1038-00010 · Cascade Retail Holdings · Contracts & Vendor Management

thornbridge-data-sharing-agreement.docx DOCUMENT Finance & Banking

15 / 38 ← → ✕

Contract analysis Extract to table

DATA-SHARING AGREEMENT

by and between

CASCADE RETAIL HOLDINGS INC.

a Delaware corporation

("Cascade" or "Data Sharer")

and

THORNBRIDGE MEDIA CORP.

a Nevada corporation

("Thornbridge" or "Data Recipient")

Effective Date: October 31, 2025

This Agreement restructures and supersedes the prior data-sharing arrangement between the parties relating to programmatic advertising and audience-targeting services.

CONFIDENTIAL TREATMENT REQUESTED — This document contains confidential business, financial, and technical information of the parties. Distribution is restricted to authorized representatives and legal counsel of Cascade Retail Holdings Inc. and Thornbridge Media Corp.

Right-click to update Table of Contents

RECITALS

WHEREAS, Cascade Retail Holdings Inc. ("Cascade") is a publicly traded omnichannel retailer and e-commerce platform listed on the Nasdaq Global Select Market under the ticker symbol "CSRD," headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and operates one hundred eighty-six (186) retail locations across thirty-one (31) U.S. states, processes approximately ninety-four (94) million annual online transactions through its e-commerce platform, and maintains approximately forty-one point two (41.2) million registered members of its Cascade Rewards loyalty program;

WHEREAS, Cascade, directly and through its wholly owned subsidiary Peakview Analytics Inc., a Delaware corporation ("Peakview"), collects and processes consumer behavioral data, including approximately two point one (2.1) billion consumer-event data records per month, for the purposes of advertising personalization, audience targeting, campaign measurement, and related analytics;

WHEREAS, Thornbridge Media Corp. ("Thornbridge") is a programmatic-advertising and audience-targeting company headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117, and serves as Cascade's primary programmatic-advertising and audience-targeting partner for the delivery of cross-channel advertising campaigns, audience-segment creation, and campaign attribution services;

WHEREAS, in Cascade's fiscal year ending January 31, 2025 ("FY2024"), Cascade spent approximately eighteen point four million dollars ($18,400,000) with Thornbridge for programmatic-advertising and audience-targeting services under the parties' prior data-sharing and advertising services arrangement;

WHEREAS, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), codified at California Civil Code Sections 1798.100 through 1798.199.100, and an expanding number of comprehensive U.S. state privacy statutes — currently encompassing nineteen (19) applicable jurisdictions — impose significant requirements on the sale, sharing, and processing of consumer personal information, including requirements related to consumer notice, consent, opt-out rights, data minimization, and contractual obligations between businesses, service providers, contractors, and third parties;

WHEREAS, Cascade has engaged Calderwood & Harkness LLP ("Calderwood & Harkness"), with offices at 600 Lexington Avenue, 28th Floor, New York, New York 10022 (Kevin Ostrowski, lead partner), as outside privacy counsel to design and implement a comprehensive U.S. state-privacy compliance program addressing Cascade's obligations as a business under the CCPA/CPRA and as a controller under analogous state privacy statutes, and Cascade has determined, in consultation with Calderwood & Harkness, that the prior data-sharing arrangement between the parties must be restructured to comply with applicable law;

WHEREAS, Thornbridge is represented in connection with this Agreement by Kellner Park & Associates LLP (Victor Sandoval, lead attorney; 555 Mission Street, 32nd Floor, San Francisco, California 94105) and its General Counsel, Leah Voss;

WHEREAS, the parties desire to enter into this Agreement to set forth the terms and conditions under which Cascade will share certain consumer personal information with Thornbridge for the limited purposes described herein, in compliance with the CCPA/CPRA and all other applicable U.S. state privacy laws, and to establish the parties' respective rights, obligations, and responsibilities with respect to the protection, use, and processing of such consumer personal information; and

NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:

ARTICLE 1: DEFINITIONS

Section 1.1 — Defined Terms

As used in this Agreement, the following capitalized terms shall have the meanings set forth below:

(a) "Applicable Privacy Laws" means the CCPA/CPRA (Cal. Civ. Code §§ 1798.100–1798.199.100) and all other U.S. state comprehensive privacy statutes applicable to either party's processing activities under or in connection with this Agreement, including without limitation: the Virginia Consumer Data Protection Act ("VCDPA"), Va. Code Ann. §§ 59.1-575 through 59.1-585; the Colorado Privacy Act ("CPA"), Colo. Rev. Stat. §§ 6-1-1301 through 6-1-1313; the Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 through 42-525; the Utah Consumer Privacy Act ("UCPA"), Utah Code Ann. §§ 13-61-101 through 13-61-404; the Iowa Consumer Data Protection Act ("ICDPA"), Iowa Code ch. 715D; the Indiana Consumer Data Protection Act ("INCDPA"), Ind. Code §§ 24-15-1-1 through 24-15-9-3; the Tennessee Information Protection Act ("TIPA"), Tenn. Code Ann. §§ 47-18-3201 through 47-18-3213; the Montana Consumer Data Privacy Act ("MCDPA"), Mont. Code Ann. §§ 30-14-2801 through 30-14-2817; the Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code §§ 541.001 through 541.205; the Oregon Consumer Privacy Act ("OCPA"), Or. Rev. Stat. §§ 646A.570 through 646A.597; the Delaware Personal Data Privacy Act ("DPDPA"), Del. Code Ann. tit. 6, ch. 12D; the New Jersey Data Privacy Act ("NJDPA"), N.J. Stat. Ann. §§ 56:8-166 through 56:8-189; the New Hampshire Data Privacy Act ("NHDPA"); the Nebraska Data Privacy Act ("NDPA"); the Minnesota Consumer Data Privacy Act; the Maryland Online Data Privacy Act ("MODPA"); the Kentucky Data Privacy Act ("KYDPA"); and any amendments, implementing regulations, or successor statutes to any of the foregoing.

(b) "Business Purpose" means a purpose as defined in California Civil Code Section 1798.140(e) and analogous provisions of other Applicable Privacy Laws, including auditing related to counting ad impressions, verifying positioning and quality of ad impressions, and auditing compliance; detecting security incidents; debugging to identify and repair errors; performing services on behalf of a business, including account maintenance and customer service; and undertaking internal research for technological development and demonstration.

(c) "Cascade Digital Marketplace" means Cascade Digital Marketplace LLC, a Delaware limited liability company and wholly owned subsidiary of Cascade, which operates Cascade's third-party seller marketplace platform.

(d) "Cascade Rewards" means the Cascade Rewards loyalty program operated by Cascade Rewards Corp., a Delaware corporation and wholly owned subsidiary of Cascade, which maintains approximately forty-one point two (41.2) million registered members as of the Effective Date.

(e) "Consumer" means a natural person who is a resident of a U.S. state with an Applicable Privacy Law, including without limitation Cascade customers, website visitors to cascade.com, users of the Cascade mobile application, in-store shoppers, and registered members of the Cascade Rewards loyalty program, in each case to the extent such natural person qualifies as a "consumer," "resident," or analogous term under the relevant Applicable Privacy Law.

(f) "Consumer Personal Information" or "CPI" means personal information (as defined in Cal. Civ. Code § 1798.140(v)) or personal data (as defined in analogous Applicable Privacy Laws) relating to Consumers that Cascade shares with Thornbridge under this Agreement, limited to the categories described in Section 3.1 and Exhibit A.

(g) "Controller" means the natural or legal person that, alone or jointly with others, determines the purposes and means of processing personal data, as defined in the VCDPA, CPA, CTDPA, and analogous Applicable Privacy Laws. For purposes of this Agreement, both Cascade and Thornbridge act as independent controllers with respect to Consumer Personal Information, except as otherwise expressly specified herein.

(h) "Data Subject Request" or "DSR" means any request from a Consumer to exercise rights available to the Consumer under Applicable Privacy Laws, including without limitation rights of access, deletion, correction, opt-out, data portability, and appeal.

(i) "Global Privacy Control" or "GPC" means a user-enabled browser-level or device-level signal conforming to the Global Privacy Control specification (as published at globalprivacycontrol.org or any successor specification) that communicates a Consumer's preference to opt out of the sale or sharing of their personal information.

(j) "Opt-Out Signal" means any Consumer-initiated opt-out request transmitted via a GPC signal, a "Do Not Sell or Share My Personal Information" link or similar mechanism on Cascade's website or mobile application, a written or electronic request submitted through Cascade's Consumer privacy-request portal, or any equivalent mechanism mandated by Applicable Privacy Laws.

(k) "Peakview" means Peakview Analytics Inc., a Delaware corporation and wholly owned subsidiary of Cascade, which processes consumer behavioral data for advertising personalization and audience-targeting purposes.

(l) "Permitted Purposes" has the meaning set forth in Section 4.1 of this Agreement.

(m) "Processor" means a natural or legal entity that processes personal data on behalf of a controller, as defined in the VCDPA, CPA, CTDPA, and analogous Applicable Privacy Laws.

(n) "Sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by a business to a third party for monetary or other valuable consideration, as defined in California Civil Code Section 1798.140(ad) and analogous provisions of other Applicable Privacy Laws.

(o) "Security Incident" means any confirmed or reasonably suspected unauthorized access, acquisition, use, disclosure, alteration, destruction, or loss of Consumer Personal Information in Thornbridge's possession or control, or in the possession or control of Thornbridge's sub-processors.

(p) "Sensitive Personal Information" means personal information that reveals a Consumer's Social Security number, driver's license number, state identification card number, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; contents of mail, email, or text messages (unless the business is the intended recipient); genetic data; biometric information; health information; or sex life or sexual orientation, as defined in California Civil Code Section 1798.140(ae) and analogous provisions of other Applicable Privacy Laws. For the avoidance of doubt, Sensitive Personal Information includes precise geolocation data collected via the Cascade mobile application, payment-card data, and account login credentials.

(q) "Service Provider" means a person that processes personal information on behalf of a business and to which the business discloses a Consumer's personal information for a business purpose pursuant to a written contract, as defined in California Civil Code Section 1798.140(ag) and analogous provisions of other Applicable Privacy Laws.

(r) "Sharing" means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by a business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged, as defined in California Civil Code Section 1798.140(ah).

(s) "Third Party" means a person who is not the business that collects personal information from Consumers, a person to whom the business discloses a Consumer's personal information for a business purpose pursuant to a written contract as required under the CCPA/CPRA, or a person who is an employee or independent contractor of the business, as defined in California Civil Code Section 1798.140(ai) and analogous provisions of other Applicable Privacy Laws.

Section 1.2 — Interpretation

(a) All references in this Agreement to statutory sections, subsections, or provisions shall include all amendments, implementing regulations, formal guidance, and advisory opinions effective as of the date of the relevant obligation. Where an Applicable Privacy Law is enacted or amended after the Effective Date and imposes new or modified obligations relevant to the subject matter of this Agreement, the parties shall cooperate in good faith to amend this Agreement as necessary to comply with such new or modified obligations in accordance with Section 19.5.

(b) Headings and section titles used in this Agreement are for convenience of reference only and shall not affect the interpretation or construction of any provision of this Agreement.

(c) The words "include," "includes," and "including" shall be deemed to be followed by the phrase "without limitation" regardless of whether such phrase appears in the applicable provision.

(d) References to "days" shall mean calendar days unless "business days" are expressly specified. "Business days" means days other than Saturdays, Sundays, and federal holidays observed in the United States.

(e) References to a "party" mean Cascade or Thornbridge, as applicable, and references to "parties" mean both Cascade and Thornbridge.

ARTICLE 2: CLASSIFICATION OF DATA-SHARING RELATIONSHIP

Section 2.1 — CCPA/CPRA Classification

The parties acknowledge and agree that the transfer of Consumer Personal Information from Cascade to Thornbridge for programmatic advertising and audience targeting constitutes "sharing" for cross-context behavioral advertising within the meaning of California Civil Code Section 1798.140(ah). The parties further acknowledge that such transfer may constitute a "sale" within the meaning of California Civil Code Section 1798.140(ad) under the CCPA/CPRA and under certain other Applicable Privacy Laws, depending on the nature and circumstances of the transfer and the applicable statutory definitions. As a result, Thornbridge is a "Third Party" under the CCPA/CPRA with respect to Consumer Personal Information received from Cascade under this Agreement. For the avoidance of doubt, and notwithstanding any other arrangement between the parties, Thornbridge does not act as a "Service Provider" (as defined in Cal. Civ. Code § 1798.140(ag)) or as a "Contractor" (as defined in Cal. Civ. Code § 1798.140(j)) under the CCPA/CPRA for purposes of processing Consumer Personal Information under this Agreement. The parties have structured this Agreement to reflect the applicable legal classification and to ensure that both parties comply with their respective obligations under the CCPA/CPRA as a "business" (in the case of Cascade) and as a "Third Party" (in the case of Thornbridge).

Section 2.2 — Classification Under Other State Laws

Under the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and analogous comprehensive state privacy statutes enumerated in the definition of Applicable Privacy Laws, both Cascade and Thornbridge operate as independent "controllers" with respect to Consumer Personal Information shared under this Agreement. Each party independently determines the purposes and means of its own processing of Consumer Personal Information and is independently responsible for compliance with all controller obligations imposed by all Applicable Privacy Laws. Neither party acts as the other's "processor" under this Agreement. Thornbridge acknowledges that its receipt of Consumer Personal Information from Cascade creates independent controller obligations for Thornbridge under each applicable state privacy statute, including without limitation obligations related to transparency, data minimization, purpose limitation, data security, consumer rights facilitation, and data protection assessments where required.

Section 2.3 — No Joint Controller Relationship

Nothing in this Agreement shall be construed to create a joint controller, joint venture, partnership, or agency relationship between Cascade and Thornbridge. Each party shall be solely responsible for its own compliance with Applicable Privacy Laws in its capacity as an independent controller. Neither party shall have the authority to bind the other or to make representations on behalf of the other to Consumers, regulators, or any third party, except as expressly set forth in this Agreement.

ARTICLE 3: SCOPE OF DATA SHARING

Section 3.1 — Categories of Consumer Personal Information Shared

Cascade shall share with Thornbridge the following categories of Consumer Personal Information, as further described in Exhibit A (Description of Data Sharing):

(a) Identifiers. Hashed email addresses, device identifiers (including mobile advertising identifiers such as IDFAs and GAIDs), cookie identifiers, advertising IDs, IP addresses (truncated to the first three octets where technically feasible), and internal Cascade customer identifiers that have been pseudonymized or de-identified to the extent reasonably practicable.

(b) Commercial Information. Records of purchases made through cascade.com, the Cascade mobile application, and in-store point-of-sale systems; product interests and preferences inferred from browsing and purchase behavior; shopping cart contents and abandonment data; and product category affinities.

(c) Internet and Electronic Network Activity Information. Clickstream data, session data, referring and exit URLs, page-view sequences, time-on-page metrics, search queries entered on cascade.com, and interaction data from Cascade's digital advertising placements.

(d) Inferences Drawn from the Foregoing Categories. Consumer profiles, propensity scores, audience segments, predicted purchase likelihood scores, and other inferences generated by Cascade or Peakview from the data categories described in subsections (a) through (c) above for the purpose of advertising personalization.

The foregoing categories represent the exclusive categories of Consumer Personal Information that Cascade is authorized to share under this Agreement. Any expansion of these categories shall require a written amendment to this Agreement executed by both parties in accordance with Section 19.5.

Section 3.2 — Exclusion of Sensitive Personal Information

Cascade shall not share Sensitive Personal Information with Thornbridge under this Agreement. Without limiting the generality of the foregoing, the following categories of data are expressly excluded from the scope of data sharing under this Agreement:

(a) Precise geolocation data collected via the Cascade mobile application or any other Cascade system or service;

(b) Payment-card data, including credit card numbers, debit card numbers, bank account numbers, and associated security codes, PINs, or authentication credentials;

(c) Account login credentials, including usernames, passwords, and security questions and answers for Cascade Rewards accounts, cascade.com accounts, and Cascade mobile-application accounts;

(d) Any other categories of data that constitute Sensitive Personal Information under any Applicable Privacy Law.

If Thornbridge discovers or has reason to believe that it has received Sensitive Personal Information from Cascade in error, whether through a data-transmission error, misconfiguration, or any other cause, Thornbridge shall (i) promptly notify Cascade's designated privacy contact (Diana Polk, Associate General Counsel) within twenty-four (24) hours of discovery, (ii) immediately cease all processing of such Sensitive Personal Information, and (iii) securely delete all copies of such Sensitive Personal Information from Thornbridge's systems, including any backups, archives, or derivative data sets, within five (5) business days of discovery. Thornbridge shall provide written certification to Cascade confirming the completion of such deletion.

Section 3.3 — Sources of Consumer Personal Information

Consumer Personal Information shared under this Agreement is collected by Cascade through the following sources:

(a) cascade.com — Cascade's primary e-commerce website, including all subdomains and microsites;

(b) Cascade Mobile Application — The Cascade mobile shopping and loyalty-program application available on iOS and Android platforms;

(c) In-Store Point-of-Sale Systems — Transaction data collected through Cascade's one hundred eighty-six (186) retail locations across thirty-one (31) U.S. states, linked to Cascade Rewards loyalty-program membership where the Consumer has enrolled;

(d) Cascade Rewards Loyalty Program — Data collected through membership registration, transaction history, preference data, and engagement data maintained by Cascade Rewards Corp.

Certain Consumer Personal Information is processed and generated by Peakview Analytics Inc. for advertising personalization purposes, including the generation of audience segments, propensity scores, and other inferences described in Section 3.1(d), prior to transfer to Thornbridge. Consumer Personal Information originating from Cascade Digital Marketplace LLC's network of approximately three thousand eight hundred (3,800) third-party sellers shall not be shared with Thornbridge under this Agreement absent separate written authorization executed by an authorized representative of Cascade Digital Marketplace LLC and Cascade.

Section 3.4 — Volume and Method of Transmission

Consumer Personal Information shall be transmitted from Cascade to Thornbridge via secure, encrypted API integration or encrypted Secure File Transfer Protocol ("SFTP"), as specified in Exhibit B (Technical Specifications). The parties acknowledge that the volumes of Consumer Personal Information shared under this Agreement are substantial, reflecting Cascade's approximately ninety-four (94) million annual online transactions and Peakview's processing of approximately two point one (2.1) billion consumer-event data records per month. Data shall be transmitted in both daily batch files and real-time API calls, as further specified in Exhibit B. Thornbridge shall maintain sufficient system capacity, bandwidth, and processing infrastructure to receive and process the anticipated data volumes without degradation of performance or compromise of security.

ARTICLE 4: PERMITTED PURPOSES AND USE LIMITATIONS

Section 4.1 — Permitted Purposes

Thornbridge may process Consumer Personal Information received from Cascade solely for the following limited and specified purposes (collectively, the "Permitted Purposes"):

(a) Programmatic-Advertising Campaign Delivery. The delivery of programmatic-advertising campaigns on behalf of Cascade across Thornbridge's network of demand-side platforms, supply-side platforms, ad exchanges, and publisher inventory, in accordance with Cascade's campaign objectives, budgets, and instructions;

(b) Audience-Segment Creation and Targeting. The creation, maintenance, and activation of audience segments derived from Consumer Personal Information for the purpose of targeting advertising to Consumers on behalf of Cascade in connection with Cascade advertising campaigns;

(c) Campaign Measurement, Attribution, and Reporting. The measurement of advertising campaign performance, including impression delivery, click-through rates, conversion tracking, multi-touch attribution analysis, and the preparation and delivery of campaign performance reports to Cascade; and

(d) Frequency Capping. The implementation of frequency-capping controls across advertising channels to manage the number of times individual Consumers are exposed to specific Cascade advertising creatives within defined time periods.

Thornbridge shall not process Consumer Personal Information for any purpose other than the Permitted Purposes without the prior written consent of Cascade. Any request by Thornbridge to expand the Permitted Purposes shall be submitted in writing to Cascade's designated privacy contact and shall not take effect unless and until Cascade has provided written approval and the parties have executed a written amendment to this Agreement.

Section 4.2 — Prohibited Uses

Thornbridge shall not, under any circumstances:

(a) Sell Consumer Personal Information. Sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Consumer Personal Information to any other person or entity for monetary or other valuable consideration;

(b) Share for Unrelated Cross-Context Behavioral Advertising. Share Consumer Personal Information for cross-context behavioral advertising purposes that are unrelated to the Permitted Purposes, including without limitation using Consumer Personal Information to target advertising for any person or entity other than Cascade;

(c) Combine with Other Data Sources. Combine, merge, or commingle Consumer Personal Information with personal information obtained from other sources, including Thornbridge's own proprietary data assets, data obtained from Thornbridge's other clients, or data obtained from third-party data brokers or data aggregators, except as strictly necessary to perform the Permitted Purposes on behalf of Cascade and as expressly authorized under this Agreement;

(d) Use for Independent Commercial Purposes. Use Consumer Personal Information for Thornbridge's own independent commercial purposes, including without limitation building, augmenting, enriching, or enhancing Thornbridge's proprietary consumer profiles, data products, audience segments, or lookalike models for use by Thornbridge's other clients or for Thornbridge's own marketing activities;

(e) Retain Beyond Permitted Periods. Retain Consumer Personal Information longer than reasonably necessary for the Permitted Purposes, and in no event longer than the retention periods set forth in Exhibit C (Data Retention Schedule) or the maximum retention period specified in Section 11.1 of this Agreement.

Any breach of the restrictions set forth in this Section 4.2 shall be deemed a material breach of this Agreement entitling Cascade to terminate this Agreement immediately without the cure period otherwise provided in Section 17.2.

Section 4.3 — Data Minimization

Thornbridge shall adhere to the principle of data minimization in all processing of Consumer Personal Information under this Agreement. Specifically, Thornbridge shall process only the minimum categories and volume of Consumer Personal Information that are reasonably necessary to accomplish the Permitted Purposes. Thornbridge shall not request or collect additional categories of Consumer Personal Information beyond those enumerated in Section 3.1 and Exhibit A without prior written consent from Cascade. Thornbridge shall periodically review its data-processing activities to ensure that its use of Consumer Personal Information remains proportionate to the Permitted Purposes and shall promptly notify Cascade if Thornbridge determines that certain categories or volumes of Consumer Personal Information are no longer necessary for the Permitted Purposes, so that the parties may adjust the scope of data sharing accordingly.

ARTICLE 5: OPT-OUT OF SALE/SHARING COMPLIANCE

Section 5.1 — Obligation to Honor Opt-Out signals

Cascade shall transmit Consumer Opt-Out signals to Thornbridge in real time, or as near to real time as is technically practicable given the parties' system architectures and integration protocols, but in no event later than twenty-four (24) hours after Cascade's receipt or detection of such Opt-Out Signal, via the mechanism specified in Exhibit B (Technical Specifications). Upon receipt of an Opt-Out Signal, whether transmitted via a Global Privacy Control signal, a "Do Not Sell or Share My Personal Information" link interaction, a Consumer privacy-request portal submission, or any other mechanism mandated by Applicable Privacy Laws, Thornbridge shall immediately cease all processing of the applicable Consumer's Personal Information for Sale or Sharing purposes. Thornbridge acknowledges that failure to honor Opt-Out signals in a timely manner may result in regulatory liability for both parties and that prompt compliance is material to Cascade's obligations under the CCPA/CPRA and other Applicable Privacy Laws.

Section 5.2 — Global Privacy Control (GPC) Signal Honoring

Thornbridge shall honor GPC signals forwarded by Cascade as valid opt-out requests under the CCPA/CPRA and all other Applicable Privacy Laws that recognize the Global Privacy Control or universal opt-out mechanisms as legally binding consumer opt-out preferences. Thornbridge shall implement and maintain technical capabilities sufficient to process GPC signal pass-throughs in real time, including the ability to receive, interpret, and act upon GPC signals as transmitted by Cascade through the API integration described in Exhibit B. The specific technical requirements for GPC signal integration, including signal format, transmission protocol, acknowledgment response requirements, and error-handling procedures, are set forth in Exhibit B. Thornbridge shall not require any additional verification or confirmation from Cascade or the Consumer before honoring a validly transmitted GPC signal.

Section 5.3 — "Do Not Sell or Share" Suppression-List Maintenance

Thornbridge shall maintain a comprehensive suppression list of all Consumers who have exercised their right to opt out of the sale or sharing of their Consumer Personal Information (the "Suppression List"). The Suppression List shall be synchronized with Cascade's opt-out records in accordance with the synchronization protocol specified in Exhibit B. Thornbridge shall update the Suppression List within fifteen (15) business days of receiving notice from Cascade of a Consumer opt-out request processed through Cascade's DSR portal, GPC signal relay, "Do Not Sell or Share" link, or any other opt-out mechanism. Thornbridge shall not process any suppressed Consumer's Personal Information for Sale or Sharing purposes following the Consumer's inclusion on the Suppression List, unless and until the Consumer subsequently provides affirmative opt-in consent that is communicated by Cascade to Thornbridge in accordance with Section 5.4. Thornbridge shall implement technical safeguards to prevent the inadvertent processing of suppressed Consumers' data, including automated checks against the Suppression List prior to the activation of any audience segment or programmatic-advertising campaign.

Section 5.4 — Re-Opt-In Requirements

If a Consumer revokes their prior opt-out and affirmatively opts back in to the sale or sharing of their Consumer Personal Information through Cascade's consumer-facing opt-in mechanism, Cascade shall notify Thornbridge in writing (which may include electronic notification via the API integration or other agreed-upon mechanism) of such re-opt-in, including the relevant Consumer identifier. Thornbridge may resume processing the applicable Consumer's Personal Information for the Permitted Purposes only upon receipt of such notice from Cascade. Thornbridge shall not solicit, encourage, or facilitate any Consumer's decision to opt back in, whether directly or indirectly. Cascade shall maintain records of all Consumer re-opt-in consents and shall make such records available to Thornbridge upon reasonable request for compliance verification purposes.

ARTICLE 6: CONSUMER-RIGHTS ASSISTANCE

Section 6.1 — Cooperation on Consumer Requests

If Cascade receives a Data Subject Request from a Consumer under any Applicable Privacy Law — including without limitation requests for access, deletion, correction, portability, or the exercise of any other right — that requires action by Thornbridge in order for Cascade to fully respond to the request, Cascade shall promptly forward such request to Thornbridge, together with sufficient information to enable Thornbridge to identify the relevant Consumer and locate the applicable Consumer Personal Information in Thornbridge's systems. Thornbridge shall respond to and fulfill such forwarded requests within ten (10) business days of receipt from Cascade, to enable Cascade to meet its target response time of fifteen (15) business days or less and the statutory maximum response period of forty-five (45) calendar days under the CCPA/CPRA (subject to any extensions permitted by applicable law). Thornbridge shall designate a single point of contact for the receipt and processing of forwarded Consumer requests and shall provide such contact information to Cascade on or before the Effective Date.

Section 6.2 — Deletion Requests

Upon receipt of a verified deletion request forwarded by Cascade, Thornbridge shall delete all Consumer Personal Information relating to the requesting Consumer from Thornbridge's systems, including all active databases, backup systems, disaster-recovery environments, and archives, within thirty (30) calendar days of receipt of the forwarded request. Thornbridge shall confirm the completion of such deletion in writing to Cascade, specifying the date of deletion and the systems from which data was removed. Thornbridge shall direct its approved sub-processors (if any, as permitted under Article 8) to delete all Consumer Personal Information relating to the requesting Consumer within the same thirty (30) calendar-day timeframe and shall obtain written confirmation of such deletion from each affected sub-processor. To the extent that Applicable Privacy Laws provide exceptions to the deletion obligation (e.g., for data necessary to detect security incidents or to comply with a legal obligation), Thornbridge shall notify Cascade of any such exception it intends to invoke, specifying the legal basis and the data retained, before the expiration of the thirty (30) calendar-day period.

Section 6.3 — Access and Portability Requests

Upon receipt of a verified access or data-portability request forwarded by Cascade, Thornbridge shall provide to Cascade, in a structured, commonly used, and machine-readable format (such as CSV or JSON), the Consumer Personal Information that Thornbridge holds regarding the requesting Consumer, within the timeline specified in Section 6.1. Thornbridge shall ensure that the data provided is accurate, complete, and responsive to the scope of the Consumer's request. If Thornbridge is unable to identify the Consumer or locate the relevant data, Thornbridge shall promptly notify Cascade and cooperate with Cascade's efforts to fulfill the request.

Section 6.4 — Appeal-Process Cooperation

Thornbridge shall cooperate with Cascade in connection with any Consumer appeal of a denied Data Subject Request, as required under the VCDPA, CPA, CTDPA, and other Applicable Privacy Laws that provide Consumers with a right to appeal the denial of a DSR. Such cooperation shall include providing Cascade with any additional information or documentation necessary for Cascade to evaluate and respond to the appeal within the timeframe required by the applicable statute. To the extent that a Consumer appeal relates to Thornbridge's processing of Consumer Personal Information, Thornbridge shall conduct a good-faith review of its own records and systems to determine whether the original denial was warranted and shall report its findings to Cascade.

Section 6.5 — No Direct Consumer Interaction

Thornbridge shall not respond directly to any Consumer requests regarding Consumer Personal Information that Thornbridge received from Cascade under this Agreement, unless Cascade provides prior written authorization for Thornbridge to do so in a specific instance. If Thornbridge receives any such request directly from a Consumer, whether by email, telephone, postal mail, or any other means, Thornbridge shall (i) promptly redirect the Consumer to Cascade's designated privacy-request portal or contact information, (ii) refrain from providing any information to the Consumer regarding the Consumer Personal Information held by Thornbridge, and (iii) notify Cascade of such request, including all relevant details, within two (2) business days of receipt. Thornbridge shall maintain a log of all such direct Consumer contacts and shall make such log available to Cascade upon request.

ARTICLE 7: DATA SECURITY

Section 7.1 — Security Obligations

Thornbridge shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards to protect Consumer Personal Information against unauthorized access, use, disclosure, alteration, destruction, or loss, consistent with industry standards for entities processing comparable types and volumes of consumer data, and no less protective than the safeguards described in Exhibit D (Security Requirements). Thornbridge's security program shall be designed to ensure the confidentiality, integrity, and availability of Consumer Personal Information throughout the data lifecycle, from receipt through processing, storage, and eventual deletion. Thornbridge shall maintain SOC 2 Type II certification (issued by an independent, nationally recognized auditing firm) covering security, availability, and confidentiality trust service criteria, or an equivalent certification acceptable to Cascade, throughout the term of this Agreement. Thornbridge shall provide Cascade with a copy of its most recent SOC 2 Type II report within thirty (30) calendar days of the Effective Date and within thirty (30) calendar days of the issuance of each subsequent report.

Section 7.2 — Encryption Requirements

All Consumer Personal Information transmitted between Cascade and Thornbridge must be encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher. All Consumer Personal Information stored by Thornbridge must be encrypted at rest using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256) or an equivalent encryption standard approved by the National Institute of Standards and Technology (NIST). Thornbridge shall manage encryption keys in accordance with industry best practices, including the use of hardware security modules (HSMs) where appropriate, regular key rotation, and strict access controls for key-management personnel.

Section 7.3 — Access Controls

Thornbridge shall restrict access to Consumer Personal Information to authorized personnel who have a legitimate, documented need-to-know in connection with the Permitted Purposes. Thornbridge shall implement and maintain role-based access controls, multi-factor authentication for access to systems containing Consumer Personal Information, and logging of all access events. Thornbridge shall conduct periodic access reviews, no less frequently than quarterly, to ensure that access privileges remain appropriate and shall promptly revoke access for any individual whose access is no longer necessary. All Thornbridge personnel with access to Consumer Personal Information shall be subject to written confidentiality obligations and shall complete data-privacy and data-security training prior to being granted access and no less frequently than annually thereafter. The detailed security requirements applicable to Thornbridge's processing environment are set forth in Exhibit D.

ARTICLE 8: SUB-PROCESSORS AND ONWARD TRANSFERS

Section 8.1 — Restrictions on Onward Transfers

Thornbridge shall not disclose, transfer, or make available Consumer Personal Information to any sub-processor, subcontractor, affiliate, or other third party without the prior written consent of Cascade. Any request for approval of a sub-processor shall include the identity of the proposed sub-processor, a description of the processing activities to be performed, the location(s) where processing will occur, and the security measures implemented by the proposed sub-processor. Any approved sub-processor must be bound by a written agreement imposing data-protection obligations no less protective than those set forth in this Agreement, including without limitation obligations regarding purpose limitation, use restrictions, data security, breach notification, audit rights, and return or deletion of Consumer Personal Information.

Section 8.2 — List of Approved Sub-Processors

Thornbridge shall provide Cascade with a complete and current list of all sub-processors used to process Consumer Personal Information prior to the Effective Date, as set forth in Exhibit E (Approved Sub-Processors). Thornbridge shall update Exhibit E and provide written notice to Cascade at least thirty (30) calendar days before engaging any new sub-processor or making any material change to the processing activities of an existing sub-processor. Cascade shall have the right to object in writing to any new or changed sub-processor within fifteen (15) business days of receipt of Thornbridge's notification. If the parties are unable to resolve Cascade's objection through good-faith negotiation within thirty (30) calendar days of Cascade's written objection, Cascade may terminate this Agreement with respect to the affected processing activities, or, at Cascade's election, terminate this Agreement in its entirety, upon written notice to Thornbridge.

Section 8.3 — Liability for Sub-Processors

Thornbridge shall remain fully liable to Cascade for the acts, omissions, errors, and failures of its sub-processors with respect to Consumer Personal Information as if such acts, omissions, errors, and failures were those of Thornbridge itself. Thornbridge's engagement of an approved sub-processor shall not relieve Thornbridge of any obligation under this Agreement, and Thornbridge shall be responsible for ensuring that each sub-processor complies with all applicable terms and conditions of this Agreement.

ARTICLE 9: BREACH NOTIFICATION

Section 9.1 — Notification Obligation

Thornbridge shall notify Cascade in writing of any confirmed or reasonably suspected Security Incident without unreasonable delay and in no event later than forty-eight (48) hours after Thornbridge's discovery of such Security Incident. Discovery shall be deemed to occur at the time at which Thornbridge becomes aware of facts sufficient to constitute a reasonable belief that a Security Incident has occurred, regardless of whether a formal investigation has been completed. Notification shall be directed to Cascade's designated privacy contact (Diana Polk, Associate General Counsel) and to Cascade's General Counsel (Meredith Tanaka) via the contact information specified in Section 19.3, with a simultaneous copy to Calderwood & Harkness LLP (Kevin Ostrowski).

Section 9.2 — Content of Notification

The initial notification provided under Section 9.1 shall include, to the extent known or reasonably determinable at the time of notification:

(a) The nature and scope of the Security Incident, including a description of the circumstances leading to the incident;

(b) The categories and approximate number of affected Consumers;

(d) The likely consequences of the Security Incident for affected Consumers and for Cascade;

(e) The measures taken or proposed to be taken by Thornbridge to contain, mitigate, and remediate the Security Incident and to prevent recurrence; and

(f) The name, title, telephone number, and email address of a designated point of contact at Thornbridge who is knowledgeable about the Security Incident and authorized to coordinate with Cascade.

If complete information is not available at the time of the initial notification, Thornbridge shall provide the information in phases without unreasonable delay as additional information becomes available, and shall provide regular written updates to Cascade at least every twenty-four (24) hours until the Security Incident has been fully contained and investigated.

Section 9.3 — Cooperation

Thornbridge shall cooperate fully with Cascade's investigation and response to any Security Incident, including providing information, documentation, system logs, forensic analysis results, and access to Thornbridge's systems, facilities, and personnel as reasonably requested by Cascade or its counsel, including Calderwood & Harkness LLP. Thornbridge shall coordinate with Cascade before making any public statements, press releases, customer notifications, or regulatory notifications regarding a Security Incident involving Consumer Personal Information received from Cascade under this Agreement. Cascade shall have the right to review and approve all such communications prior to their dissemination, and Thornbridge shall incorporate Cascade's reasonable comments and revisions. Nothing in this Section 9.3 shall be construed to delay Thornbridge's compliance with any mandatory breach-notification requirements under applicable law; however, Thornbridge shall provide Cascade with advance notice of any such mandatory notification to the maximum extent permitted by law.

Section 9.4 — Remediation

Thornbridge shall promptly take all reasonable steps to contain, investigate, and remediate any Security Incident, to mitigate the effects of the Security Incident on affected Consumers and on Cascade, and to prevent recurrence of similar incidents. Thornbridge shall, within thirty (30) calendar days of the conclusion of its investigation, provide Cascade with a written root-cause analysis and a remediation plan identifying the corrective actions taken or to be taken, including timelines for implementation. Cascade shall have the right to review the remediation plan and to require reasonable modifications to address identified deficiencies.

ARTICLE 10: AUDIT RIGHTS

Section 10.1 — Cascade Audit Right

Cascade, or a qualified independent third-party auditor designated by Cascade and subject to appropriate confidentiality obligations, shall have the right to audit Thornbridge's compliance with this Agreement no more than two (2) times per calendar year, upon at least thirty (30) calendar days' prior written notice to Thornbridge. Audits may include inspection of Thornbridge's processing facilities, information-technology systems, data-security infrastructure, policies, procedures, training records, access logs, and other records relevant to the processing of Consumer Personal Information under this Agreement. Audits shall be conducted during Thornbridge's normal business hours and shall be designed to minimize disruption to Thornbridge's operations. Thornbridge shall provide reasonable cooperation and access during any audit, including making relevant personnel available for interviews and providing requested documentation in a timely manner. If Cascade identifies specific compliance concerns that require investigation outside the scope of a scheduled audit, Cascade may request an additional targeted review upon reasonable written notice, and Thornbridge shall not unreasonably withhold its cooperation.

Section 10.2 — Costs

Each party shall bear its own costs and expenses incurred in connection with an audit conducted under this Article 10. Provided, however, that if an audit reveals a material breach of this Agreement by Thornbridge, including without limitation a failure to comply with the use restrictions set forth in Article 4, the opt-out compliance requirements set forth in Article 5, or the security obligations set forth in Article 7, Thornbridge shall reimburse Cascade for the reasonable and documented costs of such audit, including auditor fees, travel expenses, and related costs, within thirty (30) calendar days of Cascade's written demand accompanied by supporting documentation.

Section 10.3 — Confidentiality of Audit Results

The findings, reports, and results of any audit conducted under this Article 10 shall be treated as Confidential Information of both parties and shall be subject to the confidentiality obligations set forth in Article 16. Audit results shall not be disclosed to any third party except (a) as required by law, regulation, or valid legal process, (b) to the auditing party's legal counsel, (c) to regulatory authorities in connection with a regulatory inquiry or investigation as described in Section 10.4, or (d) with the prior written consent of the other party.

Section 10.4 — Regulatory Audit Cooperation

Thornbridge shall cooperate fully with any audit, investigation, examination, or inquiry by a governmental authority, including without limitation the Federal Trade Commission, the California Attorney General, or any state attorney general, relating to Consumer Personal Information shared under this Agreement or to Thornbridge's processing of such data. Thornbridge shall promptly notify Cascade, in writing, of any such audit, investigation, examination, or inquiry within three (3) business days of receiving notice thereof, unless prohibited from doing so by law or by the terms of the governmental authority's request. Thornbridge shall coordinate with Cascade and, where appropriate, with Cascade's outside counsel (Calderwood & Harkness LLP) in preparing responses to any such governmental authority, and shall not make any admissions, commitments, or representations to any governmental authority regarding Consumer Personal Information received from Cascade without first consulting with Cascade, except where compliance with a lawful demand requires immediate response.

ARTICLE 11: DATA RETENTION AND RETURN/DELETION

Section 11.1 — Retention Limitations

Thornbridge shall retain Consumer Personal Information only for as long as reasonably necessary to accomplish the Permitted Purposes specified in Section 4.1 and in accordance with the specific retention periods set forth in Exhibit C (Data Retention Schedule). In no event shall Thornbridge retain Consumer Personal Information for longer than eighteen (18) months from the date of receipt from Cascade, unless a shorter retention period is required by Applicable Privacy Laws or is specified in Exhibit C for particular categories of data. Thornbridge shall implement automated data-lifecycle management processes to ensure that Consumer Personal Information is securely deleted or de-identified upon the expiration of the applicable retention period, and shall maintain records of such deletions sufficient to demonstrate compliance with this Section 11.1 upon audit.

Section 11.2 — Return or Deletion Upon Termination

Upon termination or expiration of this Agreement for any reason, Thornbridge shall, at Cascade's election (to be communicated in writing within fifteen (15) calendar days of the date of termination or expiration), either (a) return all Consumer Personal Information in Thornbridge's possession or control to Cascade in a structured, commonly used, and machine-readable format, or (b) securely delete all Consumer Personal Information from Thornbridge's systems, including all active databases, backup systems, disaster-recovery environments, staging environments, and archives, within thirty (30) calendar days of receiving Cascade's election. If Cascade fails to communicate its election within the fifteen (15) calendar-day period, Thornbridge shall securely delete all Consumer Personal Information as described in clause (b). Thornbridge shall certify such return or deletion in writing, signed by an authorized officer or the General Counsel of Thornbridge, within five (5) business days of completion. Thornbridge shall direct its approved sub-processors to return or delete Consumer Personal Information within the same thirty (30) calendar-day timeframe and shall obtain and forward to Cascade written certifications of such return or deletion from each affected sub-processor.

Section 11.3 — Survival of Deletion Obligations

Thornbridge's obligations under this Article 11 and the Consumer's deletion rights facilitated under Section 6.2 shall survive the termination or expiration of this Agreement and shall continue in full force and effect until all Consumer Personal Information in Thornbridge's possession or control has been returned to Cascade or securely deleted in accordance with this Article 11.

ARTICLE 12: PRIVACY NOTICES AND DISCLOSURES

Section 12.1 — Cascade's Notice Obligations

Cascade shall be responsible for providing Consumers with all notices and disclosures required by Applicable Privacy Laws in connection with the data-sharing activities contemplated by this Agreement. Without limiting the generality of the foregoing, Cascade shall ensure that its consumer-facing privacy notices include disclosure that Consumer Personal Information may be "shared" or "sold" to Thornbridge, or to a category of recipients that accurately encompasses Thornbridge (such as "advertising and marketing partners" or "programmatic-advertising companies"), for cross-context behavioral advertising purposes. Cascade represents and warrants that its omnibus privacy policy (published at cascade.com/privacy), its California-specific disclosures addendum (published at cascade.com/california-privacy), and its cookie and tracking-technology notice (published at cascade.com/cookies) will, as of the Effective Date and at all times during the term of this Agreement, disclose the sharing of Consumer Personal Information with Thornbridge or such category of recipients in accordance with all Applicable Privacy Laws, including the CCPA/CPRA's requirements for at-collection notices, privacy-policy disclosures, and "Do Not Sell or Share My Personal Information" links. Cascade shall promptly notify Thornbridge of any material changes to its privacy notices that affect the scope or lawfulness of the data sharing contemplated by this Agreement.

Section 12.2 — Thornbridge's Notice Obligations

Thornbridge shall maintain its own privacy policy that accurately describes Thornbridge's processing of Consumer Personal Information received from third parties, including Cascade, and shall comply with all transparency requirements under Applicable Privacy Laws applicable to Thornbridge in its capacity as an independent controller. Thornbridge's privacy policy shall, at a minimum, disclose the categories of personal information Thornbridge collects and processes, the purposes for which such information is used, the categories of third parties with whom Thornbridge shares personal information, and the rights available to consumers under Applicable Privacy Laws. Thornbridge shall ensure that its privacy policy is accessible to the public and is updated as necessary to reflect changes in Thornbridge's data-processing practices or in Applicable Privacy Laws.

ARTICLE 13: REPRESENTATIONS AND WARRANTIES

Section 13.1 — Mutual Representations

Each party represents and warrants to the other party that, as of the Effective Date and throughout the term of this Agreement:

(a) It is duly organized, validly existing, and in good standing under the laws of its jurisdiction of incorporation (Cascade: the State of Delaware; Thornbridge: the State of Nevada);

(b) It has full corporate power and authority to enter into and perform its obligations under this Agreement, and the execution, delivery, and performance of this Agreement have been duly authorized by all necessary corporate action;

(c) This Agreement constitutes the legal, valid, and binding obligation of such party, enforceable against such party in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, moratorium, and similar laws affecting creditors' rights generally;

(d) The execution, delivery, and performance of this Agreement do not and will not violate any law, regulation, order, judgment, or decree applicable to such party or any agreement to which such party is bound; and

(e) It shall comply with all Applicable Privacy Laws in the performance of its obligations under this Agreement and shall not take any action that would cause the other party to be in violation of any Applicable Privacy Law.

Section 13.2 — Cascade Representations

Cascade further represents and warrants to Thornbridge that:

(a) All Consumer Personal Information shared with Thornbridge under this Agreement has been collected in compliance with Applicable Privacy Laws, including the provision of all required at-collection notices, privacy-policy disclosures, and, where required, the obtaining of consent;

(b) Cascade has a lawful basis under all Applicable Privacy Laws for sharing Consumer Personal Information with Thornbridge for the Permitted Purposes, including any necessary notice to Consumers of such sharing;

(c) Cascade shall not share with Thornbridge the Consumer Personal Information of any Consumer who has exercised an opt-out right under any Applicable Privacy Law with respect to the sale or sharing of their personal information, except to the extent the Consumer has subsequently provided valid affirmative opt-in consent communicated by Cascade to Thornbridge in accordance with Section 5.4; and

(d) Cascade shall maintain accurate and up-to-date records of Consumer consents, opt-outs, and re-opt-ins sufficient to support the lawfulness of the data sharing contemplated by this Agreement.

Section 13.3 — Thornbridge Representations

Thornbridge further represents and warrants to Cascade that:

(a) Thornbridge has implemented and maintains commercially reasonable privacy and security programs, including written information-security policies, employee training, incident-response procedures, and data-protection assessments, appropriate to the nature and volume of Consumer Personal Information it processes;

(b) Thornbridge shall not take any action that would cause Cascade to be in violation of any Applicable Privacy Law, including any action that would undermine the legal basis for the data sharing contemplated by this Agreement;

(c) Thornbridge understands the restrictions on its use of Consumer Personal Information set forth in Articles 4 and 5 of this Agreement and shall comply with such restrictions at all times;

(d) Thornbridge shall promptly notify Cascade, in writing, if it determines that it can no longer meet its obligations under this Agreement or under any Applicable Privacy Law with respect to the processing of Consumer Personal Information, and shall take all steps necessary to stop and remediate any unauthorized processing; and

(e) Thornbridge has disclosed to Cascade all material regulatory inquiries, investigations, enforcement actions, consent orders, or settlement agreements to which Thornbridge is or has been subject in the preceding three (3) years relating to data privacy, data security, or advertising practices.

ARTICLE 14: INDEMNIFICATION

Section 14.1 — Thornbridge Indemnification

Thornbridge shall indemnify, defend, and hold harmless Cascade and its subsidiaries, including without limitation Cascade Digital Marketplace LLC, Peakview Analytics Inc., Cascade Rewards Corp., and Ridgeline Fulfillment Services Inc., and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Cascade Indemnitees"), from and against any and all claims, demands, actions, suits, proceedings, losses, liabilities, damages, judgments, awards, settlements, costs,

DATA-SHARING AGREEMENT
by and between
CASCADE RETAIL HOLDINGS INC.
a Delaware corporation
("Cascade" or "Data Sharer")
and
THORNBRIDGE MEDIA CORP.
a Nevada corporation
("Thornbridge" or "Data Recipient")
Effective Date: October 31, 2025
This Agreement restructures and supersedes the prior data-sharing arrangement between the parties relating to programmatic advertising and audience-targeting services.
CONFIDENTIAL TREATMENT REQUESTED — This document contains confidential business, financial, and technical information of the parties. Distribution is restricted to authorized representatives and legal counsel of Cascade Retail Holdings Inc. and Thornbridge Media Corp.
Right-click to update Table of Contents
RECITALS
WHEREAS, Cascade Retail Holdings Inc. ("Cascade") is a publicly traded omnichannel retailer and e-commerce platform listed on the Nasdaq Global Select Market under the ticker symbol "CSRD," headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and operates one hundred eighty-six (186) retail locations across thirty-one (31) U.S. states, processes approximately ninety-four (94) million annual online transactions through its e-commerce platform, and maintains approximately forty-one point two (41.2) million registered members of its Cascade Rewards loyalty program;
WHEREAS, Cascade, directly and through its wholly owned subsidiary Peakview Analytics Inc., a Delaware corporation ("Peakview"), collects and processes consumer behavioral data, including approximately two point one (2.1) billion consumer-event data records per month, for the purposes of advertising personalization, audience targeting, campaign measurement, and related analytics;
WHEREAS, Thornbridge Media Corp. ("Thornbridge") is a programmatic-advertising and audience-targeting company headquartered at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117, and serves as Cascade's primary programmatic-advertising and audience-targeting partner for the delivery of cross-channel advertising campaigns, audience-segment creation, and campaign attribution services;
WHEREAS, in Cascade's fiscal year ending January 31, 2025 ("FY2024"), Cascade spent approximately eighteen point four million dollars ($18,400,000) with Thornbridge for programmatic-advertising and audience-targeting services under the parties' prior data-sharing and advertising services arrangement;
WHEREAS, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), codified at California Civil Code Sections 1798.100 through 1798.199.100, and an expanding number of comprehensive U.S. state privacy statutes — currently encompassing nineteen (19) applicable jurisdictions — impose significant requirements on the sale, sharing, and processing of consumer personal information, including requirements related to consumer notice, consent, opt-out rights, data minimization, and contractual obligations between businesses, service providers, contractors, and third parties;
WHEREAS, Cascade has engaged Calderwood & Harkness LLP ("Calderwood & Harkness"), with offices at 600 Lexington Avenue, 28th Floor, New York, New York 10022 (Kevin Ostrowski, lead partner), as outside privacy counsel to design and implement a comprehensive U.S. state-privacy compliance program addressing Cascade's obligations as a business under the CCPA/CPRA and as a controller under analogous state privacy statutes, and Cascade has determined, in consultation with Calderwood & Harkness, that the prior data-sharing arrangement between the parties must be restructured to comply with applicable law;
WHEREAS, Thornbridge is represented in connection with this Agreement by Kellner Park & Associates LLP (Victor Sandoval, lead attorney; 555 Mission Street, 32nd Floor, San Francisco, California 94105) and its General Counsel, Leah Voss;
WHEREAS, the parties desire to enter into this Agreement to set forth the terms and conditions under which Cascade will share certain consumer personal information with Thornbridge for the limited purposes described herein, in compliance with the CCPA/CPRA and all other applicable U.S. state privacy laws, and to establish the parties' respective rights, obligations, and responsibilities with respect to the protection, use, and processing of such consumer personal information; and
NOW, THEREFORE, in consideration of the mutual covenants and agreements set forth herein, and for other good and valuable consideration, the receipt and sufficiency of which are hereby acknowledged, the parties agree as follows:
ARTICLE 1: DEFINITIONS
Section 1.1 — Defined Terms
As used in this Agreement, the following capitalized terms shall have the meanings set forth below:
(a) "Applicable Privacy Laws" means the CCPA/CPRA (Cal. Civ. Code §§ 1798.100–1798.199.100) and all other U.S. state comprehensive privacy statutes applicable to either party's processing activities under or in connection with this Agreement, including without limitation: the Virginia Consumer Data Protection Act ("VCDPA"), Va. Code Ann. §§ 59.1-575 through 59.1-585; the Colorado Privacy Act ("CPA"), Colo. Rev. Stat. §§ 6-1-1301 through 6-1-1313; the Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 through 42-525; the Utah Consumer Privacy Act ("UCPA"), Utah Code Ann. §§ 13-61-101 through 13-61-404; the Iowa Consumer Data Protection Act ("ICDPA"), Iowa Code ch. 715D; the Indiana Consumer Data Protection Act ("INCDPA"), Ind. Code §§ 24-15-1-1 through 24-15-9-3; the Tennessee Information Protection Act ("TIPA"), Tenn. Code Ann. §§ 47-18-3201 through 47-18-3213; the Montana Consumer Data Privacy Act ("MCDPA"), Mont. Code Ann. §§ 30-14-2801 through 30-14-2817; the Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code §§ 541.001 through 541.205; the Oregon Consumer Privacy Act ("OCPA"), Or. Rev. Stat. §§ 646A.570 through 646A.597; the Delaware Personal Data Privacy Act ("DPDPA"), Del. Code Ann. tit. 6, ch. 12D; the New Jersey Data Privacy Act ("NJDPA"), N.J. Stat. Ann. §§ 56:8-166 through 56:8-189; the New Hampshire Data Privacy Act ("NHDPA"); the Nebraska Data Privacy Act ("NDPA"); the Minnesota Consumer Data Privacy Act; the Maryland Online Data Privacy Act ("MODPA"); the Kentucky Data Privacy Act ("KYDPA"); and any amendments, implementing regulations, or successor statutes to any of the foregoing.
(b) "Business Purpose" means a purpose as defined in California Civil Code Section 1798.140(e) and analogous provisions of other Applicable Privacy Laws, including auditing related to counting ad impressions, verifying positioning and quality of ad impressions, and auditing compliance; detecting security incidents; debugging to identify and repair errors; performing services on behalf of a business, including account maintenance and customer service; and undertaking internal research for technological development and demonstration.
(c) "Cascade Digital Marketplace" means Cascade Digital Marketplace LLC, a Delaware limited liability company and wholly owned subsidiary of Cascade, which operates Cascade's third-party seller marketplace platform.
(d) "Cascade Rewards" means the Cascade Rewards loyalty program operated by Cascade Rewards Corp., a Delaware corporation and wholly owned subsidiary of Cascade, which maintains approximately forty-one point two (41.2) million registered members as of the Effective Date.
(e) "Consumer" means a natural person who is a resident of a U.S. state with an Applicable Privacy Law, including without limitation Cascade customers, website visitors to cascade.com, users of the Cascade mobile application, in-store shoppers, and registered members of the Cascade Rewards loyalty program, in each case to the extent such natural person qualifies as a "consumer," "resident," or analogous term under the relevant Applicable Privacy Law.
(f) "Consumer Personal Information" or "CPI" means personal information (as defined in Cal. Civ. Code § 1798.140(v)) or personal data (as defined in analogous Applicable Privacy Laws) relating to Consumers that Cascade shares with Thornbridge under this Agreement, limited to the categories described in Section 3.1 and Exhibit A.
(g) "Controller" means the natural or legal person that, alone or jointly with others, determines the purposes and means of processing personal data, as defined in the VCDPA, CPA, CTDPA, and analogous Applicable Privacy Laws. For purposes of this Agreement, both Cascade and Thornbridge act as independent controllers with respect to Consumer Personal Information, except as otherwise expressly specified herein.
(h) "Data Subject Request" or "DSR" means any request from a Consumer to exercise rights available to the Consumer under Applicable Privacy Laws, including without limitation rights of access, deletion, correction, opt-out, data portability, and appeal.
(i) "Global Privacy Control" or "GPC" means a user-enabled browser-level or device-level signal conforming to the Global Privacy Control specification (as published at globalprivacycontrol.org or any successor specification) that communicates a Consumer's preference to opt out of the sale or sharing of their personal information.
(j) "Opt-Out Signal" means any Consumer-initiated opt-out request transmitted via a GPC signal, a "Do Not Sell or Share My Personal Information" link or similar mechanism on Cascade's website or mobile application, a written or electronic request submitted through Cascade's Consumer privacy-request portal, or any equivalent mechanism mandated by Applicable Privacy Laws.
(k) "Peakview" means Peakview Analytics Inc., a Delaware corporation and wholly owned subsidiary of Cascade, which processes consumer behavioral data for advertising personalization and audience-targeting purposes.
(l) "Permitted Purposes" has the meaning set forth in Section 4.1 of this Agreement.
(m) "Processor" means a natural or legal entity that processes personal data on behalf of a controller, as defined in the VCDPA, CPA, CTDPA, and analogous Applicable Privacy Laws.
(n) "Sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by a business to a third party for monetary or other valuable consideration, as defined in California Civil Code Section 1798.140(ad) and analogous provisions of other Applicable Privacy Laws.
(o) "Security Incident" means any confirmed or reasonably suspected unauthorized access, acquisition, use, disclosure, alteration, destruction, or loss of Consumer Personal Information in Thornbridge's possession or control, or in the possession or control of Thornbridge's sub-processors.
(p) "Sensitive Personal Information" means personal information that reveals a Consumer's Social Security number, driver's license number, state identification card number, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; contents of mail, email, or text messages (unless the business is the intended recipient); genetic data; biometric information; health information; or sex life or sexual orientation, as defined in California Civil Code Section 1798.140(ae) and analogous provisions of other Applicable Privacy Laws. For the avoidance of doubt, Sensitive Personal Information includes precise geolocation data collected via the Cascade mobile application, payment-card data, and account login credentials.
(q) "Service Provider" means a person that processes personal information on behalf of a business and to which the business discloses a Consumer's personal information for a business purpose pursuant to a written contract, as defined in California Civil Code Section 1798.140(ag) and analogous provisions of other Applicable Privacy Laws.
(r) "Sharing" means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a Consumer's personal information by a business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged, as defined in California Civil Code Section 1798.140(ah).
(s) "Third Party" means a person who is not the business that collects personal information from Consumers, a person to whom the business discloses a Consumer's personal information for a business purpose pursuant to a written contract as required under the CCPA/CPRA, or a person who is an employee or independent contractor of the business, as defined in California Civil Code Section 1798.140(ai) and analogous provisions of other Applicable Privacy Laws.
Section 1.2 — Interpretation
(a) All references in this Agreement to statutory sections, subsections, or provisions shall include all amendments, implementing regulations, formal guidance, and advisory opinions effective as of the date of the relevant obligation. Where an Applicable Privacy Law is enacted or amended after the Effective Date and imposes new or modified obligations relevant to the subject matter of this Agreement, the parties shall cooperate in good faith to amend this Agreement as necessary to comply with such new or modified obligations in accordance with Section 19.5.
(b) Headings and section titles used in this Agreement are for convenience of reference only and shall not affect the interpretation or construction of any provision of this Agreement.
(c) The words "include," "includes," and "including" shall be deemed to be followed by the phrase "without limitation" regardless of whether such phrase appears in the applicable provision.
(d) References to "days" shall mean calendar days unless "business days" are expressly specified. "Business days" means days other than Saturdays, Sundays, and federal holidays observed in the United States.
(e) References to a "party" mean Cascade or Thornbridge, as applicable, and references to "parties" mean both Cascade and Thornbridge.
ARTICLE 2: CLASSIFICATION OF DATA-SHARING RELATIONSHIP
Section 2.1 — CCPA/CPRA Classification
The parties acknowledge and agree that the transfer of Consumer Personal Information from Cascade to Thornbridge for programmatic advertising and audience targeting constitutes "sharing" for cross-context behavioral advertising within the meaning of California Civil Code Section 1798.140(ah). The parties further acknowledge that such transfer may constitute a "sale" within the meaning of California Civil Code Section 1798.140(ad) under the CCPA/CPRA and under certain other Applicable Privacy Laws, depending on the nature and circumstances of the transfer and the applicable statutory definitions. As a result, Thornbridge is a "Third Party" under the CCPA/CPRA with respect to Consumer Personal Information received from Cascade under this Agreement. For the avoidance of doubt, and notwithstanding any other arrangement between the parties, Thornbridge does not act as a "Service Provider" (as defined in Cal. Civ. Code § 1798.140(ag)) or as a "Contractor" (as defined in Cal. Civ. Code § 1798.140(j)) under the CCPA/CPRA for purposes of processing Consumer Personal Information under this Agreement. The parties have structured this Agreement to reflect the applicable legal classification and to ensure that both parties comply with their respective obligations under the CCPA/CPRA as a "business" (in the case of Cascade) and as a "Third Party" (in the case of Thornbridge).
Section 2.2 — Classification Under Other State Laws
Under the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, and analogous comprehensive state privacy statutes enumerated in the definition of Applicable Privacy Laws, both Cascade and Thornbridge operate as independent "controllers" with respect to Consumer Personal Information shared under this Agreement. Each party independently determines the purposes and means of its own processing of Consumer Personal Information and is independently responsible for compliance with all controller obligations imposed by all Applicable Privacy Laws. Neither party acts as the other's "processor" under this Agreement. Thornbridge acknowledges that its receipt of Consumer Personal Information from Cascade creates independent controller obligations for Thornbridge under each applicable state privacy statute, including without limitation obligations related to transparency, data minimization, purpose limitation, data security, consumer rights facilitation, and data protection assessments where required.
Section 2.3 — No Joint Controller Relationship
Nothing in this Agreement shall be construed to create a joint controller, joint venture, partnership, or agency relationship between Cascade and Thornbridge. Each party shall be solely responsible for its own compliance with Applicable Privacy Laws in its capacity as an independent controller. Neither party shall have the authority to bind the other or to make representations on behalf of the other to Consumers, regulators, or any third party, except as expressly set forth in this Agreement.
ARTICLE 3: SCOPE OF DATA SHARING
Section 3.1 — Categories of Consumer Personal Information Shared
Cascade shall share with Thornbridge the following categories of Consumer Personal Information, as further described in Exhibit A (Description of Data Sharing):
(a) Identifiers. Hashed email addresses, device identifiers (including mobile advertising identifiers such as IDFAs and GAIDs), cookie identifiers, advertising IDs, IP addresses (truncated to the first three octets where technically feasible), and internal Cascade customer identifiers that have been pseudonymized or de-identified to the extent reasonably practicable.
(b) Commercial Information. Records of purchases made through cascade.com, the Cascade mobile application, and in-store point-of-sale systems; product interests and preferences inferred from browsing and purchase behavior; shopping cart contents and abandonment data; and product category affinities.
(c) Internet and Electronic Network Activity Information. Clickstream data, session data, referring and exit URLs, page-view sequences, time-on-page metrics, search queries entered on cascade.com, and interaction data from Cascade's digital advertising placements.
(d) Inferences Drawn from the Foregoing Categories. Consumer profiles, propensity scores, audience segments, predicted purchase likelihood scores, and other inferences generated by Cascade or Peakview from the data categories described in subsections (a) through (c) above for the purpose of advertising personalization.
The foregoing categories represent the exclusive categories of Consumer Personal Information that Cascade is authorized to share under this Agreement. Any expansion of these categories shall require a written amendment to this Agreement executed by both parties in accordance with Section 19.5.
Section 3.2 — Exclusion of Sensitive Personal Information
Cascade shall not share Sensitive Personal Information with Thornbridge under this Agreement. Without limiting the generality of the foregoing, the following categories of data are expressly excluded from the scope of data sharing under this Agreement:
(a) Precise geolocation data collected via the Cascade mobile application or any other Cascade system or service;
(b) Payment-card data, including credit card numbers, debit card numbers, bank account numbers, and associated security codes, PINs, or authentication credentials;
(c) Account login credentials, including usernames, passwords, and security questions and answers for Cascade Rewards accounts, cascade.com accounts, and Cascade mobile-application accounts;
(d) Any other categories of data that constitute Sensitive Personal Information under any Applicable Privacy Law.
If Thornbridge discovers or has reason to believe that it has received Sensitive Personal Information from Cascade in error, whether through a data-transmission error, misconfiguration, or any other cause, Thornbridge shall (i) promptly notify Cascade's designated privacy contact (Diana Polk, Associate General Counsel) within twenty-four (24) hours of discovery, (ii) immediately cease all processing of such Sensitive Personal Information, and (iii) securely delete all copies of such Sensitive Personal Information from Thornbridge's systems, including any backups, archives, or derivative data sets, within five (5) business days of discovery. Thornbridge shall provide written certification to Cascade confirming the completion of such deletion.
Section 3.3 — Sources of Consumer Personal Information
Consumer Personal Information shared under this Agreement is collected by Cascade through the following sources:
(a) cascade.com — Cascade's primary e-commerce website, including all subdomains and microsites;
(b) Cascade Mobile Application — The Cascade mobile shopping and loyalty-program application available on iOS and Android platforms;
(c) In-Store Point-of-Sale Systems — Transaction data collected through Cascade's one hundred eighty-six (186) retail locations across thirty-one (31) U.S. states, linked to Cascade Rewards loyalty-program membership where the Consumer has enrolled;
(d) Cascade Rewards Loyalty Program — Data collected through membership registration, transaction history, preference data, and engagement data maintained by Cascade Rewards Corp.
Certain Consumer Personal Information is processed and generated by Peakview Analytics Inc. for advertising personalization purposes, including the generation of audience segments, propensity scores, and other inferences described in Section 3.1(d), prior to transfer to Thornbridge. Consumer Personal Information originating from Cascade Digital Marketplace LLC's network of approximately three thousand eight hundred (3,800) third-party sellers shall not be shared with Thornbridge under this Agreement absent separate written authorization executed by an authorized representative of Cascade Digital Marketplace LLC and Cascade.
Section 3.4 — Volume and Method of Transmission
Consumer Personal Information shall be transmitted from Cascade to Thornbridge via secure, encrypted API integration or encrypted Secure File Transfer Protocol ("SFTP"), as specified in Exhibit B (Technical Specifications). The parties acknowledge that the volumes of Consumer Personal Information shared under this Agreement are substantial, reflecting Cascade's approximately ninety-four (94) million annual online transactions and Peakview's processing of approximately two point one (2.1) billion consumer-event data records per month. Data shall be transmitted in both daily batch files and real-time API calls, as further specified in Exhibit B. Thornbridge shall maintain sufficient system capacity, bandwidth, and processing infrastructure to receive and process the anticipated data volumes without degradation of performance or compromise of security.
ARTICLE 4: PERMITTED PURPOSES AND USE LIMITATIONS
Section 4.1 — Permitted Purposes
Thornbridge may process Consumer Personal Information received from Cascade solely for the following limited and specified purposes (collectively, the "Permitted Purposes"):
(a) Programmatic-Advertising Campaign Delivery. The delivery of programmatic-advertising campaigns on behalf of Cascade across Thornbridge's network of demand-side platforms, supply-side platforms, ad exchanges, and publisher inventory, in accordance with Cascade's campaign objectives, budgets, and instructions;
(b) Audience-Segment Creation and Targeting. The creation, maintenance, and activation of audience segments derived from Consumer Personal Information for the purpose of targeting advertising to Consumers on behalf of Cascade in connection with Cascade advertising campaigns;
(c) Campaign Measurement, Attribution, and Reporting. The measurement of advertising campaign performance, including impression delivery, click-through rates, conversion tracking, multi-touch attribution analysis, and the preparation and delivery of campaign performance reports to Cascade; and
(d) Frequency Capping. The implementation of frequency-capping controls across advertising channels to manage the number of times individual Consumers are exposed to specific Cascade advertising creatives within defined time periods.
Thornbridge shall not process Consumer Personal Information for any purpose other than the Permitted Purposes without the prior written consent of Cascade. Any request by Thornbridge to expand the Permitted Purposes shall be submitted in writing to Cascade's designated privacy contact and shall not take effect unless and until Cascade has provided written approval and the parties have executed a written amendment to this Agreement.
Section 4.2 — Prohibited Uses
Thornbridge shall not, under any circumstances:
(a) Sell Consumer Personal Information. Sell, rent, release, disclose, disseminate, make available, transfer, or otherwise communicate Consumer Personal Information to any other person or entity for monetary or other valuable consideration;
(b) Share for Unrelated Cross-Context Behavioral Advertising. Share Consumer Personal Information for cross-context behavioral advertising purposes that are unrelated to the Permitted Purposes, including without limitation using Consumer Personal Information to target advertising for any person or entity other than Cascade;
(c) Combine with Other Data Sources. Combine, merge, or commingle Consumer Personal Information with personal information obtained from other sources, including Thornbridge's own proprietary data assets, data obtained from Thornbridge's other clients, or data obtained from third-party data brokers or data aggregators, except as strictly necessary to perform the Permitted Purposes on behalf of Cascade and as expressly authorized under this Agreement;
(d) Use for Independent Commercial Purposes. Use Consumer Personal Information for Thornbridge's own independent commercial purposes, including without limitation building, augmenting, enriching, or enhancing Thornbridge's proprietary consumer profiles, data products, audience segments, or lookalike models for use by Thornbridge's other clients or for Thornbridge's own marketing activities;
(e) Retain Beyond Permitted Periods. Retain Consumer Personal Information longer than reasonably necessary for the Permitted Purposes, and in no event longer than the retention periods set forth in Exhibit C (Data Retention Schedule) or the maximum retention period specified in Section 11.1 of this Agreement.
Any breach of the restrictions set forth in this Section 4.2 shall be deemed a material breach of this Agreement entitling Cascade to terminate this Agreement immediately without the cure period otherwise provided in Section 17.2.
Section 4.3 — Data Minimization
Thornbridge shall adhere to the principle of data minimization in all processing of Consumer Personal Information under this Agreement. Specifically, Thornbridge shall process only the minimum categories and volume of Consumer Personal Information that are reasonably necessary to accomplish the Permitted Purposes. Thornbridge shall not request or collect additional categories of Consumer Personal Information beyond those enumerated in Section 3.1 and Exhibit A without prior written consent from Cascade. Thornbridge shall periodically review its data-processing activities to ensure that its use of Consumer Personal Information remains proportionate to the Permitted Purposes and shall promptly notify Cascade if Thornbridge determines that certain categories or volumes of Consumer Personal Information are no longer necessary for the Permitted Purposes, so that the parties may adjust the scope of data sharing accordingly.
ARTICLE 5: OPT-OUT OF SALE/SHARING COMPLIANCE
Section 5.1 — Obligation to Honor Opt-Out signals
Cascade shall transmit Consumer Opt-Out signals to Thornbridge in real time, or as near to real time as is technically practicable given the parties' system architectures and integration protocols, but in no event later than twenty-four (24) hours after Cascade's receipt or detection of such Opt-Out Signal, via the mechanism specified in Exhibit B (Technical Specifications). Upon receipt of an Opt-Out Signal, whether transmitted via a Global Privacy Control signal, a "Do Not Sell or Share My Personal Information" link interaction, a Consumer privacy-request portal submission, or any other mechanism mandated by Applicable Privacy Laws, Thornbridge shall immediately cease all processing of the applicable Consumer's Personal Information for Sale or Sharing purposes. Thornbridge acknowledges that failure to honor Opt-Out signals in a timely manner may result in regulatory liability for both parties and that prompt compliance is material to Cascade's obligations under the CCPA/CPRA and other Applicable Privacy Laws.
Section 5.2 — Global Privacy Control (GPC) Signal Honoring
Thornbridge shall honor GPC signals forwarded by Cascade as valid opt-out requests under the CCPA/CPRA and all other Applicable Privacy Laws that recognize the Global Privacy Control or universal opt-out mechanisms as legally binding consumer opt-out preferences. Thornbridge shall implement and maintain technical capabilities sufficient to process GPC signal pass-throughs in real time, including the ability to receive, interpret, and act upon GPC signals as transmitted by Cascade through the API integration described in Exhibit B. The specific technical requirements for GPC signal integration, including signal format, transmission protocol, acknowledgment response requirements, and error-handling procedures, are set forth in Exhibit B. Thornbridge shall not require any additional verification or confirmation from Cascade or the Consumer before honoring a validly transmitted GPC signal.
Section 5.3 — "Do Not Sell or Share" Suppression-List Maintenance
Thornbridge shall maintain a comprehensive suppression list of all Consumers who have exercised their right to opt out of the sale or sharing of their Consumer Personal Information (the "Suppression List"). The Suppression List shall be synchronized with Cascade's opt-out records in accordance with the synchronization protocol specified in Exhibit B. Thornbridge shall update the Suppression List within fifteen (15) business days of receiving notice from Cascade of a Consumer opt-out request processed through Cascade's DSR portal, GPC signal relay, "Do Not Sell or Share" link, or any other opt-out mechanism. Thornbridge shall not process any suppressed Consumer's Personal Information for Sale or Sharing purposes following the Consumer's inclusion on the Suppression List, unless and until the Consumer subsequently provides affirmative opt-in consent that is communicated by Cascade to Thornbridge in accordance with Section 5.4. Thornbridge shall implement technical safeguards to prevent the inadvertent processing of suppressed Consumers' data, including automated checks against the Suppression List prior to the activation of any audience segment or programmatic-advertising campaign.
Section 5.4 — Re-Opt-In Requirements
If a Consumer revokes their prior opt-out and affirmatively opts back in to the sale or sharing of their Consumer Personal Information through Cascade's consumer-facing opt-in mechanism, Cascade shall notify Thornbridge in writing (which may include electronic notification via the API integration or other agreed-upon mechanism) of such re-opt-in, including the relevant Consumer identifier. Thornbridge may resume processing the applicable Consumer's Personal Information for the Permitted Purposes only upon receipt of such notice from Cascade. Thornbridge shall not solicit, encourage, or facilitate any Consumer's decision to opt back in, whether directly or indirectly. Cascade shall maintain records of all Consumer re-opt-in consents and shall make such records available to Thornbridge upon reasonable request for compliance verification purposes.
ARTICLE 6: CONSUMER-RIGHTS ASSISTANCE
Section 6.1 — Cooperation on Consumer Requests
If Cascade receives a Data Subject Request from a Consumer under any Applicable Privacy Law — including without limitation requests for access, deletion, correction, portability, or the exercise of any other right — that requires action by Thornbridge in order for Cascade to fully respond to the request, Cascade shall promptly forward such request to Thornbridge, together with sufficient information to enable Thornbridge to identify the relevant Consumer and locate the applicable Consumer Personal Information in Thornbridge's systems. Thornbridge shall respond to and fulfill such forwarded requests within ten (10) business days of receipt from Cascade, to enable Cascade to meet its target response time of fifteen (15) business days or less and the statutory maximum response period of forty-five (45) calendar days under the CCPA/CPRA (subject to any extensions permitted by applicable law). Thornbridge shall designate a single point of contact for the receipt and processing of forwarded Consumer requests and shall provide such contact information to Cascade on or before the Effective Date.
Section 6.2 — Deletion Requests
Upon receipt of a verified deletion request forwarded by Cascade, Thornbridge shall delete all Consumer Personal Information relating to the requesting Consumer from Thornbridge's systems, including all active databases, backup systems, disaster-recovery environments, and archives, within thirty (30) calendar days of receipt of the forwarded request. Thornbridge shall confirm the completion of such deletion in writing to Cascade, specifying the date of deletion and the systems from which data was removed. Thornbridge shall direct its approved sub-processors (if any, as permitted under Article 8) to delete all Consumer Personal Information relating to the requesting Consumer within the same thirty (30) calendar-day timeframe and shall obtain written confirmation of such deletion from each affected sub-processor. To the extent that Applicable Privacy Laws provide exceptions to the deletion obligation (e.g., for data necessary to detect security incidents or to comply with a legal obligation), Thornbridge shall notify Cascade of any such exception it intends to invoke, specifying the legal basis and the data retained, before the expiration of the thirty (30) calendar-day period.
Section 6.3 — Access and Portability Requests
Upon receipt of a verified access or data-portability request forwarded by Cascade, Thornbridge shall provide to Cascade, in a structured, commonly used, and machine-readable format (such as CSV or JSON), the Consumer Personal Information that Thornbridge holds regarding the requesting Consumer, within the timeline specified in Section 6.1. Thornbridge shall ensure that the data provided is accurate, complete, and responsive to the scope of the Consumer's request. If Thornbridge is unable to identify the Consumer or locate the relevant data, Thornbridge shall promptly notify Cascade and cooperate with Cascade's efforts to fulfill the request.
Section 6.4 — Appeal-Process Cooperation
Thornbridge shall cooperate with Cascade in connection with any Consumer appeal of a denied Data Subject Request, as required under the VCDPA, CPA, CTDPA, and other Applicable Privacy Laws that provide Consumers with a right to appeal the denial of a DSR. Such cooperation shall include providing Cascade with any additional information or documentation necessary for Cascade to evaluate and respond to the appeal within the timeframe required by the applicable statute. To the extent that a Consumer appeal relates to Thornbridge's processing of Consumer Personal Information, Thornbridge shall conduct a good-faith review of its own records and systems to determine whether the original denial was warranted and shall report its findings to Cascade.
Section 6.5 — No Direct Consumer Interaction
Thornbridge shall not respond directly to any Consumer requests regarding Consumer Personal Information that Thornbridge received from Cascade under this Agreement, unless Cascade provides prior written authorization for Thornbridge to do so in a specific instance. If Thornbridge receives any such request directly from a Consumer, whether by email, telephone, postal mail, or any other means, Thornbridge shall (i) promptly redirect the Consumer to Cascade's designated privacy-request portal or contact information, (ii) refrain from providing any information to the Consumer regarding the Consumer Personal Information held by Thornbridge, and (iii) notify Cascade of such request, including all relevant details, within two (2) business days of receipt. Thornbridge shall maintain a log of all such direct Consumer contacts and shall make such log available to Cascade upon request.
ARTICLE 7: DATA SECURITY
Section 7.1 — Security Obligations
Thornbridge shall implement and maintain reasonable and appropriate administrative, technical, and physical safeguards to protect Consumer Personal Information against unauthorized access, use, disclosure, alteration, destruction, or loss, consistent with industry standards for entities processing comparable types and volumes of consumer data, and no less protective than the safeguards described in Exhibit D (Security Requirements). Thornbridge's security program shall be designed to ensure the confidentiality, integrity, and availability of Consumer Personal Information throughout the data lifecycle, from receipt through processing, storage, and eventual deletion. Thornbridge shall maintain SOC 2 Type II certification (issued by an independent, nationally recognized auditing firm) covering security, availability, and confidentiality trust service criteria, or an equivalent certification acceptable to Cascade, throughout the term of this Agreement. Thornbridge shall provide Cascade with a copy of its most recent SOC 2 Type II report within thirty (30) calendar days of the Effective Date and within thirty (30) calendar days of the issuance of each subsequent report.
Section 7.2 — Encryption Requirements
All Consumer Personal Information transmitted between Cascade and Thornbridge must be encrypted in transit using Transport Layer Security (TLS) version 1.2 or higher. All Consumer Personal Information stored by Thornbridge must be encrypted at rest using Advanced Encryption Standard (AES) with a minimum key length of 256 bits (AES-256) or an equivalent encryption standard approved by the National Institute of Standards and Technology (NIST). Thornbridge shall manage encryption keys in accordance with industry best practices, including the use of hardware security modules (HSMs) where appropriate, regular key rotation, and strict access controls for key-management personnel.
Section 7.3 — Access Controls
Thornbridge shall restrict access to Consumer Personal Information to authorized personnel who have a legitimate, documented need-to-know in connection with the Permitted Purposes. Thornbridge shall implement and maintain role-based access controls, multi-factor authentication for access to systems containing Consumer Personal Information, and logging of all access events. Thornbridge shall conduct periodic access reviews, no less frequently than quarterly, to ensure that access privileges remain appropriate and shall promptly revoke access for any individual whose access is no longer necessary. All Thornbridge personnel with access to Consumer Personal Information shall be subject to written confidentiality obligations and shall complete data-privacy and data-security training prior to being granted access and no less frequently than annually thereafter. The detailed security requirements applicable to Thornbridge's processing environment are set forth in Exhibit D.
ARTICLE 8: SUB-PROCESSORS AND ONWARD TRANSFERS
Section 8.1 — Restrictions on Onward Transfers
Thornbridge shall not disclose, transfer, or make available Consumer Personal Information to any sub-processor, subcontractor, affiliate, or other third party without the prior written consent of Cascade. Any request for approval of a sub-processor shall include the identity of the proposed sub-processor, a description of the processing activities to be performed, the location(s) where processing will occur, and the security measures implemented by the proposed sub-processor. Any approved sub-processor must be bound by a written agreement imposing data-protection obligations no less protective than those set forth in this Agreement, including without limitation obligations regarding purpose limitation, use restrictions, data security, breach notification, audit rights, and return or deletion of Consumer Personal Information.
Section 8.2 — List of Approved Sub-Processors
Thornbridge shall provide Cascade with a complete and current list of all sub-processors used to process Consumer Personal Information prior to the Effective Date, as set forth in Exhibit E (Approved Sub-Processors). Thornbridge shall update Exhibit E and provide written notice to Cascade at least thirty (30) calendar days before engaging any new sub-processor or making any material change to the processing activities of an existing sub-processor. Cascade shall have the right to object in writing to any new or changed sub-processor within fifteen (15) business days of receipt of Thornbridge's notification. If the parties are unable to resolve Cascade's objection through good-faith negotiation within thirty (30) calendar days of Cascade's written objection, Cascade may terminate this Agreement with respect to the affected processing activities, or, at Cascade's election, terminate this Agreement in its entirety, upon written notice to Thornbridge.
Section 8.3 — Liability for Sub-Processors
Thornbridge shall remain fully liable to Cascade for the acts, omissions, errors, and failures of its sub-processors with respect to Consumer Personal Information as if such acts, omissions, errors, and failures were those of Thornbridge itself. Thornbridge's engagement of an approved sub-processor shall not relieve Thornbridge of any obligation under this Agreement, and Thornbridge shall be responsible for ensuring that each sub-processor complies with all applicable terms and conditions of this Agreement.
ARTICLE 9: BREACH NOTIFICATION
Section 9.1 — Notification Obligation
Thornbridge shall notify Cascade in writing of any confirmed or reasonably suspected Security Incident without unreasonable delay and in no event later than forty-eight (48) hours after Thornbridge's discovery of such Security Incident. Discovery shall be deemed to occur at the time at which Thornbridge becomes aware of facts sufficient to constitute a reasonable belief that a Security Incident has occurred, regardless of whether a formal investigation has been completed. Notification shall be directed to Cascade's designated privacy contact (Diana Polk, Associate General Counsel) and to Cascade's General Counsel (Meredith Tanaka) via the contact information specified in Section 19.3, with a simultaneous copy to Calderwood & Harkness LLP (Kevin Ostrowski).
Section 9.2 — Content of Notification
The initial notification provided under Section 9.1 shall include, to the extent known or reasonably determinable at the time of notification:
(a) The nature and scope of the Security Incident, including a description of the circumstances leading to the incident;
(b) The categories and approximate number of affected Consumers;
(c) The categories and approximate volume of Consumer Personal Information affected;
(d) The likely consequences of the Security Incident for affected Consumers and for Cascade;
(e) The measures taken or proposed to be taken by Thornbridge to contain, mitigate, and remediate the Security Incident and to prevent recurrence; and
(f) The name, title, telephone number, and email address of a designated point of contact at Thornbridge who is knowledgeable about the Security Incident and authorized to coordinate with Cascade.
If complete information is not available at the time of the initial notification, Thornbridge shall provide the information in phases without unreasonable delay as additional information becomes available, and shall provide regular written updates to Cascade at least every twenty-four (24) hours until the Security Incident has been fully contained and investigated.
Section 9.3 — Cooperation
Thornbridge shall cooperate fully with Cascade's investigation and response to any Security Incident, including providing information, documentation, system logs, forensic analysis results, and access to Thornbridge's systems, facilities, and personnel as reasonably requested by Cascade or its counsel, including Calderwood & Harkness LLP. Thornbridge shall coordinate with Cascade before making any public statements, press releases, customer notifications, or regulatory notifications regarding a Security Incident involving Consumer Personal Information received from Cascade under this Agreement. Cascade shall have the right to review and approve all such communications prior to their dissemination, and Thornbridge shall incorporate Cascade's reasonable comments and revisions. Nothing in this Section 9.3 shall be construed to delay Thornbridge's compliance with any mandatory breach-notification requirements under applicable law; however, Thornbridge shall provide Cascade with advance notice of any such mandatory notification to the maximum extent permitted by law.
Section 9.4 — Remediation
Thornbridge shall promptly take all reasonable steps to contain, investigate, and remediate any Security Incident, to mitigate the effects of the Security Incident on affected Consumers and on Cascade, and to prevent recurrence of similar incidents. Thornbridge shall, within thirty (30) calendar days of the conclusion of its investigation, provide Cascade with a written root-cause analysis and a remediation plan identifying the corrective actions taken or to be taken, including timelines for implementation. Cascade shall have the right to review the remediation plan and to require reasonable modifications to address identified deficiencies.
ARTICLE 10: AUDIT RIGHTS
Section 10.1 — Cascade Audit Right
Cascade, or a qualified independent third-party auditor designated by Cascade and subject to appropriate confidentiality obligations, shall have the right to audit Thornbridge's compliance with this Agreement no more than two (2) times per calendar year, upon at least thirty (30) calendar days' prior written notice to Thornbridge. Audits may include inspection of Thornbridge's processing facilities, information-technology systems, data-security infrastructure, policies, procedures, training records, access logs, and other records relevant to the processing of Consumer Personal Information under this Agreement. Audits shall be conducted during Thornbridge's normal business hours and shall be designed to minimize disruption to Thornbridge's operations. Thornbridge shall provide reasonable cooperation and access during any audit, including making relevant personnel available for interviews and providing requested documentation in a timely manner. If Cascade identifies specific compliance concerns that require investigation outside the scope of a scheduled audit, Cascade may request an additional targeted review upon reasonable written notice, and Thornbridge shall not unreasonably withhold its cooperation.
Section 10.2 — Costs
Each party shall bear its own costs and expenses incurred in connection with an audit conducted under this Article 10. Provided, however, that if an audit reveals a material breach of this Agreement by Thornbridge, including without limitation a failure to comply with the use restrictions set forth in Article 4, the opt-out compliance requirements set forth in Article 5, or the security obligations set forth in Article 7, Thornbridge shall reimburse Cascade for the reasonable and documented costs of such audit, including auditor fees, travel expenses, and related costs, within thirty (30) calendar days of Cascade's written demand accompanied by supporting documentation.
Section 10.3 — Confidentiality of Audit Results
The findings, reports, and results of any audit conducted under this Article 10 shall be treated as Confidential Information of both parties and shall be subject to the confidentiality obligations set forth in Article 16. Audit results shall not be disclosed to any third party except (a) as required by law, regulation, or valid legal process, (b) to the auditing party's legal counsel, (c) to regulatory authorities in connection with a regulatory inquiry or investigation as described in Section 10.4, or (d) with the prior written consent of the other party.
Section 10.4 — Regulatory Audit Cooperation
Thornbridge shall cooperate fully with any audit, investigation, examination, or inquiry by a governmental authority, including without limitation the Federal Trade Commission, the California Attorney General, or any state attorney general, relating to Consumer Personal Information shared under this Agreement or to Thornbridge's processing of such data. Thornbridge shall promptly notify Cascade, in writing, of any such audit, investigation, examination, or inquiry within three (3) business days of receiving notice thereof, unless prohibited from doing so by law or by the terms of the governmental authority's request. Thornbridge shall coordinate with Cascade and, where appropriate, with Cascade's outside counsel (Calderwood & Harkness LLP) in preparing responses to any such governmental authority, and shall not make any admissions, commitments, or representations to any governmental authority regarding Consumer Personal Information received from Cascade without first consulting with Cascade, except where compliance with a lawful demand requires immediate response.
ARTICLE 11: DATA RETENTION AND RETURN/DELETION
Section 11.1 — Retention Limitations
Thornbridge shall retain Consumer Personal Information only for as long as reasonably necessary to accomplish the Permitted Purposes specified in Section 4.1 and in accordance with the specific retention periods set forth in Exhibit C (Data Retention Schedule). In no event shall Thornbridge retain Consumer Personal Information for longer than eighteen (18) months from the date of receipt from Cascade, unless a shorter retention period is required by Applicable Privacy Laws or is specified in Exhibit C for particular categories of data. Thornbridge shall implement automated data-lifecycle management processes to ensure that Consumer Personal Information is securely deleted or de-identified upon the expiration of the applicable retention period, and shall maintain records of such deletions sufficient to demonstrate compliance with this Section 11.1 upon audit.
Section 11.2 — Return or Deletion Upon Termination
Upon termination or expiration of this Agreement for any reason, Thornbridge shall, at Cascade's election (to be communicated in writing within fifteen (15) calendar days of the date of termination or expiration), either (a) return all Consumer Personal Information in Thornbridge's possession or control to Cascade in a structured, commonly used, and machine-readable format, or (b) securely delete all Consumer Personal Information from Thornbridge's systems, including all active databases, backup systems, disaster-recovery environments, staging environments, and archives, within thirty (30) calendar days of receiving Cascade's election. If Cascade fails to communicate its election within the fifteen (15) calendar-day period, Thornbridge shall securely delete all Consumer Personal Information as described in clause (b). Thornbridge shall certify such return or deletion in writing, signed by an authorized officer or the General Counsel of Thornbridge, within five (5) business days of completion. Thornbridge shall direct its approved sub-processors to return or delete Consumer Personal Information within the same thirty (30) calendar-day timeframe and shall obtain and forward to Cascade written certifications of such return or deletion from each affected sub-processor.
Section 11.3 — Survival of Deletion Obligations
Thornbridge's obligations under this Article 11 and the Consumer's deletion rights facilitated under Section 6.2 shall survive the termination or expiration of this Agreement and shall continue in full force and effect until all Consumer Personal Information in Thornbridge's possession or control has been returned to Cascade or securely deleted in accordance with this Article 11.
ARTICLE 12: PRIVACY NOTICES AND DISCLOSURES
Section 12.1 — Cascade's Notice Obligations
Cascade shall be responsible for providing Consumers with all notices and disclosures required by Applicable Privacy Laws in connection with the data-sharing activities contemplated by this Agreement. Without limiting the generality of the foregoing, Cascade shall ensure that its consumer-facing privacy notices include disclosure that Consumer Personal Information may be "shared" or "sold" to Thornbridge, or to a category of recipients that accurately encompasses Thornbridge (such as "advertising and marketing partners" or "programmatic-advertising companies"), for cross-context behavioral advertising purposes. Cascade represents and warrants that its omnibus privacy policy (published at cascade.com/privacy), its California-specific disclosures addendum (published at cascade.com/california-privacy), and its cookie and tracking-technology notice (published at cascade.com/cookies) will, as of the Effective Date and at all times during the term of this Agreement, disclose the sharing of Consumer Personal Information with Thornbridge or such category of recipients in accordance with all Applicable Privacy Laws, including the CCPA/CPRA's requirements for at-collection notices, privacy-policy disclosures, and "Do Not Sell or Share My Personal Information" links. Cascade shall promptly notify Thornbridge of any material changes to its privacy notices that affect the scope or lawfulness of the data sharing contemplated by this Agreement.
Section 12.2 — Thornbridge's Notice Obligations
Thornbridge shall maintain its own privacy policy that accurately describes Thornbridge's processing of Consumer Personal Information received from third parties, including Cascade, and shall comply with all transparency requirements under Applicable Privacy Laws applicable to Thornbridge in its capacity as an independent controller. Thornbridge's privacy policy shall, at a minimum, disclose the categories of personal information Thornbridge collects and processes, the purposes for which such information is used, the categories of third parties with whom Thornbridge shares personal information, and the rights available to consumers under Applicable Privacy Laws. Thornbridge shall ensure that its privacy policy is accessible to the public and is updated as necessary to reflect changes in Thornbridge's data-processing practices or in Applicable Privacy Laws.
ARTICLE 13: REPRESENTATIONS AND WARRANTIES
Section 13.1 — Mutual Representations
Each party represents and warrants to the other party that, as of the Effective Date and throughout the term of this Agreement:
(a) It is duly organized, validly existing, and in good standing under the laws of its jurisdiction of incorporation (Cascade: the State of Delaware; Thornbridge: the State of Nevada);
(b) It has full corporate power and authority to enter into and perform its obligations under this Agreement, and the execution, delivery, and performance of this Agreement have been duly authorized by all necessary corporate action;
(c) This Agreement constitutes the legal, valid, and binding obligation of such party, enforceable against such party in accordance with its terms, subject to applicable bankruptcy, insolvency, reorganization, moratorium, and similar laws affecting creditors' rights generally;
(d) The execution, delivery, and performance of this Agreement do not and will not violate any law, regulation, order, judgment, or decree applicable to such party or any agreement to which such party is bound; and
(e) It shall comply with all Applicable Privacy Laws in the performance of its obligations under this Agreement and shall not take any action that would cause the other party to be in violation of any Applicable Privacy Law.
Section 13.2 — Cascade Representations
Cascade further represents and warrants to Thornbridge that:
(a) All Consumer Personal Information shared with Thornbridge under this Agreement has been collected in compliance with Applicable Privacy Laws, including the provision of all required at-collection notices, privacy-policy disclosures, and, where required, the obtaining of consent;
(b) Cascade has a lawful basis under all Applicable Privacy Laws for sharing Consumer Personal Information with Thornbridge for the Permitted Purposes, including any necessary notice to Consumers of such sharing;
(c) Cascade shall not share with Thornbridge the Consumer Personal Information of any Consumer who has exercised an opt-out right under any Applicable Privacy Law with respect to the sale or sharing of their personal information, except to the extent the Consumer has subsequently provided valid affirmative opt-in consent communicated by Cascade to Thornbridge in accordance with Section 5.4; and
(d) Cascade shall maintain accurate and up-to-date records of Consumer consents, opt-outs, and re-opt-ins sufficient to support the lawfulness of the data sharing contemplated by this Agreement.
Section 13.3 — Thornbridge Representations
Thornbridge further represents and warrants to Cascade that:
(a) Thornbridge has implemented and maintains commercially reasonable privacy and security programs, including written information-security policies, employee training, incident-response procedures, and data-protection assessments, appropriate to the nature and volume of Consumer Personal Information it processes;
(b) Thornbridge shall not take any action that would cause Cascade to be in violation of any Applicable Privacy Law, including any action that would undermine the legal basis for the data sharing contemplated by this Agreement;
(c) Thornbridge understands the restrictions on its use of Consumer Personal Information set forth in Articles 4 and 5 of this Agreement and shall comply with such restrictions at all times;
(d) Thornbridge shall promptly notify Cascade, in writing, if it determines that it can no longer meet its obligations under this Agreement or under any Applicable Privacy Law with respect to the processing of Consumer Personal Information, and shall take all steps necessary to stop and remediate any unauthorized processing; and
(e) Thornbridge has disclosed to Cascade all material regulatory inquiries, investigations, enforcement actions, consent orders, or settlement agreements to which Thornbridge is or has been subject in the preceding three (3) years relating to data privacy, data security, or advertising practices.
ARTICLE 14: INDEMNIFICATION
Section 14.1 — Thornbridge Indemnification
Thornbridge shall indemnify, defend, and hold harmless Cascade and its subsidiaries, including without limitation Cascade Digital Marketplace LLC, Peakview Analytics Inc., Cascade Rewards Corp., and Ridgeline Fulfillment Services Inc., and their respective officers, directors, employees, agents, successors, and assigns (collectively, the "Cascade Indemnitees"), from and against any and all claims, demands, actions, suits, proceedings, losses, liabilities, damages, judgments, awards, settlements, costs,