Attachment: Phase_1_Kickoff_Agenda_June_16_2025.pdf
Diana and Meredith,
I hope this message finds you both well. I am writing to confirm that the Phase 1 kickoff meeting and data-mapping workshop is scheduled for Monday, June 16, 2025, from 10:00 AM to 4:00 PM Pacific (1:00 PM to 7:00 PM Eastern). The meeting will be held at Cascade's headquarters at 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119, with a videoconference option available for remote participants.
Kevin Ostrowski and I will attend in person from Calderwood & Harkness. Sara Hendricks will join by videoconference from our New York office (600 Lexington Avenue, 28th Floor, New York, NY 10022). Marcus Ellerby and Fieldhaven's technical team will attend in person, traveling from their San Francisco office.
Please find attached the full proposed agenda (Phase_1_Kickoff_Agenda_June_16_2025.pdf). I have summarized the key agenda items below for your reference.
---
**PROPOSED AGENDA — SUMMARY**
**1. Welcome & Introductions (10:00 – 10:30 AM PT)**
We will begin with introductions of the full project team:
- **Calderwood & Harkness LLP:** Kevin Ostrowski (Responsible Partner), Rachel Bernstein (Billing Partner), Alan Burke (Lead Associate), and Sara Hendricks (Working Associate, via video) - **Cascade Retail, Inc.:** Meredith Tanaka (General Counsel), Diana Polk (Associate General Counsel / Interim CPO), Gregory Farris (CISO), Priya Nandakumar (VP, Data & Analytics), and Jason Leclaire (VP, Marketing & Customer Engagement) - **Fieldhaven Consulting Group LLC:** Marcus Ellerby (Engagement Lead), plus technical staff
Please note that Jason Leclaire's attendance is specifically requested for the afternoon sessions (beginning at 2:30 PM PT), though he is of course welcome to join for the full day.
**2. Engagement Scope Review (10:30 – 11:15 AM PT)**
We will review the scope of the engagement opened June 2, 2025 (Matter No. 1038-00010). As a reminder, the engagement encompasses a comprehensive U.S. state-privacy compliance program covering the CCPA/CPRA and the 19 applicable state privacy statutes identified to date. Coverage areas include:
- Cascade's direct-to-consumer retail operations across 186 retail locations in 31 states - The e-commerce platform (cascade.com) - The third-party marketplace operated by Cascade Digital Marketplace LLC, hosting approximately 3,800 third-party sellers - The Cascade Rewards loyalty program (approximately 41.2 million registered members) - The advertising technology stack operated through Peakview Analytics Inc. - Vendor and service-provider data practices
We will also review the two-phase engagement structure: Phase 1 (assessment through implementation-readiness, through December 31, 2025) and Phase 2 (ongoing monitoring, training, and regulatory response, January 1 – June 30, 2026). I will briefly address coordination with Whitfield Greaves LLP (Carolyn J. Marsden) on SEC disclosure and board-governance aspects, pursuant to the common-interest agreement executed today, June 10, 2025.
**3. Fieldhaven Data-Mapping Report — Key Findings (11:15 AM – 12:15 PM PT)**
Marcus Ellerby will present findings from Fieldhaven's data-mapping report dated May 19, 2025. Key data points for discussion include:
- Peakview Analytics Inc. processes approximately 2.1 billion consumer-event data records per month for ad targeting and personalization - Cascade shares consumer data with 47 third-party advertising and analytics partners - 12 categories of cookies and tracking technologies are deployed on cascade.com - Commingling of third-party seller data (Cascade Digital Marketplace) with first-party customer data in a single data lake without role-based access controls - 23 of the 47 third-party advertising partners lack executed data-processing agreements
Calderwood & Harkness's legal overlay review of the identified data flows will follow in a separate memorandum. Gregory and Priya have been identified as key subject-matter experts for the technical Q&A portion of this session.
**4. Working Lunch (12:15 – 1:00 PM PT)**
**5. Preliminary Compliance Gap Overview (1:00 – 2:30 PM PT)**
We will discuss preliminary compliance gaps identified through the Fieldhaven report and Calderwood & Harkness's initial legal review. Topics include:
- Cascade's current online privacy policy was last updated in March 2022 and does not address 14 of the 19 applicable state statutes - No universal opt-out mechanism (Global Privacy Control / "Do Not Sell or Share") is currently honored - Sensitive personal information processing — specifically, precise geolocation data from the Cascade mobile app — occurs without the separate opt-in consent required under the CCPA/CPRA - No documented data-retention schedule exists for customer-transaction or loyalty data - The consumer-rights intake process (DSR portal) does not verify identity to CCPA standards and lacks appeal-process functionality required by Virginia, Colorado, Connecticut, and other state laws - FY2024 DSR metrics: approximately 38,400 total requests received (access: ~12,800; deletion: ~19,100; opt-out of sale/sharing: ~6,500), with an average response time of 27 calendar days against a program target of ≤ 15 business days
We will also make a brief, high-level reference to lessons learned from prior regulatory interactions. The details of those interactions will be addressed separately in a privileged memorandum and are not intended for discussion in this mixed-audience setting.
**6. Advertising & Data-Sharing Partners — Initial Discussion (2:30 – 3:15 PM PT)**
This session will focus on the Thornbridge Media Corp. relationship (FY2024 annual spend: $18.4 million) as the highest-priority data-sharing arrangement requiring restructuring. We will also discuss the framework for classifying all 47 partners as service providers, contractors, or third parties under the CCPA and equivalent state-law frameworks. Jason Leclaire will provide business context on advertising and loyalty-program data flows.
**7. Milestone Timeline & Next Steps (3:15 – 4:00 PM PT)**
We will review the following Phase 1 milestones:
| Milestone
We will assign action items and responsible parties during this session and discuss the initial data and document requests outlined below.
---
**INITIAL DATA-REQUEST LIST**
At the meeting, we will circulate a formal initial data-request list. To give your teams advance notice, the request will cover the following categories:
1. Current privacy policy and all consumer-facing notices 2. Existing vendor/partner contracts and DPAs (to the extent they exist) for all 47 advertising/analytics partners 3. Cascade Rewards program terms and conditions 4. Cascade Digital Marketplace seller terms of service 5. OnPoint Data Solutions Inc. SaaS agreement (consent-management platform; 3-year term; $480,000/year annual license) 6. Fieldhaven Consulting Group LLC statement of work ($3,150,000 fixed fee) 7. FY2024 DSR log and response-time metrics 8. Peakview Analytics data-flow documentation 9. Current data-retention policies (if any) 10. Mobile app permissions and geolocation data collection disclosures 11. Any correspondence with the FTC and the California Attorney General's office (to be handled separately under privilege protocols)
---
**PRE-MEETING REQUESTS**
In advance of the meeting, I would appreciate confirmation on the following:
- **Diana:** Could you please confirm attendance for all Cascade participants, and in particular whether Jason Leclaire is available for the afternoon sessions (beginning at 2:30 PM PT)? - **Marcus:** Could you confirm whether the Fieldhaven team will bring updated data-flow diagrams beyond those included in the May 19, 2025 report? - **Gregory:** Could you confirm that the meeting room at Suite 1200 will have secure videoconference capability for Sara Hendricks and any other remote attendees?
If possible, I would appreciate receiving these confirmations by end of day Thursday, June 12.
---
**PRIVILEGE AND CONFIDENTIALITY**
Please note that this meeting and all associated materials are covered by attorney-client privilege and by the common-interest agreement with Whitfield Greaves LLP. I ask that all participants treat the agenda, meeting materials, and any documents circulated in connection with this engagement as privileged and confidential, and that they not be forwarded or shared outside the authorized project team without prior approval.
If you have any questions before Monday, please do not hesitate to reach out to me directly or to Kevin Ostrowski. We look forward to a productive session.
Best regards,
**Alan Burke** Associate Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022 Direct: (212) 554-7183 Mobile: (917) 408-2246 aburke@calderwoodharkness.com
---
*CONFIDENTIALITY NOTICE: This e-mail message, including any attachments, is sent by the law firm of Calderwood & Harkness LLP and is intended exclusively for the use of the individual(s) or entity named above. This communication may contain information that is privileged, confidential, and exempt from disclosure under applicable law, including attorney-client privileged communications and attorney work product. If you are not the intended recipient, or the employee or agent responsible for delivering this message to the intended recipient, you are hereby notified that any dissemination, distribution, copying, or other use of this communication is strictly prohibited. If you have received this e-mail in error, please notify the sender immediately by reply e-mail and permanently delete the original message and all copies. Thank you.*