specific Business Purposes identified in Section 4 of this Addendum, as necessary to perform the CMP services under the Underlying Agreement, and in strict accordance with Cascade's documented instructions. OnPoint shall not Process Personal Information in a manner that is incompatible with the purposes for which it was collected or subsequently authorized by Cascade. In the event that OnPoint believes that any instruction from Cascade would result in a violation of Applicable Privacy Laws, OnPoint shall promptly notify Cascade and shall not carry out such instruction until the parties have resolved the concern.
6.2 Prohibition on Sale or Sharing.
OnPoint shall not Sell or Share (as those terms are defined in the CCPA/CPRA and corresponding provisions of other Applicable Privacy Laws) any Personal Information received from or on behalf of Cascade. This prohibition applies regardless of whether the Sale or Sharing would involve monetary consideration or other valuable consideration. OnPoint represents and warrants that it has not Sold or Shared, and will not Sell or Share, any Personal Information received from or on behalf of Cascade during the term of this Addendum or at any time thereafter.
6.3 Prohibition on Combining Data.
OnPoint shall not combine Personal Information received from Cascade with (a) Personal Information that OnPoint receives from or on behalf of any other person or entity, or (b) Personal Information that OnPoint collects from its own interaction with Consumers, except as expressly permitted by California Civil Code Section 1798.140(ag)(1)(A) through (E) and the corresponding provisions under other Applicable Privacy Laws. The permitted exceptions include combining Personal Information:
(i) to perform the CMP services specified in the Underlying Agreement and this Addendum;
(ii) to detect data-security incidents or protect against fraudulent or illegal activity;
(iii) to identify and repair errors that impair existing intended functionality of the CMP services;
(iv) for internal use by OnPoint to build or improve the quality of its services, provided that such use does not include building or modifying consumer profiles to be used in providing services to another business or for cross-context behavioral advertising; and
(v) as otherwise expressly authorized by Cascade in writing.
6.4 Prohibition on Retention Beyond Necessity.
OnPoint shall not retain, use, or disclose Personal Information outside the direct business relationship between OnPoint and Cascade or for any purpose other than performing the CMP services specified in Section 4 and the Underlying Agreement. OnPoint shall retain Personal Information only for so long as reasonably necessary to fulfill the Business Purposes for which it was collected, after which OnPoint shall securely delete or de-identify such Personal Information in accordance with Section 12 of this Addendum. OnPoint's data-retention practices shall comply with all applicable retention-limitation requirements under Applicable Privacy Laws.
6.5 No Commercial Use.
OnPoint shall not use Personal Information received from or on behalf of Cascade for OnPoint's own commercial purposes, including but not limited to: (a) product development or improvement of OnPoint's products and services for the benefit of other customers or prospective customers; (b) analytics, benchmarking, or market research for OnPoint's own benefit or the benefit of third parties; (c) advertising, marketing, or cross-context behavioral advertising; (d) training of machine-learning models for purposes unrelated to the CMP services; or (e) any other purpose that is not directly related to and reasonably necessary for OnPoint's performance of the CMP services for Cascade under the Underlying Agreement.
SECTION 7: SUB-PROCESSOR REQUIREMENTS
7.1 Disclosure of Existing Sub-processors.
OnPoint shall provide Cascade with a current, complete list of all Sub-processors that Process Personal Information under this Addendum. The initial Sub-processor list shall be delivered as Exhibit A to this Addendum and shall include, for each Sub-processor: (a) the legal name of the Sub-processor entity; (b) the location (city, state, and country) of the Sub-processor's Processing operations; (c) a description of the Processing activities performed by the Sub-processor; and (d) the categories of Personal Information Processed by the Sub-processor. OnPoint shall update the Sub-processor list promptly upon any change and shall make the current list available to Cascade at all times upon reasonable request.
7.2 Prior Written Notice of New Sub-processors.
OnPoint shall provide Cascade with at least thirty (30) calendar days' prior written notice before engaging any new Sub-processor or replacing any existing Sub-processor that will Process Personal Information under this Addendum. Such notice shall include the information specified in Section 7.1(a) through (d) above, together with a description of the safeguards implemented by the proposed Sub-processor. OnPoint shall not engage any new Sub-processor until the notice period has expired and any objection by Cascade has been resolved in accordance with Section 7.3.
7.3 Cascade's Right to Object.
Cascade shall have the right to object to the engagement of any new or replacement Sub-processor by providing written notice to OnPoint within fifteen (15) calendar days of receiving the notice described in Section 7.2. Cascade's objection may be based on reasonable privacy or security grounds, including but not limited to concerns regarding the Sub-processor's data-protection practices, security posture, compliance history, or geographic location. Upon receipt of an objection, OnPoint shall work with Cascade in good faith to resolve the objection, which may include implementing additional safeguards or proposing an alternative Sub-processor. If the parties are unable to resolve the objection within fifteen (15) calendar days following Cascade's objection, Cascade may terminate the affected CMP services, or the portion thereof that would require the use of the objected-to Sub-processor, without penalty, liability, or payment of early-termination fees, upon written notice to OnPoint.
7.4 Flow-Down Obligations.
Prior to any Sub-processor's Processing of Personal Information under this Addendum, OnPoint shall enter into a written agreement with such Sub-processor that imposes data-protection obligations no less protective than those set forth in this Addendum. Without limiting the generality of the foregoing, each Sub-processor agreement shall include:
(a) the restrictions on use, retention, and disclosure set forth in Section 6 of this Addendum;
(b) the security requirements set forth in Section 9 of this Addendum;
(c) the breach-notification obligations set forth in Section 10 of this Addendum;
(d) the data-localization requirements set forth in Section 8 of this Addendum;
(e) the deletion and return obligations set forth in Section 12 of this Addendum; and
(f) audit rights allowing Cascade (or its authorized representative) to verify the Sub-processor's compliance with such obligations.
OnPoint shall make copies of Sub-processor agreements available to Cascade upon request, subject to the redaction of commercially sensitive terms that are not relevant to data-protection compliance.
7.5 Liability for Sub-processors.
OnPoint shall remain fully liable to Cascade for the acts and omissions of its Sub-processors with respect to the Processing of Personal Information under this Addendum. OnPoint's engagement of a Sub-processor shall not relieve OnPoint of any obligation under this Addendum or the Underlying Agreement. In the event that a Sub-processor fails to fulfill its data-protection obligations, OnPoint shall take prompt corrective action and shall be responsible for any losses, liabilities, damages, costs, or expenses incurred by Cascade as a result of such failure.
SECTION 8: DATA LOCALIZATION
8.1 Processing Within the United States.
OnPoint shall Process and store all Personal Information received from or on behalf of Cascade exclusively within the continental United States. All servers, databases, storage media, and infrastructure used to Process or store Personal Information under this Addendum shall be located within the United States.
8.2 Prohibition on International Transfers.
OnPoint shall not transfer, transmit, or otherwise make available any Personal Information received from or on behalf of Cascade to any location, server, data center, or facility outside the United States without Cascade's prior written consent, which may be withheld in Cascade's sole discretion. This prohibition applies to all forms of transfer, including remote access from outside the United States.
8.3 Sub-processor Data Localization.
OnPoint shall ensure that each Sub-processor engaged pursuant to Section 7 of this Addendum also Processes and stores Personal Information exclusively within the United States, unless Cascade has provided prior written authorization for Processing in a different jurisdiction. OnPoint shall include data-localization requirements consistent with this Section 8 in each Sub-processor agreement entered into pursuant to Section 7.4.
8.4 Data-Center Identification.
OnPoint shall identify the specific data-center locations (by city and state) used for the Processing and storage of Personal Information under this Addendum and shall provide this information to Cascade upon request. OnPoint shall notify Cascade in writing at least thirty (30) calendar days prior to any change in the data-center locations used for Processing or storage of Personal Information. As of the Effective Date, OnPoint shall provide an initial list of data-center locations to Cascade as part of Exhibit C to this Addendum.
SECTION 9: SECURITY REQUIREMENTS
9.1 Comprehensive Security Program.
OnPoint shall implement and maintain a comprehensive information-security program that includes administrative, technical, and physical safeguards appropriate to the nature, scope, context, and purposes of the Processing and the sensitivity of the Personal Information Processed. OnPoint's information-security program shall be designed to protect Personal Information against unauthorized access, acquisition, use, disclosure, destruction, alteration, and loss, and shall comply with all security requirements imposed by Applicable Privacy Laws. OnPoint shall document its information-security program in writing and make such documentation available to Cascade upon request.
9.2 Minimum Security Controls.
At a minimum, and without limiting the generality of Section 9.1, OnPoint's information-security program shall include the following controls and measures:
(a) Encryption in Transit: All Personal Information transmitted over public or untrusted networks shall be encrypted using Transport Layer Security (TLS) version 1.2 or higher, with strong cipher suites.
(b) Encryption at Rest: All Personal Information stored on OnPoint's systems, including databases, file systems, and backup media, shall be encrypted using the Advanced Encryption Standard (AES) with a key length of 256 bits (AES-256) or an equivalent encryption standard approved by the National Institute of Standards and Technology (NIST).
(c) Multi-Factor Authentication: Administrative access to systems and applications that Process or store Personal Information shall require multi-factor authentication (MFA), using at least two independent authentication factors (e.g., a knowledge factor and a possession factor or inherence factor).
(d) Role-Based Access Controls: Access to Personal Information shall be restricted to authorized personnel on a least-privilege, need-to-know basis, with role-based access controls implemented to limit each user's access to the minimum set of data and functions necessary to perform their assigned duties.
(e) Intrusion Detection and Prevention Systems: OnPoint shall deploy and maintain intrusion detection systems (IDS) and intrusion prevention systems (IPS) to monitor network traffic and detect unauthorized access attempts and other security events.
(f) Vulnerability Scanning and Penetration Testing: OnPoint shall conduct regular vulnerability scanning of its systems and applications (at least quarterly) and external penetration testing (at least annually) using qualified independent security professionals. OnPoint shall promptly remediate any identified vulnerabilities in accordance with industry-standard timelines based on severity.
(g) Logging and Monitoring: OnPoint shall maintain comprehensive audit logs of all access to Personal Information, including user identity, date and time of access, type of access (read, write, delete), and the data or systems accessed. Logs shall be retained for a minimum of twelve (12) months and shall be reviewed regularly for anomalous activity.
(h) Employee Security Training: OnPoint shall provide regular security-awareness training to all personnel who have access to Personal Information, with initial training upon onboarding and refresher training at least annually. Training shall cover data-protection principles, secure handling of Personal Information, phishing and social-engineering awareness, and incident-reporting procedures.
Additional technical and organizational security measures are specified in Exhibit C to this Addendum.
9.3 SOC 2 Type II Report.
OnPoint shall maintain a current Service Organization Controls (SOC) 2 Type II report, issued by an independent certified public accounting firm, covering the CMP services and the Trust Services Criteria relevant to security, availability, and confidentiality. OnPoint shall provide a copy of the most recent SOC 2 Type II report to Cascade upon request and upon each annual renewal of the Underlying Agreement. OnPoint acknowledges that Cascade's independent auditor, Lakemont Audit Partners LLP (engagement partner Sheila Brogan), may review OnPoint's SOC 2 Type II report as part of its assessment of Cascade's internal controls over financial reporting, and OnPoint shall cooperate with Cascade and Lakemont Audit Partners LLP as reasonably necessary to address any questions or concerns regarding the SOC 2 report, including the overlap between privacy controls and internal-control implications for Cascade's financial-reporting obligations.
9.4 Risk Assessments.
OnPoint shall conduct regular risk assessments of its Processing activities, including assessments of administrative, technical, and physical safeguards, at least annually and following any material change to OnPoint's Processing environment, technology infrastructure, or organizational structure. OnPoint shall provide summaries of risk assessments to Cascade upon request, and shall promptly notify Cascade of any material risks or vulnerabilities identified during such assessments.
9.5 Updates to Security Measures.
OnPoint shall update its security measures as necessary to address evolving threats, vulnerabilities, and industry best practices, and to comply with changes in Applicable Privacy Laws. OnPoint shall not materially reduce the level of security protection applicable to Personal Information during the term of this Addendum without Cascade's prior written consent.
SECTION 10: SECURITY INCIDENT / BREACH NOTIFICATION
10.1 Notification Timeline.
OnPoint shall notify Cascade of any Security Incident without unreasonable delay and in no event later than forty-eight (48) hours after OnPoint becomes aware, or reasonably should have become aware, of the Security Incident. Notification shall be provided to Cascade's General Counsel (Meredith Tanaka) and Associate General Counsel / Interim CPO (Diana Polk) via email and telephone, using the contact information set forth in Section 20.4, with a concurrent copy to Calderwood & Harkness LLP (Kevin Ostrowski). OnPoint acknowledges that the 48-hour notification requirement is a material obligation of this Addendum and that untimely notification may expose Cascade to regulatory penalties, consumer harm, and reputational damage.
10.2 Content of Notification.
The initial notification provided by OnPoint pursuant to Section 10.1 shall include, to the extent known at the time of notification and to the fullest extent reasonably available:
(a) a description of the nature of the Security Incident, including the categories and approximate number of affected Consumers and Personal Information records;
(b) the name, title, email address, and telephone number of OnPoint's designated point of contact for the Security Incident;
(c) a description of the likely consequences of the Security Incident for affected Consumers and for Cascade;
(d) a description of the measures taken or proposed by OnPoint to address the Security Incident and to mitigate its potential adverse effects, including any measures taken to contain the incident and prevent recurrence; and
(e) the date and time when OnPoint first became aware of the Security Incident, and a preliminary timeline of events.
If OnPoint is unable to provide all of the information specified above at the time of the initial notification, OnPoint shall provide the information in phases without further undue delay, supplementing the initial notification with additional details as they become available. OnPoint shall provide written follow-up reports to Cascade at least every seventy-two (72) hours until the Security Incident has been fully investigated and resolved.
10.3 Cooperation.
OnPoint shall cooperate fully with Cascade in investigating and remediating any Security Incident, including providing all information, documentation, access to systems and personnel, and other assistance reasonably necessary for Cascade to: (a) assess the nature and scope of the Security Incident; (b) determine whether notification to affected Consumers, regulatory authorities, or other third parties is required under Applicable Privacy Laws; (c) prepare and deliver any required notifications; and (d) comply with any regulatory inquiry, investigation, or enforcement action arising from the Security Incident. OnPoint shall designate a senior-level incident-response coordinator to serve as Cascade's primary point of contact throughout the investigation and remediation process.
10.4 Preservation of Evidence.
OnPoint shall preserve all relevant logs, records, forensic images, correspondence, and other evidence related to a Security Incident for a minimum of three (3) years following the date on which OnPoint first became aware of the incident, or for such longer period as may be required by Applicable Privacy Laws or requested by Cascade. OnPoint shall not alter, delete, or destroy any such evidence without Cascade's prior written consent. OnPoint shall implement and maintain a litigation-hold protocol in connection with any Security Incident that may give rise to legal claims or regulatory proceedings.
10.5 No Independent Notification.
OnPoint shall not notify any affected Consumer, regulatory authority, law-enforcement agency, credit-monitoring service, media outlet, or any other third party of a Security Incident without Cascade's prior written consent, except where such notification is expressly required by law and cannot reasonably be delayed pending Cascade's consent. In the event that OnPoint is legally compelled to provide notification without Cascade's consent, OnPoint shall provide Cascade with as much advance notice as legally permissible and shall coordinate the content and timing of such notification with Cascade to the fullest extent possible.
10.6 Insurance Coordination.
Cascade maintains cyber and privacy-liability insurance coverage with Northcastle Indemnity Company (policy period: July 1, 2025 through June 30, 2026), with an aggregate limit of Twenty-Five Million Dollars ($25,000,000) per occurrence and Fifty Million Dollars ($50,000,000) in annual aggregate coverage, at an annual premium of One Million Three Hundred Forty Thousand Dollars ($1,340,000). The coverage is brokered by Ridgepoint Insurance Brokers Inc. (account executive: Nathan Gilroy). OnPoint shall cooperate with Cascade, Northcastle Indemnity Company, Ridgepoint Insurance Brokers Inc., and any forensic investigators, breach-response consultants, or legal counsel retained in connection with any insurance claim arising from a Security Incident. Such cooperation shall include providing access to relevant systems, logs, and personnel, participating in interviews and depositions, and providing written declarations or certifications as reasonably requested by Cascade's insurer. OnPoint's cooperation obligations under this Section 10.6 shall survive termination or expiration of this Addendum.
SECTION 11: CONSUMER-RIGHTS ASSISTANCE (DSR SUPPORT)
11.1 Assistance Obligations.
OnPoint shall assist Cascade in fulfilling Cascade's obligations to respond to Data Subject Requests from Consumers exercising their rights under Applicable Privacy Laws. Such assistance shall include, without limitation, support for the following categories of DSRs:
(a) Access/Right to Know Requests: Requests from Consumers to know or access the categories and specific pieces of Personal Information that have been collected about them, including consent-preference records and CMP-interaction data;
(b) Deletion Requests: Requests from Consumers to delete Personal Information held by OnPoint, including all consent records, cookie IDs, and associated data;
(c) Correction Requests: Requests from Consumers to correct inaccurate Personal Information;
(d) Opt-Out of Sale/Sharing Requests: Requests from Consumers to opt out of the Sale or Sharing of their Personal Information, including requests transmitted via Global Privacy Control signals;
(e) Limitation of Sensitive PI Requests: Requests from Consumers to limit the use and disclosure of their Sensitive Personal Information; and
(f) Appeal Requests: Consumer appeals of Cascade's denial of a DSR, as required under the VCDPA, Colorado CPA, CTDPA, and other Applicable Privacy Laws.
OnPoint shall implement and maintain technical and organizational measures sufficient to enable Cascade to search for, retrieve, correct, and delete Personal Information held by OnPoint in response to DSRs, and shall not require Cascade to perform manual or duplicative processes where automated solutions are reasonably available.
11.2 Response Time.
OnPoint shall respond to Cascade's DSR-related requests within five (5) business days of receipt of such requests. This response-time requirement is designed to enable Cascade to meet its target DSR response time of fifteen (15) business days or less, which represents a material improvement over Cascade's fiscal year 2024 average DSR response time of twenty-seven (27) calendar days. For context, Cascade processed approximately 38,400 DSRs in fiscal year 2024, comprising approximately 12,800 access/right-to-know requests, approximately 19,100 deletion requests, and approximately 6,500 opt-out requests. The parties anticipate that DSR volume may increase during the term of this Addendum as additional state privacy laws become effective and consumer awareness grows. OnPoint's five (5)-business-day response-time commitment shall apply regardless of DSR volume, and OnPoint shall scale its resources as necessary to meet this commitment.
11.3 Technical Capability.
OnPoint's CMP shall support automated DSR-processing functionality, including the ability to programmatically search for, retrieve, export, correct, and delete Personal Information in response to DSRs. OnPoint shall support integration with the DSR-automation tool being deployed by Fieldhaven Consulting Group LLC (engagement lead: Marcus Ellerby) as part of Cascade's broader privacy-compliance program. OnPoint shall provide application programming interfaces (APIs) and technical documentation sufficient to enable seamless integration between the CMP and Fieldhaven's DSR-automation platform, and shall cooperate with Fieldhaven and Cascade's internal technology teams as reasonably necessary to complete integration testing and deployment.
11.4 Global Privacy Control (GPC).
OnPoint's CMP shall recognize and honor Global Privacy Control ("GPC") signals transmitted by Consumer browsers and devices as a valid opt-out-of-Sale/Sharing mechanism under the CCPA/CPRA (in accordance with California Civil Code Section 1798.135(b) and the implementing regulations promulgated by the California Privacy Protection Agency) and equivalent universal opt-out mechanisms recognized under other Applicable Privacy Laws, including but not limited to the Colorado CPA, CTDPA, TDPSA, Montana MCDPA, and OCPA. OnPoint shall configure the CMP to detect GPC signals in real time and apply the corresponding consent-preference settings automatically, without requiring additional Consumer action.
11.5 Appeal Process.
OnPoint shall support Cascade's implementation of consumer-appeal processes required under the VCDPA, Colorado CPA, CTDPA, and other Applicable Privacy Laws that provide Consumers with the right to appeal a denial of a DSR. OnPoint shall configure the CMP interface to include a clearly accessible mechanism for Consumers to submit appeals and shall maintain records of all appeals processed through the CMP for a period of at least twenty-four (24) months. OnPoint shall provide Cascade with reporting on appeal volumes, outcomes, and response times on a quarterly basis.
SECTION 12: DELETION AND RETURN OF PERSONAL INFORMATION
12.1 Upon Termination or Expiration.
Upon expiration or termination of the Underlying Agreement or this Addendum (for any reason), OnPoint shall, at Cascade's sole election and upon written instruction from Cascade:
(a) securely delete all Personal Information in OnPoint's possession, custody, or control (including all copies, backups, archives, and replications), using methods that render the data permanently unrecoverable, such as cryptographic erasure or physical destruction of storage media; or
(b) return all Personal Information to Cascade in a commercially standard, machine-readable, structured format (such as CSV, JSON, or XML), via a secure transfer mechanism agreed upon by the parties.
Cascade shall communicate its election to OnPoint in writing within thirty (30) calendar days following the expiration or termination of the Underlying Agreement. If Cascade does not communicate its election within such period, OnPoint shall securely delete all Personal Information in accordance with Section 12.1(a).
12.2 Certification of Deletion.
If Cascade elects deletion pursuant to Section 12.1(a), OnPoint shall complete the deletion process within thirty (30) calendar days of receiving Cascade's written instruction and shall provide Cascade with a written certification of deletion within thirty (30) calendar days of completing the deletion process. The certification shall:
(a) confirm that all Personal Information, including all copies, backups, archives, and replications, has been permanently and securely deleted;
(b) describe the deletion methods used;
(c) identify the date(s) on which deletion was completed; and
(d) be signed by an authorized officer of OnPoint (at the level of Vice President or above).
12.3 Retention Exceptions.
Notwithstanding Sections 12.1 and 12.2, OnPoint may retain Personal Information only to the extent strictly required by applicable federal, state, or local law (including tax, financial-reporting, or legal-hold obligations), provided that OnPoint:
(a) promptly notifies Cascade in writing of the specific legal basis for such retention, including a citation to the relevant legal authority and the anticipated duration of the retention obligation;
(b) limits Processing of the retained Personal Information strictly to the purposes required by such law and does not use or disclose such information for any other purpose; and
(c) securely deletes the retained Personal Information as soon as the applicable retention obligation expires, and provides Cascade with written certification of such deletion in accordance with Section 12.2.
12.4 Sub-processor Deletion.
OnPoint shall ensure that all Sub-processors engaged pursuant to Section 7 of this Addendum also delete or return Personal Information in accordance with the terms of this Section 12. OnPoint shall include deletion and return obligations consistent with this Section 12 in each Sub-processor agreement entered into pursuant to Section 7.4, and shall obtain and provide to Cascade written certifications of deletion from each Sub-processor upon completion of the deletion process.
SECTION 13: AUDIT RIGHTS
13.1 Right to Audit.
Cascade, or its authorized representative (which may include Calderwood & Harkness LLP, Lakemont Audit Partners LLP, or any other qualified third-party auditor designated by Cascade), shall have the right to conduct audits of OnPoint's Processing activities, systems, facilities, and records to verify compliance with this Addendum, the Underlying Agreement, and Applicable Privacy Laws. Audits may include on-site inspections of OnPoint's facilities and data centers, review of documentation and records, interviews with OnPoint personnel, and technical testing of OnPoint's systems and security controls, to the extent reasonably related to OnPoint's obligations under this Addendum.