PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
MEMORANDUM
FROM: Alan Burke, Senior Associate, Privacy & Data Security Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
TO: Meredith Tanaka, General Counsel, Cascade Retail Holdings Inc. Diana Polk, Associate General Counsel (Interim Chief Privacy Officer), Cascade Retail Holdings Inc.
CC: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP Rachel Bernstein, Partner, Privacy & Data Security, Calderwood & Harkness LLP Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP
September 30, 2025
RE: Third-Party Vendor Data Processing Agreement Rollout Plan — Cascade Retail Holdings Inc. US State Privacy Compliance Program
Matter No.: 1038-00010
Right-click to update Table of Contents
I. Executive Summary
The purpose of this memorandum is to set forth a structured, phased strategy for deploying data processing agreements ("DPAs") to the twenty-three (23) of Cascade Retail Holdings Inc.'s ("Cascade" or the "Company") forty-seven (47) third-party advertising and analytics partners that currently lack executed data processing agreements or equivalent contractual data-protection provisions. This compliance gap was identified in the data-mapping report prepared by Fieldhaven Consulting Group LLC ("Fieldhaven") dated May 19, 2025 (the "Fieldhaven Data-Mapping Report") and was subsequently confirmed and analyzed in detail in Calderwood & Harkness's Comprehensive Gap-Analysis Report dated August 15, 2025 (the "Gap-Analysis Report") and the Third-Party Data-Sharing Risk Assessment Memorandum dated August 4, 2025 (the "Risk Assessment Memorandum"). The absence of executed DPAs with these twenty-three partners was identified as one of the seven key compliance deficiencies in the Gap-Analysis Report—specifically, that twenty-three of Cascade's forty-seven third-party advertising partners lack executed data-processing agreements meeting the requirements of the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the broader set of applicable state privacy statutes.
The rollout will utilize the two DPA templates finalized today, September 30, 2025: (i) the Master Data Processing Agreement Template — Service Providers (the "Service Provider DPA Template") and (ii) the Master Data Processing Agreement Template — Contractors (the "Contractor DPA Template"). Each template has been adapted for compliance with CCPA/CPRA and the full set of nineteen (19) applicable state privacy statutes identified in the Gap-Analysis Report, including the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), and fourteen additional state-law regimes.
The target completion date for this rollout is December 31, 2025, at which point all twenty-three DPAs should be fully executed or, where execution is not feasible, alternative arrangements (including data-flow restructuring, transition to data-sharing agreements, or vendor-relationship termination) should be in place. This date aligns with the Phase 1 completion date established in the overall Cascade US State Privacy Compliance Program and the compliance-readiness certification milestone.
It should be noted that the restructured data-sharing agreement with Thornbridge Media Corp. ("Thornbridge")—Cascade's highest-priority advertising partner, with FY2024 advertising spend of approximately $18.4 million—is being handled on a separate, dedicated negotiation track. The Thornbridge negotiation has a target execution date of October 31, 2025, and is therefore excluded from the scope of this rollout plan. The Thornbridge arrangement is referenced herein only for purposes of coordination, as its negotiation outcomes will inform the treatment of certain Wave 3 vendors discussed in Section V.D below.
This memorandum addresses the classification framework for the twenty-three vendors, the DPA templates and vendor-specific schedules, the prioritization and phasing of the rollout, the detailed rollout process and workflow, tracking and reporting mechanisms, coordination with related workstreams, risk considerations, budget and resource requirements, and recommended next steps. We respectfully request that Meredith Tanaka and Diana Polk review and authorize the commencement of the Wave 1 vendor outreach on or before October 7, 2025, as further detailed in Section XII below.
II. Background
A. Cascade's Third-Party Advertising and Analytics Ecosystem
Cascade Retail Holdings Inc. operates one of the largest omnichannel retail platforms in the United States, and its advertising, analytics, and customer-engagement operations depend on a substantial ecosystem of third-party service providers and technology partners. As documented in the Fieldhaven Data-Mapping Report, Cascade currently shares consumer personal information with forty-seven (47) third-party advertising and analytics partners across a range of functional categories including programmatic advertising, display and social media advertising, search engine marketing, customer analytics, audience-segment building, cross-device identity resolution, measurement and attribution, email and push-notification marketing, data enrichment, and retargeting.
The categories of personal information shared with these third-party partners include, but are not limited to: (i) identifiers such as name, email address, phone number, device identifiers, IP addresses, and cookie IDs; (ii) commercial information including records of products purchased, considered, or added to cart, purchase history, and transaction amounts; (iii) internet or other electronic network activity information including browsing history, search history, and information regarding a consumer's interaction with the Cascade website, mobile application, and advertisements; (iv) geolocation data, including in certain instances precise geolocation data derived from mobile-device GPS signals; and (v) inferences drawn from the foregoing categories to create consumer profiles reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
Peakview Analytics Inc. ("Peakview"), Cascade's wholly owned advertising technology and customer analytics subsidiary, serves as the central data-processing hub for the Company's advertising and analytics ecosystem. Peakview processes approximately 2.1 billion consumer-event data records per month, encompassing website interactions, mobile application events, in-store transaction data, loyalty program engagement, and advertising-impression data. Peakview distributes processed data to the forty-seven third-party partners for purposes of ad targeting and personalization, audience-segment construction, campaign measurement and attribution, cross-device identity resolution, and customer-lifetime-value modeling.
Cascade's online platform, cascade.com, and its associated mobile applications utilize twelve (12) categories of cookies and tracking technologies, including first-party analytics cookies, third-party advertising cookies, social-media tracking pixels, cross-site tracking identifiers, session-replay technologies, and device-fingerprinting mechanisms. Many of these tracking technologies involve the collection and transmission of consumer personal information to or by the forty-seven third-party partners addressed in this memorandum.
Additionally, consumer personal information associated with the Cascade Rewards loyalty program, which has approximately 41.2 million registered members as of the date of this memorandum, and e-commerce transaction data from approximately 94 million annual online transactions flow through various partner integrations maintained by Peakview and Cascade's marketing technology stack. The scale and complexity of these data flows underscore the urgency of establishing contractual protections through executed DPAs with all partners receiving consumer personal information.
B. Regulatory Requirements for Data Processing Agreements
The legal imperative for this DPA rollout is grounded in the contractual requirements imposed by CCPA/CPRA and the other eighteen applicable state privacy statutes. Under CCPA/CPRA, businesses that disclose consumers' personal information to other entities must ensure that such disclosures are properly classified and contractually governed.
Under California Civil Code Section 1798.140(ag), as amended by CPRA, a "service provider" is defined as a legal entity that processes personal information on behalf of a business pursuant to a written contract that, among other things, prohibits the entity from (i) selling or sharing the personal information; (ii) retaining, using, or disclosing the personal information for any purpose other than for the business purposes specified in the contract, including retaining, using, or disclosing the personal information for a commercial purpose other than providing the services specified in the contract; (iii) retaining, using, or disclosing the information outside of the direct business relationship between the person and the business; and (iv) combining the personal information received from the business with personal information received from another source, except as expressly permitted.
Similarly, under California Civil Code Section 1798.140(j), a "contractor" is defined as a person to whom the business makes available a consumer's personal information for a business purpose, pursuant to a written contract that includes provisions requiring the contractor to comply with applicable obligations under the CCPA, granting the business the right to take reasonable and appropriate steps to ensure compliance, and requiring the contractor to notify the business if it can no longer meet its obligations under the CCPA. Critically, the contractor contract must include a prohibition on the contractor combining personal information received from the business with personal information it receives from or on behalf of another person or entity or collects from its own interaction with the consumer, subject to limited exceptions. The contractor must also certify that it understands the restrictions and will comply with them.
The failure to have such agreements in place carries significant consequences. Absent a written contract meeting the statutory requirements, a disclosure of personal information to a third-party entity may be classified as a "sale" under CCPA (California Civil Code Section 1798.140(ad)) or as "sharing" for cross-context behavioral advertising under CPRA (California Civil Code Section 1798.140(ah)). Such classification triggers mandatory consumer opt-out rights under Section 1798.120, obligations to honor the Global Privacy Control and other opt-out preference signals, additional disclosure requirements in privacy notices, and potential enforcement exposure from the California Attorney General and the California Privacy Protection Agency ("CPPA").
Analogous contractual requirements exist under each of the other eighteen applicable state privacy laws. The VCDPA (Va. Code § 59.1-578), CPA (Colo. Rev. Stat. § 6-1-1305), CTDPA (Conn. Gen. Stat. § 42-520), TDPSA (Tex. Bus. & Com. Code § 541.055), and OCPA (Or. Rev. Stat. § 646A.582), among others, each require controllers to enter into data processing agreements with their processors containing specified provisions regarding the nature and purpose of processing, the type of personal data subject to processing, the duration of processing, and the rights and obligations of both parties. While the terminology and specific requirements vary across jurisdictions, the common thread is that controllers must contractually bind their processors to limitations on data use and must ensure contractual protections for consumer personal information.
Of particular significance, the California Attorney General's informal inquiry letter dated February 6, 2024, which was directed to Cascade in connection with the Attorney General's review of Cascade's data-sharing practices, specifically highlighted deficiencies in Cascade's service-provider agreements. The inquiry noted that certain of Cascade's vendor relationships appeared to lack written contracts meeting the requirements of Section 1798.140(ag) and requested that Cascade provide documentation of its service-provider agreements. This deficiency remains open and unresolved, and it is a direct driver for the DPA rollout plan described in this memorandum. Continued failure to establish compliant DPAs with all applicable partners heightens the risk of a follow-up enforcement action by the California Attorney General's office, potentially including a formal investigative demand or civil enforcement proceeding.
C. Current State of DPA Coverage
As of the date of this memorandum, twenty-four (24) of Cascade's forty-seven (47) advertising and analytics partners currently have some form of data-handling agreement in place. This figure includes the existing Thornbridge Media Corp. arrangement, which, while technically documented by a legacy data-handling addendum executed in 2019, has been identified in the Risk Assessment Memorandum as materially deficient under current CCPA/CPRA requirements and is being restructured on a separate negotiation track as described in Section VIII.A below. The remaining twenty-three partners with existing agreements have contractual data-protection provisions of varying quality, many of which will require amendment or supplementation as part of the broader compliance program but are not the subject of this rollout plan.
The remaining twenty-three (23) partners lack any executed DPA, data-handling addendum, data-protection addendum, or contractual data-protection provisions meeting CCPA, CPRA, or applicable state-law standards. For these partners, there is currently no written contract governing the use, retention, or disclosure of consumer personal information disclosed by Cascade or Peakview. In the absence of such agreements, these twenty-three data-sharing relationships may constitute "sales" of personal information under CCPA, and Cascade may be unable to rely on the service-provider or contractor exemptions from the CCPA's opt-out and disclosure requirements. This represents a significant and ongoing compliance gap that must be addressed as a priority within the Phase 1 timeline.
III. DPA Classification Framework
A. Service Provider vs. Contractor Determination
A threshold determination in the DPA rollout process is the proper classification of each of the twenty-three partners as a "service provider," "contractor," or "third party" under CCPA/CPRA, and the analogous classification as a "processor" or "third party" under the other applicable state privacy statutes. The classification determines which DPA template applies and, in instances where a vendor cannot be contractually constrained to service-provider or contractor status, whether an alternative arrangement (such as a data-sharing agreement or relationship termination) is required.
The classification methodology applied in the Risk Assessment Memorandum (August 4, 2025) and further refined in connection with the DPA template finalization process evaluates each partner relationship along several dimensions, including the degree of Cascade's control and direction over the partner's data-processing activities, the partner's ability or need to use received personal information for its own independent purposes, the partner's data-combination practices, and the feasibility of contractually restricting the partner's data use to the parameters required by each classification category.
Service Providers (CCPA § 1798.140(ag) / "Processors" under VCDPA, Colorado CPA, CTDPA, TDPSA, OCPA, and analogous state statutes): This classification applies to vendors that process personal information on behalf of Cascade pursuant to a written contract, for specified business purposes, and are prohibited from retaining, using, or disclosing the personal information for any purpose other than performing services for Cascade as specified in the contract. Typical service-provider relationships involve vendors that act strictly at Cascade's direction and do not exercise independent judgment regarding the use of personal information received from Cascade. The service-provider classification is appropriate where the vendor's data-processing activities are conducted solely for Cascade's benefit, the vendor does not commingle Cascade data with data from other clients or its own independently collected data, and the vendor can be contractually bound to comply with the full range of service-provider restrictions under CCPA and the applicable state statutes.
Contractors (CCPA § 1798.140(j)): This classification applies to vendors to which Cascade makes personal information available pursuant to a written contract that includes heightened restrictions beyond those applicable to service providers. The contractor classification is relevant for vendors that may, in the course of providing services, use received personal information for certain limited purposes that extend beyond the strict confines of performing services at Cascade's direction—for example, data enrichment providers or cross-device identity resolution providers that may derive aggregate insights from processing activities conducted on behalf of multiple clients. The key distinguishing feature of the contractor classification is the express prohibition on combining personal information received from Cascade with personal information the contractor receives from or on behalf of another person or entity or collects from its own direct interaction with consumers, subject to the limited exceptions permitted under CCPA. Additionally, the contractor must certify its understanding of and compliance with the contractual restrictions, and the contract must include provisions granting Cascade the right to take reasonable and appropriate steps to ensure that the contractor uses the personal information in a manner consistent with Cascade's obligations under the CCPA.
Third Parties (CCPA § 1798.140(ai)): Where a partner's data practices cannot be contractually constrained to fit within the service-provider or contractor classification—because, for example, the partner independently determines the purposes and means of processing personal information received from Cascade, combines Cascade data with other data sources in ways that cannot be restricted, or retains and uses Cascade data for its own commercial purposes in a manner that goes beyond the exceptions permitted for contractors—the relationship constitutes a disclosure to a "third party" under CCPA. Such disclosures may be classified as a "sale" under Section 1798.140(ad) or as "sharing" for cross-context behavioral advertising under Section 1798.140(ah), in either case triggering consumer opt-out rights and additional disclosure obligations. For partners classified as third parties, the appropriate contractual instrument is a data-sharing agreement (rather than a DPA) that governs the terms of the sale or sharing and ensures compliance with applicable opt-out and disclosure requirements. Alternatively, the data flow to such partners may need to be restructured so that the relationship can be brought within the service-provider or contractor framework, or the relationship may need to be terminated entirely. The Thornbridge Media Corp. restructured data-sharing agreement currently under negotiation serves as the reference model for third-party arrangements.
B. Preliminary Classification of the 23 Partners
Based on the analysis conducted in connection with the Risk Assessment Memorandum and the subsequent diligence performed by Calderwood & Harkness in the course of the DPA template development process, the preliminary classification of the twenty-three partners lacking DPAs is as follows (subject to confirmation during the individual vendor outreach and diligence process in Waves 1 through 3 as described in Section V below):
Service Providers/Processors — Approximately 14 Vendors. These vendors are expected to qualify for the service-provider classification under CCPA and the processor classification under the other applicable state statutes. They include analytics providers that process consumer-event data solely at Cascade's direction to generate reporting and insights for Cascade's use; measurement and attribution vendors that track advertising-campaign performance on Cascade's behalf without retaining or using personal information for their own purposes; email marketing platforms that deliver communications to Cascade's customers based on audience segments and content specified by Cascade; and similar vendors whose data-processing activities are conducted exclusively for Cascade's benefit and at Cascade's instruction. These vendors will receive the Service Provider DPA Template.
Contractors — Approximately 6 Vendors. These vendors are expected to qualify for the contractor classification under CCPA. They include data enrichment providers that supplement Cascade's consumer profiles with additional data attributes; cross-device identity resolution providers that may process data from multiple clients in the course of linking consumer identities across devices; and similar vendors whose services inherently involve a degree of data processing that extends beyond the strict confines of the service-provider classification but that can be contractually restricted through the heightened requirements applicable to contractors, including the prohibition on combining Cascade personal information with data from other sources and the annual certification requirement. These vendors will receive the Contractor DPA Template.
Third Parties / Potential Restructuring Required — Approximately 3 Vendors. These vendors may need to be classified as third parties under CCPA because their current data practices involve independent determination of processing purposes, combination of Cascade data with data from other sources in ways that may not be amenable to contractual restriction, or retention and use of Cascade data for their own commercial advertising purposes. For these vendors, the rollout process will involve a determination of whether the data flow can be restructured—for example, by limiting the categories of personal information disclosed, restricting the purposes for which the vendor may use the data, or implementing technical controls to prevent data combination—such that the relationship can be brought within the service-provider or contractor framework. If restructuring is not feasible, these vendors will either be transitioned to data-sharing agreements modeled on the Thornbridge Media Corp. arrangement or, as a last resort, the data-sharing relationship will be terminated. As an interim safeguard, if these relationships remain uncontracted by December 15, 2025, the data flows will be surfaced through the OnPoint Data Solutions Inc. consent-management platform ("CMP") as "sale/sharing" for consumer opt-out purposes upon CMP go-live.
Final classification for each of the twenty-three vendors will be confirmed during the vendor outreach and diligence phase of the applicable wave, as described in Section V. Calderwood & Harkness will communicate any classification changes or reclassification recommendations to Diana Polk and Meredith Tanaka promptly as they arise during the rollout process.
IV. DPA Templates and Vendor-Specific Schedules
A. Master DPA Template — Service Providers
The Master Data Processing Agreement Template — Service Providers was finalized on September 30, 2025, and is being delivered to Cascade under separate cover concurrently with this memorandum. The Service Provider DPA Template has been designed to serve as the standard form agreement for all vendor relationships classified under the service-provider/processor framework across all applicable jurisdictions.
The key provisions of the Service Provider DPA Template include the following:
1. Limitations on Use, Retention, and Disclosure of Personal Information. The vendor is prohibited from selling or sharing the personal information; retaining, using, or disclosing the personal information for any purpose other than performing the services specified in the agreement; retaining, using, or disclosing the personal information outside of the direct business relationship between the vendor and Cascade; and combining the personal information with personal information received from other sources, except as expressly permitted for the purpose of performing the specified services.
2. Compliance with CCPA and Applicable State Privacy Statutes. The vendor is obligated to comply with all applicable provisions of CCPA/CPRA and each of the nineteen applicable state privacy statutes identified in the agreement, and to process personal information only in accordance with Cascade's documented instructions.
3. Compliance-Assistance Obligations. The vendor is required to assist Cascade in fulfilling its obligations under applicable privacy laws, including cooperation with consumer data subject requests ("DSRs") for access, deletion, correction, and opt-out; pass-through of opt-out preference signals, including the Global Privacy Control; and assistance with data-protection impact assessments and regulatory inquiries.
4. Audit Rights. Cascade retains the right to conduct audits or inspections, or to engage a qualified independent assessor to conduct audits, of the vendor's data-processing activities and compliance with the DPA, upon reasonable notice and subject to reasonable confidentiality protections.
5. Sub-Processor Restrictions and Flow-Down Requirements. The vendor may not engage sub-processors to process Cascade personal information without Cascade's prior written consent. All sub-processor engagements must be governed by written agreements imposing data-protection obligations no less restrictive than those set forth in the DPA, with the vendor remaining fully liable for the acts and omissions of its sub-processors.
6. Deletion and Return Obligations Upon Termination. Upon termination or expiration of the service relationship, the vendor must, at Cascade's election, return or delete all personal information processed under the DPA, and certify in writing that it has done so, subject to limited exceptions for data required to be retained by applicable law.
7. Certification of Understanding. The vendor must certify that it understands the restrictions and prohibitions set forth in the DPA and will comply with them, in accordance with the certification requirements of CCPA Section 1798.100(d).
8. Data Breach and Incident Notification. The vendor must notify Cascade of any actual or reasonably suspected security incident or personal-data breach within seventy-two (72) hours of discovery, and must cooperate with Cascade's incident-response and notification activities.
9. Indemnification for Unauthorized Use. The vendor must indemnify, defend, and hold harmless Cascade and its affiliates from and against any losses, liabilities, damages, costs, and expenses (including reasonable attorneys' fees) arising from or related to the vendor's unauthorized use, disclosure, or processing of personal information in violation of the DPA.
The Service Provider DPA Template is designed for multi-state compliance across all nineteen applicable statutes, utilizing a single base agreement with state-specific schedules appended where the requirements of a particular jurisdiction diverge from or supplement the baseline CCPA/CPRA provisions. This approach minimizes the number of distinct agreements to be negotiated while ensuring comprehensive coverage across all relevant jurisdictions.
B. Master DPA Template — Contractors
The Master Data Processing Agreement Template — Contractors was likewise finalized on September 30, 2025, and is being delivered to Cascade under separate cover. The Contractor DPA Template includes all of the provisions described above for the Service Provider DPA Template, and supplements them with the following heightened restrictions required for the contractor classification under CCPA:
1. Express Prohibition on Data Combination. The contractor is expressly prohibited from combining personal information received from or on behalf of Cascade with personal information that the contractor receives from or on behalf of another person or persons, or that the contractor collects from its own interaction with the consumer, except as expressly permitted by CCPA Section 1798.140(j)(1)(A)(iv) (i.e., to perform the business purpose specified in the contract).
2. Annual Certification Requirement. The contractor must provide Cascade with an annual written certification, executed by a duly authorized officer or representative, confirming that the contractor understands its obligations under the DPA and under applicable law, that it has not engaged in any prohibited use, disclosure, or combination of Cascade personal information, and that it has implemented and maintained reasonable security measures to protect the personal information.
3. Enhanced Compliance-Monitoring Provisions. The DPA includes provisions granting Cascade enhanced rights to monitor the contractor's compliance, including the right to request and review the contractor's data-processing records, conduct or commission compliance assessments on an annual basis, and require the contractor to implement additional safeguards if compliance deficiencies are identified.
The Contractor DPA Template is intended for use with the approximately six vendors expected to qualify for the contractor classification, and may also be deployed for any vendor whose classification is uncertain pending diligence confirmation, as the contractor template imposes stricter requirements and thus provides a higher degree of contractual protection.
C. Vendor-Specific Schedules
Each executed DPA, whether using the Service Provider or Contractor template, will be accompanied by a vendor-specific schedule (designated as Exhibit A or Schedule A to the DPA) that particularizes the data-processing relationship for the specific vendor. The vendor-specific schedule will specify the following:
(i) Categories of Personal Information Disclosed. A detailed enumeration of the categories of personal information that Cascade or Peakview will disclose to or make available to the vendor, drawn from the categories identified in the Fieldhaven Data-Mapping Report (e.g., identifiers, commercial information, internet/network activity, geolocation, inferences).
(ii) Categories of Consumers Whose Personal Information Is Disclosed. Identification of the consumer populations whose personal information is subject to the data-processing relationship (e.g., cascade.com website visitors, Cascade Rewards loyalty program members, e-commerce customers, mobile application users).
(iii) Business Purposes or Specified Processing Purposes. A precise description of the business purposes for which the personal information is disclosed and the processing activities that the vendor is authorized to perform (e.g., programmatic ad serving, measurement and attribution reporting, audience-segment construction, email-campaign delivery).
(iv) Duration of Processing. The term during which the vendor is authorized to process the personal information, including any retention period following the completion of the specified processing activities.
(v) Applicable Data-Retention Periods. Cross-reference to Cascade's Data Retention & Disposal Schedule, specifying the maximum retention period for each category of personal information processed by the vendor, and the vendor's obligations to delete or return data upon expiration of the applicable retention period.
(vi) Approved Sub-Processors. Identification of any sub-processors that the vendor is authorized to engage for the processing of Cascade personal information, along with a description of the sub-processor's role and the applicable contractual flow-down obligations.
Calderwood & Harkness will prepare the vendor-specific schedules for each of the twenty-three vendors using data from the Fieldhaven Data-Mapping Report as the primary source. Before transmittal to the respective vendors, each schedule will be reviewed and validated by Priya Nandakumar (Vice President, Data & Analytics, Cascade) for accuracy regarding data flows, processing activities, and technical integrations, and by Jason Leclaire (Vice President, Marketing & Customer Engagement, Cascade) for accuracy regarding marketing and advertising-partner use cases, campaign structures, and business purposes. This internal validation step is critical to ensuring that the vendor-specific schedules accurately reflect the actual data-processing activities and can serve as a reliable basis for ongoing compliance monitoring.
V. Rollout Prioritization and Phasing
A. Prioritization Criteria
The twenty-three vendors lacking DPAs have been organized into three waves for purposes of outreach, negotiation, and execution. The wave assignments are based on a multi-factor prioritization analysis that considers the following criteria:
1. Data Volume. The volume of consumer personal information received or processed by the partner, measured by the number of records disclosed, the frequency of data transfers (e.g., real-time, daily batch, weekly), and the breadth of data categories involved. Partners receiving the largest volumes of personal information present the greatest compliance exposure and are prioritized accordingly.
2. Data Sensitivity. Whether the partner receives categories of personal information that are classified as "sensitive personal information" under CCPA/CPRA or as "sensitive data" under other applicable state statutes, including precise geolocation data, payment-card data, or data from which inferences about protected characteristics may be drawn. Partners receiving sensitive personal information without adequate contractual protections represent heightened regulatory risk.
3. Risk Classification. Whether the partner's current data-processing practices, absent a DPA, are likely to constitute a "sale" or "sharing" of personal information under CCPA or analogous state statutes. Partners whose data practices most closely resemble third-party data sharing—rather than service-provider or contractor processing—are prioritized to minimize the period of uncontracted exposure.
4. Regulatory Exposure. Whether the partner's data-processing activities were specifically identified or implicated in prior regulatory inquiries directed at Cascade, including the Federal Trade Commission Civil Investigative Demand (File No. 232-0147) and the California Attorney General's informal inquiry letter dated February 6, 2024. Partners whose data flows were the subject of regulatory scrutiny receive priority treatment in recognition of the elevated enforcement risk.
5. Revenue Significance. Cascade's annual spend with the partner and the business criticality of the partner's services to Cascade's advertising and analytics operations. Partners with significant annual spend represent both higher financial exposure in the event of a relationship disruption and greater leverage in negotiating DPA terms.
These criteria were applied in consultation with Diana Polk and with input from the Fieldhaven Data-Mapping Report and the Risk Assessment Memorandum to produce the three-wave structure described below. The wave assignments are subject to adjustment if circumstances change during the rollout process—for example, if a vendor's risk classification is revised based on new information obtained during the diligence phase.
B. Wave 1 — High Priority (Target: October 31, 2025)
Number of Vendors: Eight (8)
Wave 1 encompasses the eight vendors that present the highest compliance priority based on the criteria described above. These vendors are characterized by one or more of the following attributes: (i) they receive the largest volumes of Peakview Analytics behavioral data, including real-time or near-real-time data feeds of consumer browsing, search, and purchase activity; (ii) they are involved in the programmatic-advertising supply chain and receive personal information in connection with real-time bidding, ad-exchange transactions, or demand-side platform integrations (excluding Thornbridge Media Corp., which is handled on the separate negotiation track described in Section VIII.A); (iii) they receive sensitive personal information, including precise geolocation data, without contractual restrictions on its use or retention; or (iv) their data-processing activities were specifically implicated in the California Attorney General's February 6, 2024 inquiry.
The data flows to these eight vendors are, in the assessment of Calderwood & Harkness, the most likely among the twenty-three uncontracted relationships to constitute a "sale" or "sharing" of personal information under CCPA in the absence of DPA execution. Accordingly, these vendors are prioritized for immediate outreach and aggressive negotiation to minimize the period of uncontracted exposure.
Calderwood & Harkness will prepare and transmit outreach letters and draft DPAs (with pre-populated vendor-specific schedules) to all eight Wave 1 vendors within five (5) business days of the date of this memorandum—that is, by October 7, 2025. The target date for full execution of all eight Wave 1 DPAs is October 31, 2025. Given the compressed timeline, Calderwood & Harkness will allocate additional attorney resources to Wave 1 negotiations and will coordinate closely with Diana Polk and the Cascade internal team to facilitate rapid turnaround on vendor-specific schedule validation, redline review, and execution.
C. Wave 2 — Medium Priority (Target: November 30, 2025)
Number of Vendors: Nine (9)
Wave 2 encompasses nine vendors of moderate compliance priority. These vendors are predominantly analytics and measurement partners with moderate data volumes and less complex data flows than the Wave 1 vendors. The majority of Wave 2 vendors are expected to qualify for the service-provider classification, with relatively straightforward data-processing relationships that should facilitate efficient negotiation. Typical Wave 2 vendors include web-analytics platforms, A/B testing and optimization tools, campaign-performance measurement providers, and marketing-automation platforms that process personal information at Cascade's direction for specified and limited business purposes.
Outreach letters and draft DPAs for Wave 2 vendors will be transmitted by October 20, 2025. This schedule allows Calderwood & Harkness to incorporate any lessons learned from the Wave 1 outreach and negotiation process, including common vendor objections, typical redline patterns, and any template refinements that may be warranted based on Wave 1 experience. The target date for full execution of all nine Wave 2 DPAs is November 30, 2025.
D. Wave 3 — Lower Priority / Complex Negotiations (Target: December 31, 2025)
Number of Vendors: Six (6)
Wave 3 encompasses the remaining six vendors. While these vendors generally involve lower data volumes than the Wave 1 and Wave 2 vendors, they are grouped in the final wave because they present more complex classification and negotiation challenges. Specifically, this wave includes the approximately three vendors that, based on the preliminary classification analysis, may require classification as third parties under CCPA due to the nature of their data-processing practices, or that may require restructuring of the data flow to fit within the service-provider or contractor parameters.
For the three potentially third-party-classified vendors, the rollout process will involve an initial assessment during the outreach phase of whether the vendor's data practices can be restructured to qualify for service-provider or contractor status. Restructuring options may include limiting the categories of personal information disclosed to the vendor, restricting the vendor's use of the data to specified business purposes, requiring the vendor to maintain separate processing environments for Cascade data, or implementing technical controls (such as data clean rooms or aggregation requirements) to prevent the combination of Cascade data with data from other sources. Calderwood & Harkness will work with Priya Nandakumar and the Peakview technical team to evaluate the feasibility and business impact of each restructuring option.
If restructuring is not feasible for a particular vendor, the vendor will be transitioned to a data-sharing agreement modeled on the restructured Thornbridge Media Corp. agreement (target execution October 31, 2025). This approach recognizes that certain vendor relationships may, by their nature, involve disclosures that constitute "sales" or "sharing" under CCPA, and the appropriate compliance response is not to force the relationship into an ill-fitting service-provider or contractor framework but rather to ensure that the sharing is properly documented, disclosed to consumers, and subject to opt-out rights. As a last resort, if neither a DPA nor a data-sharing agreement can be agreed upon with a particular vendor, Calderwood & Harkness will recommend termination of the data-sharing relationship, subject to Meredith Tanaka's approval and appropriate business transition planning with Jason Leclaire.
As a fallback for interim risk mitigation, any data flows to Wave 3 vendors that remain uncontracted by December 15, 2025, will be surfaced through the OnPoint Data Solutions Inc. consent-management platform as "sale/sharing" for consumer opt-out purposes upon the CMP's go-live on that date. This will ensure that even if certain Wave 3 negotiations extend beyond the target deadline, consumers are afforded the opt-out rights to which they are entitled under CCPA and applicable state law.
Outreach letters and draft DPAs (or, for potentially third-party-classified vendors, introductory letters outlining the classification assessment and proposed restructuring options) will be transmitted to Wave 3 vendors by November 15, 2025. The target date for all Wave 3 DPAs or alternative arrangements to be finalized is December 31, 2025, coinciding with the Phase 1 completion date and the compliance-readiness certification milestone.
VI. Rollout Process and Workflow
A. Step 1: Vendor Outreach and Data Confirmation
The rollout process for each wave will commence with the transmittal of a formal vendor outreach letter and draft DPA to each vendor in the wave. Calderwood & Harkness will prepare the outreach letters on Cascade Retail Holdings Inc. letterhead, to be signed by Diana Polk in her capacity as Associate General Counsel and Interim Chief Privacy Officer. The outreach letters will be tailored for each vendor but will follow a standard format introducing Cascade's privacy compliance program, explaining the regulatory requirements under CCPA/CPRA and applicable state privacy statutes that necessitate the execution of a DPA, and requesting the vendor's review and execution of the enclosed agreement.
Each outreach package transmitted to a vendor will include the following materials:
(i) The outreach letter, as described above.
(ii) The applicable DPA template (Service Provider DPA Template or Contractor DPA Template, as determined by the preliminary classification), in clean form.
(iii) The vendor-specific schedule (Exhibit/Schedule A), pre-populated by Calderwood & Harkness based on the data flows, processing activities, and integration details documented in the Fieldhaven Data-Mapping Report, and validated by Cascade's internal team prior to transmittal.
(iv) A response deadline of fifteen (15) business days from the date of transmittal, by which the vendor is requested to either execute and return the DPA or provide any proposed redlines or comments.
Prior to transmittal, each vendor-specific schedule will undergo an internal validation process. Priya Nandakumar, as VP of Data & Analytics, will review and confirm the accuracy of the data-flow descriptions, categories of personal information, processing activities, technical integration details, and data-retention period references in the schedule. Jason Leclaire, as VP of Marketing & Customer Engagement, will review and confirm the accuracy of the business-purpose descriptions, advertising and marketing use cases, and campaign-related processing activities. This dual-review process is essential to ensuring that the vendor-specific schedules are both legally defensible and operationally accurate, and that they provide a reliable foundation for ongoing compliance monitoring and enforcement.
Calderwood & Harkness will maintain a log of all outreach packages transmitted, including the date of transmittal, the method of delivery (email and, for Wave 1 vendors, concurrent delivery by overnight courier), and the designated vendor contact for each package.
B. Step 2: Vendor Review, Negotiation, and Redlining
Upon receipt of the outreach package, each vendor will have the opportunity to review the DPA and vendor-specific schedule and to provide proposed redlines, comments, or counterproposals. Calderwood & Harkness will review all vendor redlines and negotiate modifications in coordination with Diana Polk, ensuring that any agreed-upon changes are consistent with CCPA/CPRA requirements and do not compromise Cascade's compliance position.
Based on our experience with similar DPA rollout programs and our familiarity with the advertising and analytics vendor ecosystem, we anticipate that the most common negotiation issues will include the following:
(i) Scope of Audit Rights. Vendors may seek to narrow Cascade's audit rights by imposing limitations on audit frequency, requiring advance notice periods of 60 or 90 days, restricting audits to document reviews (as opposed to on-site inspections), or requiring Cascade to bear the costs of audits. Calderwood & Harkness's position is that CCPA requires meaningful audit rights, and while reasonable limitations on frequency and notice are acceptable, the core right to audit compliance with the DPA's data-processing restrictions must be preserved.
(ii) Indemnification for Regulatory Fines. Vendors may resist indemnification obligations that extend to regulatory fines or penalties imposed on Cascade as a result of the vendor's non-compliance with the DPA. This is a significant provision, and Calderwood & Harkness will seek to retain the indemnification obligation in all DPAs, while recognizing that certain smaller vendors may have legitimate concerns about uncapped fine exposure.
(iii) Sub-Processor Consent Mechanisms. Vendors may prefer a general authorization to engage sub-processors, with a notification mechanism and a right for Cascade to object, rather than a prior written consent requirement for each sub-processor engagement. Calderwood & Harkness is prepared to accept a general authorization with prior notification (e.g., 30 days' advance notice) and an objection right, provided that the vendor maintains a current list of approved sub-processors and ensures that all sub-processors are bound by data-processing obligations no less restrictive than those in the DPA.
(iv) Data-Breach Notification Timelines. The template specifies notification within 72 hours of discovery. Vendors may seek to extend this period to 96 hours or to qualify the obligation with a materiality threshold. Calderwood & Harkness will endeavor to maintain the 72-hour notification requirement, consistent with the strictest applicable state-law requirements.
(v) Limitation of Liability Carve-Outs for Data-Protection Obligations. Vendors may seek to subject data-protection indemnification obligations and damages related to data breaches or unauthorized data use to general limitation-of-liability caps in the underlying services agreement. Calderwood & Harkness's position is that data-protection obligations should be carved out from general limitation-of-liability provisions, or at minimum subject to a separate, higher cap, to ensure that the DPA's contractual protections have meaningful economic force.
Kevin Ostrowski will be consulted on and will approve any material deviations from the template provisions. For purposes of this rollout, "material deviations" include: (a) any modification to the restrictions on use, retention, or disclosure of personal information that could jeopardize the service-provider or contractor classification under CCPA; (b) any elimination or material narrowing of Cascade's audit rights; (c) any removal of the indemnification obligation for unauthorized data use; (d) any modification to the sub-processor flow-down requirements that would allow sub-processors to operate without equivalent contractual restrictions; and (e) any change to the data-deletion or return-upon-termination obligations that would permit the vendor to retain personal information beyond the specified retention period. All other negotiation points may be resolved at the discretion of Alan Burke and Sara Hendricks, in consultation with Diana Polk.
Sara Hendricks will track all vendor negotiations in the centralized DPA status tracker described in Section VII.A below, ensuring that the current status, outstanding issues, and target execution dates for each vendor are accurately reflected and available for reporting purposes.
C. Step 3: Internal Cascade Review and Execution
Upon completion of negotiations and finalization of the DPA and vendor-specific schedule, each agreement will be routed to Cascade for internal review and countersignature. Executed DPAs will be reviewed and countersigned by Diana Polk as Associate General Counsel and Interim Chief Privacy Officer, except that agreements with vendors where Cascade's annual spend exceeds $1 million will be countersigned by Meredith Tanaka as General Counsel, in accordance with Cascade's existing contract-execution authority matrix.
Copies of all executed DPAs, including the base agreement, vendor-specific schedule, and any negotiated amendments or side letters, will be maintained in Cascade's contract management system. Duplicate copies will be maintained in the Calderwood & Harkness matter file (Matter No. 1038-00010) for reference in connection with ongoing compliance monitoring, regulatory inquiries, and the compliance-readiness certification.
D. Step 4: Post-Execution Integration
Execution of the DPA is not the final step in the process. Upon execution, the following post-execution integration activities will be performed to ensure that the DPA is operationalized within Cascade's broader privacy compliance infrastructure:
(i) Data-Mapping Inventory Update. Each vendor's confirmed classification (service provider, contractor, or third party) will be recorded in Cascade's data-mapping inventory maintained by Fieldhaven Consulting Group LLC. Fieldhaven will update the inventory to reflect the existence of the executed DPA, the applicable classification, the categories of personal information covered, and the authorized processing purposes, ensuring that the data-mapping inventory is current and accurate for purposes of ongoing compliance monitoring and regulatory reporting.
(ii) Peakview Analytics Data-Flow Documentation. The vendor-specific schedules will be incorporated into Peakview Analytics' internal data-flow documentation, ensuring that Peakview's data-distribution activities are aligned with the contractual terms of each executed DPA and that any technical integration parameters (e.g., data-feed configurations, API permissions, cookie-sync relationships) are consistent with the authorized processing purposes.
(iii) OnPoint CMP Configuration. The vendor classifications will be reflected in the configuration of the OnPoint Data Solutions Inc. consent-management platform. Specifically, data flows to service-provider- and contractor-classified vendors will be configured as covered by the applicable DPA and exempt from the opt-out-of-sale/sharing mechanism, while any data flows to third-party-classified vendors will be surfaced for consumer opt-out in accordance with CCPA and applicable state-law requirements.
(iv) Annual Re-Certification Calendaring. For vendors classified as contractors, the annual re-certification requirement will be calendared to ensure timely collection of the vendor's written certification of compliance. Calderwood & Harkness will provide the initial calendar entries and Diana Polk's office will assume responsibility for ongoing re-certification tracking.
VII. Tracking and Reporting
A. DPA Status Tracker
Calderwood & Harkness will create and maintain a centralized DPA Status Tracker in spreadsheet format to provide real-time visibility into the status of each of the twenty-three vendor DPA engagements throughout the rollout process. The tracker will include the following fields for each vendor:
Sara Hendricks will be primarily responsible for maintaining the tracker, updating it promptly upon each status change. The tracker will be shared with Diana Polk on a weekly basis and will be accessible to all members of the Calderwood & Harkness engagement team. The tracker will also serve as the basis for the biweekly status reports described below and for the DPA rollout status update to be included in the Board Presentation Memorandum for the Audit & Risk Committee meeting.
B. Biweekly Status Reports
Alan Burke will provide biweekly written status reports to Meredith Tanaka and Diana Polk, with copies to Kevin Ostrowski, on the progress of the DPA rollout. Each biweekly status report will include the following information:
• Total number of DPAs transmitted to date, broken down by wave.
• Number of DPAs currently under negotiation, including identification of any negotiations that are behind schedule or encountering significant vendor resistance.
• Number of DPAs fully executed to date.
• Identification of any vendors requiring escalation or alternative treatment (e.g., vendors that have failed to respond, vendors that have rejected material DPA provisions, vendors whose classification has been revised based on diligence findings).
• Summary of any recurring negotiation issues or template modifications that may warrant discussion.
• Any issues requiring client decision-making, such as approval of material deviations, authorization of vendor-relationship termination, or adjustments to the rollout timeline.
The first biweekly status report will be issued on or about October 14, 2025, coinciding with the first week following the Wave 1 outreach. Subsequent reports will be issued on a biweekly cadence through the completion of the rollout on December 31, 2025.
The DPA rollout status will also be incorporated into the Board Presentation Memorandum being prepared for the November 13, 2025 meeting of the Cascade Retail Holdings Inc. Board of Directors Audit & Risk Committee, chaired by Ellen Marchetti. The Board Presentation Memorandum will include a summary of the DPA rollout progress as part of the broader privacy-compliance program update, including the number of DPAs executed, the number remaining, and any material issues or risks identified during the rollout process.
C. Escalation Protocol
To ensure that the rollout proceeds on schedule and that compliance risks are addressed promptly, the following escalation protocol will apply:
Non-Responsive Vendors. Any vendor that fails to respond to the outreach package within fifteen (15) business days of transmittal will receive a follow-up communication from Calderwood & Harkness on behalf of Cascade. If the vendor fails to respond within ten (10) additional business days following the follow-up communication (i.e., twenty-five business days total from initial transmittal), the matter will be escalated to Kevin Ostrowski for strategic assessment and to Diana Polk for a determination of next steps.
Rejection of Material Provisions. Any vendor that rejects material DPA provisions—including the restrictions on use, retention, and disclosure of personal information; the audit rights; or the prohibition on data combination (for contractor-classified vendors)—and is unwilling to negotiate acceptable alternative terms will be escalated to Kevin Ostrowski for strategic assessment. Kevin Ostrowski will evaluate whether the vendor's proposed terms can be accommodated without compromising Cascade's compliance position and will make a recommendation to Diana Polk.
Alternative Treatment Options. If a vendor refuses to execute a DPA by the applicable wave deadline, the following alternative options will be evaluated: (a) restructuring the data flow to eliminate the sharing of personal information with the vendor, such that a DPA is no longer required; (b) transitioning the vendor to a data-sharing agreement with full consumer opt-out compliance via the OnPoint CMP; or (c) terminating the vendor relationship entirely. Each of these options carries potential business and financial implications, and any recommendation for vendor-relationship termination will be made jointly by Calderwood & Harkness and Cascade's Marketing team (Jason Leclaire), taking into account the vendor's role in Cascade's advertising and analytics operations, the availability of alternative vendors, and the financial impact of termination. Termination decisions require the approval of Meredith Tanaka.
VIII. Coordination with Related Workstreams
The DPA rollout does not exist in isolation. It is one component of the broader Cascade US State Privacy Compliance Program, and its success depends on effective coordination with several related workstreams. This section identifies the key coordination points and the interfaces between the DPA rollout and other program elements.
A. Thornbridge Media Corp. — Separate Track
As noted in the Executive Summary and throughout this memorandum, the restructured Data-Sharing Agreement with Thornbridge Media Corp. is being handled on a dedicated, parallel negotiation track outside the scope of this rollout plan. Thornbridge is Cascade's single largest advertising partner, with FY2024 spend of approximately $18.4 million, and the restructuring of its data-sharing arrangement involves complex commercial, technical, and legal considerations that warrant individualized treatment.
The Thornbridge negotiation is currently in active progress with Victor Sandoval of Kellner Park & Associates LLP (outside counsel to Thornbridge) and Leah Voss (Thornbridge General Counsel). The target execution date for the restructured Thornbridge Data-Sharing Agreement is October 31, 2025, consistent with the Phase 1 timeline. Calderwood & Harkness is managing the Thornbridge negotiation in parallel with the DPA rollout and will ensure that the two tracks remain coordinated.
Thornbridge is not counted among the twenty-three vendors in this rollout plan. However, the provisions and negotiation outcomes in the Thornbridge agreement will have direct relevance to the treatment of the approximately three Wave 3 vendors that may require classification as third parties and transition to data-sharing agreements rather than DPAs. Specifically, the Thornbridge agreement is expected to establish the contractual template and negotiation precedent for third-party data-sharing arrangements, including provisions governing the scope of permitted data use, consumer opt-out mechanisms, data-sharing disclosures, audit rights, and financial terms. Once the Thornbridge agreement is finalized, Calderwood & Harkness will adapt its key provisions for use with the Wave 3 vendors as needed.
B. OnPoint Data Solutions