1038-00010 · Cascade Retail Holdings · Engagement

conflict-check-clearance-memo.docx DOCUMENT Finance & Banking

22 / 38 ← → ✕

MEMORANDUM — CONFIDENTIAL — ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, NY 10022

Practice Group: Privacy & Data Security

June 1, 2025

1. Purpose

This memorandum documents the results of a comprehensive conflicts check conducted in connection with Calderwood & Harkness LLP's proposed representation of Cascade Retail Holdings Inc. ("Cascade" or the "Prospective Client") in a US state-privacy compliance program engagement (the "Proposed Engagement"). The Proposed Engagement is anticipated to be formally opened on June 2, 2025, under Matter Number 1038-00010, subject to the clearance documented herein.

This memorandum has been prepared for the sole internal use of Calderwood & Harkness LLP in evaluating the Proposed Engagement and is not intended for distribution to Cascade Retail Holdings Inc. or any other party outside the firm. The memorandum constitutes attorney work product and is protected by the work-product doctrine and the attorney-client privilege to the fullest extent applicable.

The conflicts check described below covers the Prospective Client, its subsidiaries and affiliated entities, and all known counterparties, adverse parties, and material third parties identified during the engagement intake process. The search encompasses all individuals and entities that, based on information provided by the Prospective Client during the preliminary engagement discussions and the data-mapping documentation received to date, are reasonably expected to be involved in, affected by, or relevant to the Proposed Engagement. In conducting this review, the undersigned has applied both the applicable New York Rules of Professional Conduct (in particular, Rules 1.7, 1.8, 1.9, 1.10, and 1.13) and Calderwood & Harkness's internal conflicts and new-matter intake policies, which in certain respects impose standards more stringent than those required by the Rules.

2. Proposed Client and Affiliated Entities Searched

The following entities were identified as the Prospective Client and its subsidiaries and affiliates and were included in the conflicts search. All entity information was verified against the Prospective Client's corporate-organization chart provided by Meredith Tanaka, General Counsel, on May 22, 2025, and cross-referenced against publicly available corporate-registration records, SEC filings, and the Prospective Client's most recent Annual Report on Form 10-K filed with the Securities and Exchange Commission on March 1, 2025, for fiscal year ended December 31, 2024.

Cascade Retail Holdings Inc. — A Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol "CSRD." Cascade is headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Its Employer Identification Number ("EIN") is 84-3192057. Cascade operates a multi-channel retail business encompassing direct-to-consumer e-commerce, brick-and-mortar retail locations, a third-party seller marketplace, and associated advertising technology and loyalty programs. For the fiscal year ended December 31, 2024, Cascade reported consolidated revenues of approximately $8.4 billion and a workforce of approximately 22,000 full-time employees. Cascade is the parent entity of all subsidiaries listed below.

Cascade Digital Marketplace LLC ("CDM") — A Delaware limited liability company and wholly owned subsidiary of Cascade Retail Holdings Inc. CDM operates Cascade's third-party seller marketplace platform, which facilitates transactions between independent merchants and consumers through the Cascade e-commerce platform. CDM's EIN is 85-4107638. CDM is a data controller with respect to certain consumer transaction data and seller account data processed through the marketplace and is therefore directly within the scope of the Proposed Engagement.

Ridgeline Fulfillment Services Inc. ("Ridgeline") — A Washington corporation and wholly owned subsidiary of Cascade Retail Holdings Inc. Ridgeline provides warehousing, order fulfillment, and last-mile logistics services in support of Cascade's e-commerce operations through a network of eleven fulfillment centers located across the United States. Ridgeline's EIN is 91-1647823. Ridgeline processes employee data, vendor data, and certain consumer shipping and delivery data, all of which fall within the scope of the privacy compliance program.

Peakview Analytics Inc. ("Peakview") — A Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc. Peakview provides in-house advertising technology services, customer analytics, audience segmentation, and behavioral-targeting capabilities that support Cascade's retail marketing operations and its advertising-as-a-service revenue line. Peakview's EIN is 87-2250194. Peakview's data practices — including its collection and use of device identifiers, behavioral signals, and cross-context behavioral advertising activities — are a primary focus of the Proposed Engagement.

Cascade Rewards Corp. ("Cascade Rewards") — A Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc. Cascade Rewards operates Cascade's consumer loyalty program and stored-value card programs, including the issuance and management of Cascade-branded gift cards and loyalty points. Cascade Rewards' EIN is 86-3381729. The loyalty program involves the collection and use of detailed consumer purchase-history data, preference data, and financial account information, all of which are squarely within the scope of the privacy compliance program.

In addition to the corporate entities listed above, the following key individuals associated with the Prospective Client were included in the conflicts search:

• Thomas R. Cavanaugh — Chief Executive Officer, Cascade Retail Holdings Inc.

• Meredith Tanaka — General Counsel, Cascade Retail Holdings Inc.

• Diana Polk — Associate General Counsel and Interim Chief Privacy Officer, Cascade Retail Holdings Inc.

• Gregory Farris — Chief Information Security Officer, Cascade Retail Holdings Inc.

• Priya Nandakumar — Vice President, Data & Analytics, Cascade Retail Holdings Inc.

• Jason Leclaire — Vice President, Marketing & Customer Engagement, Cascade Retail Holdings Inc.

• Ellen Marchetti — Director, Cascade Retail Holdings Inc.; Chair, Audit & Risk Committee of the Board of Directors.

These individuals were identified as the primary client-side stakeholders for the Proposed Engagement and as persons whose involvement could give rise to individual-level conflict concerns.

3. Counterparties, Adverse Parties, and Material Third Parties Searched

The following entities and individuals were identified during the engagement intake process as counterparties, adverse parties, and material third parties whose relationships to the Prospective Client and to the subject matter of the Proposed Engagement warranted inclusion in the conflicts search. The classifications below reflect the nature of each party's anticipated relationship to the engagement.

3.1 Key Counterparties / Data-Sharing Partners

Thornbridge Media Corp. — A Nevada corporation with offices at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117. Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner. The relationship between Cascade and Thornbridge is governed by a Master Advertising Services Agreement dated March 15, 2022, and an associated Data Sharing and Audience Extension Addendum dated September 1, 2022 (collectively, the "Thornbridge Agreements"). Key individuals searched in connection with Thornbridge include Robert Shin, Chief Executive Officer, and Leah Voss, General Counsel.

As part of the Proposed Engagement, the data-sharing arrangement between Cascade (through Peakview Analytics Inc.) and Thornbridge must be evaluated against the requirements of the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the applicable requirements of at least eighteen additional state privacy statutes. Based on Cascade's preliminary assessment, certain aspects of the Thornbridge Agreements — including the scope of permitted secondary use, the absence of contractual opt-out signal-forwarding obligations, and the characterization of Thornbridge's role (as a "service provider," "contractor," or "third party" under applicable law) — will require restructuring and renegotiation. Accordingly, Thornbridge is properly classified as a negotiation counterparty with respect to the data-sharing agreement restructuring component of the Proposed Engagement. Thornbridge is not, however, an adverse litigation party; there is no pending or threatened litigation between Cascade and Thornbridge, and the anticipated negotiations are expected to be conducted on a cooperative basis.

3.2 Vendors and Service Providers

OnPoint Data Solutions Inc. — A Delaware corporation with offices at 800 West El Camino Real, Suite 220, Mountain View, California 94040. OnPoint is a software-as-a-service ("SaaS") vendor that provides Cascade with a consent-management platform ("CMP") used to collect, record, and transmit consumer consent and opt-out signals across Cascade's digital properties. The key individual searched in connection with OnPoint is Danielle Ferrero, Chief Executive Officer. OnPoint's CMP will be evaluated for compliance with applicable state privacy requirements as part of Phase 1 of the Proposed Engagement, and Calderwood & Harkness may review and recommend amendments to the existing SaaS subscription agreement between Cascade and OnPoint to ensure appropriate data-processing and privacy-compliance provisions are in place.

Fieldhaven Consulting Group LLC — A Delaware limited liability company with offices at 350 Sansome Street, Suite 400, San Francisco, California 94104. Fieldhaven is a technology consulting firm that has been separately retained by Cascade to provide technical implementation support for privacy controls, including implementation of consent-management flows, data-subject access request ("DSAR") workflow automation, and data-deletion and data-inventory tooling. The engagement lead at Fieldhaven is Marcus Ellerby. Calderwood & Harkness will oversee and review Fieldhaven's work product for legal sufficiency and consistency with the compliance program design, but Fieldhaven is an independent vendor to Cascade and is not, and will not become, a client of Calderwood & Harkness LLP. The relationship between Calderwood & Harkness and Fieldhaven is that of coordinating professionals retained by a common client, not an attorney-client relationship.

3.3 Opposing / Counterparty Counsel

Kellner Park & Associates LLP ("KP&A") — A California limited liability partnership with offices at 555 Mission Street, 32nd Floor, San Francisco, California 94105. KP&A represents Thornbridge Media Corp. in connection with the anticipated restructuring and renegotiation of the Thornbridge Agreements. The lead attorney at KP&A for this matter is Victor Sandoval, Partner. Calderwood & Harkness will negotiate directly with Mr. Sandoval and his team on behalf of Cascade with respect to the revised data-sharing agreement terms. KP&A's role is that of counterparty counsel in a commercial transaction negotiation; there is no litigation between the parties, and KP&A is not opposing counsel in any adjudicative proceeding.

3.4 Co-Counsel and Related Counsel

Whitfield Greaves LLP — A Delaware limited liability partnership with offices at 1999 K Street NW, Suite 700, Washington, D.C. 20006. Whitfield Greaves serves as Cascade's existing corporate and securities counsel and has represented Cascade in that capacity since 2019. The lead partner at Whitfield Greaves for the Cascade relationship is Carolyn J. Marsden, Partner, Corporate & Securities. Calderwood & Harkness will coordinate with Whitfield Greaves on the SEC-disclosure and board-governance aspects of the privacy compliance program, including the preparation of any required risk-factor disclosures, the development of board and audit committee oversight protocols for privacy risk, and any amendments to Cascade's committee charters or corporate governance guidelines that may be warranted. The relationship between Calderwood & Harkness and Whitfield Greaves with respect to this engagement is collaborative and non-adverse; both firms represent the same client (Cascade). A common-interest agreement between Calderwood & Harkness and Whitfield Greaves is anticipated to be executed prior to the commencement of joint work in order to protect shared privileged communications and attorney work product.

3.5 Other Material Third Parties

Lakemont Audit Partners LLP — An Illinois limited liability partnership with offices at 233 South Wacker Drive, Suite 5600, Chicago, Illinois 60606. Lakemont serves as Cascade's independent registered public accounting firm and has audited Cascade's consolidated financial statements for fiscal years 2024 and 2025. The engagement partner at Lakemont for the Cascade audit is Sheila Brogan, Partner. Consultation with Lakemont is anticipated in connection with the privacy compliance program to the extent that Cascade's SOC 2 Type II reporting and internal controls over privacy-related data processing overlap with the scope of the compliance program. Lakemont is not a party to the engagement and is not a client of Calderwood & Harkness.

Ridgepoint Insurance Brokers Inc. — A New York corporation with offices at 140 Broadway, 22nd Floor, New York, New York 10005. Ridgepoint serves as Cascade's insurance broker for cyber-liability and privacy-liability insurance coverage. The account executive at Ridgepoint responsible for the Cascade account is Nathan Gilroy. Ridgepoint may be consulted during the engagement with respect to the impact of the privacy compliance program on Cascade's insurability and the terms of its cyber/privacy-liability insurance policy. Ridgepoint is not a party to the engagement and is not a client of Calderwood & Harkness.

Northcastle Indemnity Company — A Connecticut domestic insurance company with offices at 100 Constitution Plaza, Hartford, Connecticut 06103. Northcastle is the carrier on Cascade's cyber-liability and privacy-liability insurance policy for the policy period commencing July 1, 2025 and expiring June 30, 2026. The privacy compliance program may affect Cascade's coverage terms, and Calderwood & Harkness may review the Northcastle policy in connection with the engagement to advise Cascade on notice obligations and coverage implications. Northcastle is not a party to the engagement and is not a client of Calderwood & Harkness.

4. Conflicts Database Search Methodology

The conflicts search was conducted by the undersigned on May 30 and May 31, 2025, using Calderwood & Harkness's firm-wide conflicts database and new-matter intake system (the "Conflicts System"). The Conflicts System is maintained by the firm's General Counsel's Office and the Conflicts Department and contains records of all current active client engagements, all matters closed within the past ten years, all prospective matters that were evaluated and either opened or declined, and all lateral-hire portability disclosures submitted during the onboarding of lateral attorneys and professional staff.

Searches were conducted using the following search parameters for each entity and individual listed in Sections 2 and 3 above:

(a) Full legal name of each entity (e.g., "Cascade Retail Holdings Inc.," "Thornbridge Media Corp.," "Kellner Park & Associates LLP");

(b) abbreviated and short names (e.g., "Cascade," "CDM," "Ridgeline," "Peakview," "Cascade Rewards," "Thornbridge," "OnPoint," "Fieldhaven," "KP&A," "Whitfield Greaves," "Lakemont," "Ridgepoint," "Northcastle");

(d) Nasdaq ticker symbol "CSRD" for Cascade Retail Holdings Inc.;

(e) Employer Identification Numbers for all Cascade-family entities (84-3192057, 85-4107638, 91-1647823, 87-2250194, 86-3381729);

(f) Individual names for all key persons identified in Sections 2 and 3, including variations (e.g., "Thomas Cavanaugh," "Tom Cavanaugh," "T. Cavanaugh," "T.R. Cavanaugh"; "Victor Sandoval," "V. Sandoval");

(g) Wildcard and partial-string searches designed to capture variations in entity and individual names resulting from data-entry differences, name changes, or abbreviations.

The search covered all current active matters, all matters closed within the past five years (i.e., matters closed on or after June 1, 2020), and all prospective and declined matters recorded in the Conflicts System during the same period. Although the Conflicts System retains records for a ten-year window, the five-year lookback period was deemed the appropriate scope for this analysis under Rule 1.9 and the firm's internal successive-conflicts policies, given the nature of the Proposed Engagement (transactional compliance advisory, not litigation).

In addition to the database search, lateral-hire portability conflicts were checked for all members of the proposed engagement team. Specifically, the lateral-hire conflict disclosures submitted by the following attorneys upon their respective dates of joining the firm were reviewed:

• Kevin Ostrowski, Partner — joined Calderwood & Harkness in January 2018 from Hartwell Bryce LLP; portability disclosure reviewed and cleared;

• Rachel Bernstein, Partner — joined Calderwood & Harkness in September 2020 from the U.S. Department of Commerce, Bureau of Industry and Security; portability disclosure reviewed and cleared;

• Alan Burke, Senior Associate — joined Calderwood & Harkness in August 2021 from Dennehy Brackoven LLP; portability disclosure reviewed and cleared;

• Sara Hendricks, Associate — joined Calderwood & Harkness in September 2023 directly from New York University School of Law (no prior law firm portability concerns); new-hire intake form reviewed and cleared.

No portability conflicts or prior-firm conflict restrictions were identified for any member of the proposed engagement team with respect to any of the entities or individuals searched.

5. Results of Conflicts Check

5.1 No Disqualifying Conflicts Identified

Based on the comprehensive conflicts search described in Section 4 above, no disqualifying conflicts of interest were identified under the New York Rules of Professional Conduct (including, without limitation, Rules 1.7 (Conflict of Interest: Current Clients), 1.8 (Current Clients: Specific Conflict of Interest Rules), 1.9 (Duties to Former Clients), 1.10 (Imputation of Conflicts of Interest), and 1.13 (Organization as Client)) or under Calderwood & Harkness LLP's internal conflicts policies (Calderwood & Harkness Conflicts Policy, Rev. 12, effective January 1, 2025). No advance waivers, informed-consent letters, or ethical screens are required in connection with the acceptance of the Proposed Engagement.

The detailed results for each category of searched entity are set forth below.

5.2 Current and Recent Client Representations — No Conflicts Found

The conflicts search confirms that Calderwood & Harkness LLP does not currently represent, and has not at any time within the past five years (i.e., on or after June 1, 2020) represented, any of the following entities in any matter of any kind:

• Cascade Retail Holdings Inc.;

• Cascade Digital Marketplace LLC;

• Ridgeline Fulfillment Services Inc.;

• Peakview Analytics Inc.;

• Cascade Rewards Corp.;

• Thornbridge Media Corp.;

• OnPoint Data Solutions Inc.;

• Fieldhaven Consulting Group LLC;

• Kellner Park & Associates LLP;

• Northcastle Indemnity Company.

The Proposed Engagement will constitute Calderwood & Harkness's first representation of Cascade Retail Holdings Inc. or any member of the Cascade corporate family. There are no prior attorney-client relationships, fee arrangements, or engagement letters with respect to any of the above-listed entities in the firm's records. Because Calderwood & Harkness has no prior or current relationship with any of these entities, no successive-conflict analysis under Rule 1.9 is required, and no concurrent-conflict analysis under Rule 1.7(a) arises from the firm's existing client base.

5.3 Whitfield Greaves LLP — No Conflict; Co-Counsel Relationship

Whitfield Greaves LLP is identified in the firm's Conflicts System as a law firm with which Calderwood & Harkness has collaborated on several prior matters involving other clients. Specifically, Calderwood & Harkness and Whitfield Greaves have served as co-counsel on two prior matters: (i) the representation of Apex Consolidated Industries Inc. in a CFIUS voluntary notice proceeding in 2022 (Matter No. 1038-00010, closed March 2023), and (ii) the representation of Bellmark Therapeutics Inc. in connection with a cross-border data-transfer compliance matter in 2024 (Matter No. 1038-00010, closed August 2024). In both prior matters, the relationship between the two firms was collaborative and non-adverse.

With respect to the Proposed Engagement, Whitfield Greaves serves as Cascade's existing corporate and securities counsel. The relationship between Calderwood & Harkness and Whitfield Greaves on the Proposed Engagement will again be collaborative and non-adverse; both firms will represent the same client (Cascade Retail Holdings Inc.) in complementary practice areas and will coordinate their respective work streams. A common-interest agreement is anticipated to be executed between the two firms, with Cascade's consent, prior to the commencement of joint work. This co-counsel relationship presents no conflict under any applicable rule or firm policy.

5.4 Kellner Park & Associates LLP — Counterparty Counsel; No Conflict

Kellner Park & Associates LLP, through its partner Victor Sandoval, represents Thornbridge Media Corp. in connection with the anticipated restructuring and renegotiation of the data-sharing agreements between Cascade and Thornbridge. KP&A will therefore serve as counterparty counsel in a commercial-transaction negotiation component of the Proposed Engagement.

The conflicts search confirms that Calderwood & Harkness does not currently represent, and has not within the past five years represented, Kellner Park & Associates LLP or any of its partners, associates, or clients in a manner that would create a concurrent conflict under Rule 1.7 or a successive conflict under Rule 1.9. Mr. Sandoval does not appear in the firm's Conflicts System in any capacity. Additionally, the negotiation at issue is a commercial transaction (restructuring of a data-sharing agreement), not litigation or an adversarial adjudicative proceeding, which further mitigates any potential concern. No conflict exists, and no waiver or consent is required.

5.5 Thornbridge Media Corp. — Counterparty; No Conflict

Thornbridge Media Corp. is classified as a negotiation counterparty with respect to the data-sharing agreement restructuring component of the Proposed Engagement. The conflicts search confirms that Calderwood & Harkness has no current or recent representation of Thornbridge Media Corp. or any of its principals, including Robert Shin (CEO) and Leah Voss (General Counsel). Neither Thornbridge nor any of its known affiliates appear in the firm's Conflicts System as a current or former client, or as a counterparty to a current Calderwood & Harkness client in a manner that would give rise to a conflict.

Because Thornbridge is a negotiation counterparty in a commercial-transaction context rather than a litigation adversary, and because Calderwood & Harkness has no prior or current attorney-client relationship with Thornbridge, no conflict of interest exists under Rule 1.7 or Rule 1.9. The firm is free to represent Cascade in negotiations with Thornbridge without restriction.

5.6 Other Searched Entities — No Conflicts

The conflicts search returned negative results for each of the following entities. Calderwood & Harkness does not currently represent, and has not within the past five years represented, any of these entities in any matter:

• OnPoint Data Solutions Inc. — No appearances in the Conflicts System as a client, counterparty, or material third party in any Calderwood & Harkness matter.

• Fieldhaven Consulting Group LLC — No appearances in the Conflicts System. As noted in Section 3.2, Fieldhaven is a vendor to Cascade and will not be a client of Calderwood & Harkness.

• Lakemont Audit Partners LLP — No appearances in the Conflicts System as a client. Lakemont does appear in the Conflicts System as the independent auditor of three current Calderwood & Harkness clients in unrelated matters; however, this does not create a conflict, as the firm does not represent Lakemont itself and there is no adversity between Cascade and Lakemont.

• Ridgepoint Insurance Brokers Inc. — No appearances in the Conflicts System as a client or counterparty.

• Northcastle Indemnity Company — No appearances in the Conflicts System as a client. Northcastle appears as the identified insurer in two other Calderwood & Harkness matters involving other clients, but Calderwood & Harkness does not represent Northcastle, and no adversity between Cascade and Northcastle has been identified or is anticipated.

No conflicts were identified with respect to any of the above entities.

6. Engagement Team Confirmation

The following attorneys have been designated as the proposed engagement team for the Proposed Engagement. Each team member's name was searched in the Conflicts System for individual-level conflicts, and each team member was independently asked to confirm whether he or she has any personal, financial, familial, or prior-employment relationships with any of the entities or individuals identified in Sections 2 and 3 of this memorandum.

None of the above-listed team members has any personal, financial, or prior-employment relationship with any of the searched entities or individuals. None of the team members holds any securities in Cascade Retail Holdings Inc. or any other entity identified in Sections 2 or 3. None of the team members has a familial or close personal relationship with any officer, director, general counsel, or other key individual identified in this memorandum. Confirmations were obtained by email from each team member on May 31, 2025, and copies of such confirmations are maintained in the conflicts file for this matter.

7. Scope of Engagement and Nature of Matter

For purposes of providing context relevant to the conflicts analysis, the scope and nature of the Proposed Engagement are summarized below. A full description of the engagement scope will be set forth in the engagement letter to be delivered to Cascade upon clearance.

The Proposed Engagement encompasses the design, build, and implementation of a comprehensive US state-privacy compliance program for Cascade Retail Holdings Inc. and its subsidiaries. The compliance program will address the requirements of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code §§ 1798.100 et seq.), and eighteen additional state privacy statutes that are either currently in effect or will become effective during the engagement period, including the laws of Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Kentucky, and Rhode Island.

The compliance program will encompass all of Cascade's US-facing data-processing activities, including:

(a) Direct-to-consumer retail operations (both e-commerce and brick-and-mortar);

(b) Third-party seller marketplace operations (Cascade Digital Marketplace LLC);

(d) Advertising technology and customer analytics operations (Peakview Analytics Inc.);

(e) Warehousing, fulfillment, and logistics operations, to the extent they involve the processing of personal information (Ridgeline Fulfillment Services Inc.);

(f) Vendor and service-provider data practices, including the negotiation and documentation of data-processing agreements with third-party vendors and data-sharing partners; and

(g) Employee and human-resources data practices, to the extent covered by applicable state privacy statutes.

The engagement is structured in two phases:

Phase 1 — Assessment, Gap Analysis, and Policy Development (anticipated June 2, 2025, through December 31, 2025): Calderwood & Harkness will conduct a comprehensive assessment of Cascade's current privacy practices against the requirements of each applicable state privacy statute; prepare a detailed gap analysis; draft and revise consumer-facing privacy notices, internal privacy policies, and data-processing procedures; develop standardized vendor data-processing agreement templates and data-sharing agreement terms; prepare consumer-rights request fulfillment protocols; develop employee training materials; and advise on the restructuring of the Thornbridge data-sharing arrangement.

Phase 2 — Implementation Support (anticipated January 1, 2026, through June 30, 2026): Calderwood & Harkness will provide legal support for the implementation of the compliance program, including review and approval of Fieldhaven Consulting Group's technical implementations for legal sufficiency, coordination with Whitfield Greaves LLP on SEC-disclosure and board-governance matters, negotiation of data-processing agreements with identified vendors and partners, and ongoing legal advice as new state privacy statutes become effective during the implementation period.

The Proposed Engagement does not include the representation of Cascade in any litigation, enforcement proceedings, or regulatory investigations. The firm is aware that Cascade was the subject of a closed Federal Trade Commission inquiry (FTC File No. 232-0147, closed with no action in February 2024) and a resolved informal inquiry from the California Attorney General's Office (closed with no further action in November 2024). These prior regulatory matters have been reviewed and do not give rise to any conflicts of interest. Should Cascade require representation in any future litigation, enforcement proceeding, or regulatory investigation, a separate engagement letter and a supplemental conflicts check would be required.

8. Conditions and Ongoing Monitoring

The conflict clearance documented in this memorandum is based on information available as of June 1, 2025, including the information provided by Cascade during preliminary engagement discussions, the corporate-organization chart provided by Meredith Tanaka, the preliminary data-mapping report prepared by Fieldhaven Consulting Group LLC dated May 19, 2025, and the results of the conflicts searches conducted on May 30 and May 31, 2025.

The following ongoing monitoring obligations and recommendations are noted:

(a) Updated Searches Upon Identification of New Parties. The conflicts check should be updated promptly if new counterparties, adverse parties, or significant third parties are identified during the course of the engagement. In particular, the Fieldhaven data-mapping report dated May 19, 2025, identified forty-seven advertising and analytics partners with which Cascade shares consumer data or from which Cascade receives data. Only the most significant of these — Thornbridge Media Corp. — was included in the initial conflicts search. As the remaining partners are identified by name and evaluated during Phase 1, supplemental conflicts searches should be conducted for each.

(b) Re-Screening of Vendors Requiring DPA Negotiations. The Fieldhaven data-mapping report identifies twenty-three advertising and analytics partners that currently lack data-processing agreements ("DPAs") with Cascade. To the extent that Calderwood & Harkness is asked to negotiate DPAs with any of these vendors, the vendor entity and its outside counsel (if any) must be run through the Conflicts System before negotiations commence. This is particularly important because the negotiation of DPA terms may create relationships that implicate Rules 1.7 and 1.9.

(c) Periodic Re-Screening. Periodic re-screening of all identified parties is recommended at quarterly intervals during the engagement (i.e., at approximately September 1, 2025; December 1, 2025; March 1, 2026; and June 1, 2026) to account for any intervening changes in the firm's client base or matter portfolio that could give rise to new conflicts.

(d) Prompt Reporting Obligation. All members of the engagement team are reminded of their obligation under Calderwood & Harkness's Conflicts Policy to promptly report to the responsible partner (Kevin Ostrowski) any newly identified potential conflict of interest, including any personal, financial, or relational conflict, that may arise at any point during the engagement. This obligation extends to situations in which a team member learns of a new Calderwood & Harkness engagement involving any party that is or could become a counterparty or adverse party in the Cascade matter.

9. Recommendation and Approval

Prepared by:

Alan Burke Senior Associate, Privacy & Data Security Calderwood & Harkness LLP

Recommendation: Based on the comprehensive conflicts check documented in this memorandum, including searches of all entities and individuals identified in Sections 2 and 3 above, review of all current and recently closed matters, review of all lateral-hire portability disclosures for the proposed engagement team, and individual confirmations from each team member, there are no impediments under the New York Rules of Professional Conduct or under Calderwood & Harkness LLP's internal conflicts policies to the firm's acceptance of the Proposed Engagement with Cascade Retail Holdings Inc. (Matter No. 1038-00010). The engagement may proceed, subject to the execution of an engagement letter in accordance with the firm's standard intake procedures and the ongoing monitoring obligations described in Section 8.

Approved by:

CALDERWOOD & HARKNESS LLP

By: ________

Name: Kevin Ostrowski

Title: Partner, Privacy & Data Security

Date: June _, 2025

This memorandum and the underlying conflicts search results, including all email confirmations from engagement team members, will be maintained in the firm's conflicts files under Matter Number 1038-00010 in accordance with Calderwood & Harkness LLP's document-retention policies. This memorandum is confidential, constitutes attorney work product, and is not to be distributed outside Calderwood & Harkness LLP.

To:	Kevin Ostrowski, Partner, Privacy & Data Security
From:	Alan Burke, Senior Associate, Privacy & Data Security
Re:	Conflict-Check Clearance — Proposed Engagement of Cascade Retail Holdings Inc. (US State Privacy Compliance Program)
Matter Number:	1038-00010
Classification:	Internal — Not for Distribution Outside Calderwood & Harkness LLP
Team Member	Role	Conflict Status
Kevin Ostrowski, Partner	Responsible Partner, Privacy & Data Security	No conflicts identified
Rachel Bernstein, Partner	Billing Partner, Privacy & Data Security	No conflicts identified
Alan Burke, Senior Associate	Lead Associate, Privacy & Data Security	No conflicts identified
Sara Hendricks, Associate	Working Associate, Privacy & Data Security	No conflicts identified

MEMORANDUM — CONFIDENTIAL — ATTORNEY WORK PRODUCT
CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
Practice Group: Privacy & Data Security
June 1, 2025
1. Purpose
This memorandum documents the results of a comprehensive conflicts check conducted in connection with Calderwood & Harkness LLP's proposed representation of Cascade Retail Holdings Inc. ("Cascade" or the "Prospective Client") in a US state-privacy compliance program engagement (the "Proposed Engagement"). The Proposed Engagement is anticipated to be formally opened on June 2, 2025, under Matter Number 1038-00010, subject to the clearance documented herein.
This memorandum has been prepared for the sole internal use of Calderwood & Harkness LLP in evaluating the Proposed Engagement and is not intended for distribution to Cascade Retail Holdings Inc. or any other party outside the firm. The memorandum constitutes attorney work product and is protected by the work-product doctrine and the attorney-client privilege to the fullest extent applicable.
The conflicts check described below covers the Prospective Client, its subsidiaries and affiliated entities, and all known counterparties, adverse parties, and material third parties identified during the engagement intake process. The search encompasses all individuals and entities that, based on information provided by the Prospective Client during the preliminary engagement discussions and the data-mapping documentation received to date, are reasonably expected to be involved in, affected by, or relevant to the Proposed Engagement. In conducting this review, the undersigned has applied both the applicable New York Rules of Professional Conduct (in particular, Rules 1.7, 1.8, 1.9, 1.10, and 1.13) and Calderwood & Harkness's internal conflicts and new-matter intake policies, which in certain respects impose standards more stringent than those required by the Rules.
2. Proposed Client and Affiliated Entities Searched
The following entities were identified as the Prospective Client and its subsidiaries and affiliates and were included in the conflicts search. All entity information was verified against the Prospective Client's corporate-organization chart provided by Meredith Tanaka, General Counsel, on May 22, 2025, and cross-referenced against publicly available corporate-registration records, SEC filings, and the Prospective Client's most recent Annual Report on Form 10-K filed with the Securities and Exchange Commission on March 1, 2025, for fiscal year ended December 31, 2024.
Cascade Retail Holdings Inc. — A Delaware corporation, publicly traded on the Nasdaq Stock Market under the ticker symbol "CSRD." Cascade is headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119. Its Employer Identification Number ("EIN") is 84-3192057. Cascade operates a multi-channel retail business encompassing direct-to-consumer e-commerce, brick-and-mortar retail locations, a third-party seller marketplace, and associated advertising technology and loyalty programs. For the fiscal year ended December 31, 2024, Cascade reported consolidated revenues of approximately $8.4 billion and a workforce of approximately 22,000 full-time employees. Cascade is the parent entity of all subsidiaries listed below.
Cascade Digital Marketplace LLC ("CDM") — A Delaware limited liability company and wholly owned subsidiary of Cascade Retail Holdings Inc. CDM operates Cascade's third-party seller marketplace platform, which facilitates transactions between independent merchants and consumers through the Cascade e-commerce platform. CDM's EIN is 85-4107638. CDM is a data controller with respect to certain consumer transaction data and seller account data processed through the marketplace and is therefore directly within the scope of the Proposed Engagement.
Ridgeline Fulfillment Services Inc. ("Ridgeline") — A Washington corporation and wholly owned subsidiary of Cascade Retail Holdings Inc. Ridgeline provides warehousing, order fulfillment, and last-mile logistics services in support of Cascade's e-commerce operations through a network of eleven fulfillment centers located across the United States. Ridgeline's EIN is 91-1647823. Ridgeline processes employee data, vendor data, and certain consumer shipping and delivery data, all of which fall within the scope of the privacy compliance program.
Peakview Analytics Inc. ("Peakview") — A Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc. Peakview provides in-house advertising technology services, customer analytics, audience segmentation, and behavioral-targeting capabilities that support Cascade's retail marketing operations and its advertising-as-a-service revenue line. Peakview's EIN is 87-2250194. Peakview's data practices — including its collection and use of device identifiers, behavioral signals, and cross-context behavioral advertising activities — are a primary focus of the Proposed Engagement.
Cascade Rewards Corp. ("Cascade Rewards") — A Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc. Cascade Rewards operates Cascade's consumer loyalty program and stored-value card programs, including the issuance and management of Cascade-branded gift cards and loyalty points. Cascade Rewards' EIN is 86-3381729. The loyalty program involves the collection and use of detailed consumer purchase-history data, preference data, and financial account information, all of which are squarely within the scope of the privacy compliance program.
In addition to the corporate entities listed above, the following key individuals associated with the Prospective Client were included in the conflicts search:
•  Thomas R. Cavanaugh — Chief Executive Officer, Cascade Retail Holdings Inc.
•  Meredith Tanaka — General Counsel, Cascade Retail Holdings Inc.
•  Diana Polk — Associate General Counsel and Interim Chief Privacy Officer, Cascade Retail Holdings Inc.
•  Gregory Farris — Chief Information Security Officer, Cascade Retail Holdings Inc.
•  Priya Nandakumar — Vice President, Data & Analytics, Cascade Retail Holdings Inc.
•  Jason Leclaire — Vice President, Marketing & Customer Engagement, Cascade Retail Holdings Inc.
•  Ellen Marchetti — Director, Cascade Retail Holdings Inc.; Chair, Audit & Risk Committee of the Board of Directors.
These individuals were identified as the primary client-side stakeholders for the Proposed Engagement and as persons whose involvement could give rise to individual-level conflict concerns.
3. Counterparties, Adverse Parties, and Material Third Parties Searched
The following entities and individuals were identified during the engagement intake process as counterparties, adverse parties, and material third parties whose relationships to the Prospective Client and to the subject matter of the Proposed Engagement warranted inclusion in the conflicts search. The classifications below reflect the nature of each party's anticipated relationship to the engagement.
3.1 Key Counterparties / Data-Sharing Partners
Thornbridge Media Corp. — A Nevada corporation with offices at 2750 South Durango Drive, Suite 110, Las Vegas, Nevada 89117. Thornbridge is Cascade's primary programmatic-advertising and audience-targeting partner. The relationship between Cascade and Thornbridge is governed by a Master Advertising Services Agreement dated March 15, 2022, and an associated Data Sharing and Audience Extension Addendum dated September 1, 2022 (collectively, the "Thornbridge Agreements"). Key individuals searched in connection with Thornbridge include Robert Shin, Chief Executive Officer, and Leah Voss, General Counsel.
As part of the Proposed Engagement, the data-sharing arrangement between Cascade (through Peakview Analytics Inc.) and Thornbridge must be evaluated against the requirements of the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), and the applicable requirements of at least eighteen additional state privacy statutes. Based on Cascade's preliminary assessment, certain aspects of the Thornbridge Agreements — including the scope of permitted secondary use, the absence of contractual opt-out signal-forwarding obligations, and the characterization of Thornbridge's role (as a "service provider," "contractor," or "third party" under applicable law) — will require restructuring and renegotiation. Accordingly, Thornbridge is properly classified as a negotiation counterparty with respect to the data-sharing agreement restructuring component of the Proposed Engagement. Thornbridge is not, however, an adverse litigation party; there is no pending or threatened litigation between Cascade and Thornbridge, and the anticipated negotiations are expected to be conducted on a cooperative basis.
3.2 Vendors and Service Providers
OnPoint Data Solutions Inc. — A Delaware corporation with offices at 800 West El Camino Real, Suite 220, Mountain View, California 94040. OnPoint is a software-as-a-service ("SaaS") vendor that provides Cascade with a consent-management platform ("CMP") used to collect, record, and transmit consumer consent and opt-out signals across Cascade's digital properties. The key individual searched in connection with OnPoint is Danielle Ferrero, Chief Executive Officer. OnPoint's CMP will be evaluated for compliance with applicable state privacy requirements as part of Phase 1 of the Proposed Engagement, and Calderwood & Harkness may review and recommend amendments to the existing SaaS subscription agreement between Cascade and OnPoint to ensure appropriate data-processing and privacy-compliance provisions are in place.
Fieldhaven Consulting Group LLC — A Delaware limited liability company with offices at 350 Sansome Street, Suite 400, San Francisco, California 94104. Fieldhaven is a technology consulting firm that has been separately retained by Cascade to provide technical implementation support for privacy controls, including implementation of consent-management flows, data-subject access request ("DSAR") workflow automation, and data-deletion and data-inventory tooling. The engagement lead at Fieldhaven is Marcus Ellerby. Calderwood & Harkness will oversee and review Fieldhaven's work product for legal sufficiency and consistency with the compliance program design, but Fieldhaven is an independent vendor to Cascade and is not, and will not become, a client of Calderwood & Harkness LLP. The relationship between Calderwood & Harkness and Fieldhaven is that of coordinating professionals retained by a common client, not an attorney-client relationship.
3.3 Opposing / Counterparty Counsel
Kellner Park & Associates LLP ("KP&A") — A California limited liability partnership with offices at 555 Mission Street, 32nd Floor, San Francisco, California 94105. KP&A represents Thornbridge Media Corp. in connection with the anticipated restructuring and renegotiation of the Thornbridge Agreements. The lead attorney at KP&A for this matter is Victor Sandoval, Partner. Calderwood & Harkness will negotiate directly with Mr. Sandoval and his team on behalf of Cascade with respect to the revised data-sharing agreement terms. KP&A's role is that of counterparty counsel in a commercial transaction negotiation; there is no litigation between the parties, and KP&A is not opposing counsel in any adjudicative proceeding.
3.4 Co-Counsel and Related Counsel
Whitfield Greaves LLP — A Delaware limited liability partnership with offices at 1999 K Street NW, Suite 700, Washington, D.C. 20006. Whitfield Greaves serves as Cascade's existing corporate and securities counsel and has represented Cascade in that capacity since 2019. The lead partner at Whitfield Greaves for the Cascade relationship is Carolyn J. Marsden, Partner, Corporate & Securities. Calderwood & Harkness will coordinate with Whitfield Greaves on the SEC-disclosure and board-governance aspects of the privacy compliance program, including the preparation of any required risk-factor disclosures, the development of board and audit committee oversight protocols for privacy risk, and any amendments to Cascade's committee charters or corporate governance guidelines that may be warranted. The relationship between Calderwood & Harkness and Whitfield Greaves with respect to this engagement is collaborative and non-adverse; both firms represent the same client (Cascade). A common-interest agreement between Calderwood & Harkness and Whitfield Greaves is anticipated to be executed prior to the commencement of joint work in order to protect shared privileged communications and attorney work product.
3.5 Other Material Third Parties
Lakemont Audit Partners LLP — An Illinois limited liability partnership with offices at 233 South Wacker Drive, Suite 5600, Chicago, Illinois 60606. Lakemont serves as Cascade's independent registered public accounting firm and has audited Cascade's consolidated financial statements for fiscal years 2024 and 2025. The engagement partner at Lakemont for the Cascade audit is Sheila Brogan, Partner. Consultation with Lakemont is anticipated in connection with the privacy compliance program to the extent that Cascade's SOC 2 Type II reporting and internal controls over privacy-related data processing overlap with the scope of the compliance program. Lakemont is not a party to the engagement and is not a client of Calderwood & Harkness.
Ridgepoint Insurance Brokers Inc. — A New York corporation with offices at 140 Broadway, 22nd Floor, New York, New York 10005. Ridgepoint serves as Cascade's insurance broker for cyber-liability and privacy-liability insurance coverage. The account executive at Ridgepoint responsible for the Cascade account is Nathan Gilroy. Ridgepoint may be consulted during the engagement with respect to the impact of the privacy compliance program on Cascade's insurability and the terms of its cyber/privacy-liability insurance policy. Ridgepoint is not a party to the engagement and is not a client of Calderwood & Harkness.
Northcastle Indemnity Company — A Connecticut domestic insurance company with offices at 100 Constitution Plaza, Hartford, Connecticut 06103. Northcastle is the carrier on Cascade's cyber-liability and privacy-liability insurance policy for the policy period commencing July 1, 2025 and expiring June 30, 2026. The privacy compliance program may affect Cascade's coverage terms, and Calderwood & Harkness may review the Northcastle policy in connection with the engagement to advise Cascade on notice obligations and coverage implications. Northcastle is not a party to the engagement and is not a client of Calderwood & Harkness.
4. Conflicts Database Search Methodology
The conflicts search was conducted by the undersigned on May 30 and May 31, 2025, using Calderwood & Harkness's firm-wide conflicts database and new-matter intake system (the "Conflicts System"). The Conflicts System is maintained by the firm's General Counsel's Office and the Conflicts Department and contains records of all current active client engagements, all matters closed within the past ten years, all prospective matters that were evaluated and either opened or declined, and all lateral-hire portability disclosures submitted during the onboarding of lateral attorneys and professional staff.
Searches were conducted using the following search parameters for each entity and individual listed in Sections 2 and 3 above:
(a) Full legal name of each entity (e.g., "Cascade Retail Holdings Inc.," "Thornbridge Media Corp.," "Kellner Park & Associates LLP");
(b) abbreviated and short names (e.g., "Cascade," "CDM," "Ridgeline," "Peakview," "Cascade Rewards," "Thornbridge," "OnPoint," "Fieldhaven," "KP&A," "Whitfield Greaves," "Lakemont," "Ridgepoint," "Northcastle");
(c) Known trade names and d/b/a designations, where applicable;
(d) Nasdaq ticker symbol "CSRD" for Cascade Retail Holdings Inc.;
(e) Employer Identification Numbers for all Cascade-family entities (84-3192057, 85-4107638, 91-1647823, 87-2250194, 86-3381729);
(f) Individual names for all key persons identified in Sections 2 and 3, including variations (e.g., "Thomas Cavanaugh," "Tom Cavanaugh," "T. Cavanaugh," "T.R. Cavanaugh"; "Victor Sandoval," "V. Sandoval");
(g) Wildcard and partial-string searches designed to capture variations in entity and individual names resulting from data-entry differences, name changes, or abbreviations.
The search covered all current active matters, all matters closed within the past five years (i.e., matters closed on or after June 1, 2020), and all prospective and declined matters recorded in the Conflicts System during the same period. Although the Conflicts System retains records for a ten-year window, the five-year lookback period was deemed the appropriate scope for this analysis under Rule 1.9 and the firm's internal successive-conflicts policies, given the nature of the Proposed Engagement (transactional compliance advisory, not litigation).
In addition to the database search, lateral-hire portability conflicts were checked for all members of the proposed engagement team. Specifically, the lateral-hire conflict disclosures submitted by the following attorneys upon their respective dates of joining the firm were reviewed:
•  Kevin Ostrowski, Partner — joined Calderwood & Harkness in January 2018 from Hartwell Bryce LLP; portability disclosure reviewed and cleared;
•  Rachel Bernstein, Partner — joined Calderwood & Harkness in September 2020 from the U.S. Department of Commerce, Bureau of Industry and Security; portability disclosure reviewed and cleared;
•  Alan Burke, Senior Associate — joined Calderwood & Harkness in August 2021 from Dennehy Brackoven LLP; portability disclosure reviewed and cleared;
•  Sara Hendricks, Associate — joined Calderwood & Harkness in September 2023 directly from New York University School of Law (no prior law firm portability concerns); new-hire intake form reviewed and cleared.
No portability conflicts or prior-firm conflict restrictions were identified for any member of the proposed engagement team with respect to any of the entities or individuals searched.
5. Results of Conflicts Check
5.1 No Disqualifying Conflicts Identified
Based on the comprehensive conflicts search described in Section 4 above, no disqualifying conflicts of interest were identified under the New York Rules of Professional Conduct (including, without limitation, Rules 1.7 (Conflict of Interest: Current Clients), 1.8 (Current Clients: Specific Conflict of Interest Rules), 1.9 (Duties to Former Clients), 1.10 (Imputation of Conflicts of Interest), and 1.13 (Organization as Client)) or under Calderwood & Harkness LLP's internal conflicts policies (Calderwood & Harkness Conflicts Policy, Rev. 12, effective January 1, 2025). No advance waivers, informed-consent letters, or ethical screens are required in connection with the acceptance of the Proposed Engagement.
The detailed results for each category of searched entity are set forth below.
5.2 Current and Recent Client Representations — No Conflicts Found
The conflicts search confirms that Calderwood & Harkness LLP does not currently represent, and has not at any time within the past five years (i.e., on or after June 1, 2020) represented, any of the following entities in any matter of any kind:
•  Cascade Retail Holdings Inc.;
•  Cascade Digital Marketplace LLC;
•  Ridgeline Fulfillment Services Inc.;
•  Peakview Analytics Inc.;
•  Cascade Rewards Corp.;
•  Thornbridge Media Corp.;
•  OnPoint Data Solutions Inc.;
•  Fieldhaven Consulting Group LLC;
•  Kellner Park & Associates LLP;
•  Northcastle Indemnity Company.
The Proposed Engagement will constitute Calderwood & Harkness's first representation of Cascade Retail Holdings Inc. or any member of the Cascade corporate family. There are no prior attorney-client relationships, fee arrangements, or engagement letters with respect to any of the above-listed entities in the firm's records. Because Calderwood & Harkness has no prior or current relationship with any of these entities, no successive-conflict analysis under Rule 1.9 is required, and no concurrent-conflict analysis under Rule 1.7(a) arises from the firm's existing client base.
5.3 Whitfield Greaves LLP — No Conflict; Co-Counsel Relationship
Whitfield Greaves LLP is identified in the firm's Conflicts System as a law firm with which Calderwood & Harkness has collaborated on several prior matters involving other clients. Specifically, Calderwood & Harkness and Whitfield Greaves have served as co-counsel on two prior matters: (i) the representation of Apex Consolidated Industries Inc. in a CFIUS voluntary notice proceeding in 2022 (Matter No. 1038-00010, closed March 2023), and (ii) the representation of Bellmark Therapeutics Inc. in connection with a cross-border data-transfer compliance matter in 2024 (Matter No. 1038-00010, closed August 2024). In both prior matters, the relationship between the two firms was collaborative and non-adverse.
With respect to the Proposed Engagement, Whitfield Greaves serves as Cascade's existing corporate and securities counsel. The relationship between Calderwood & Harkness and Whitfield Greaves on the Proposed Engagement will again be collaborative and non-adverse; both firms will represent the same client (Cascade Retail Holdings Inc.) in complementary practice areas and will coordinate their respective work streams. A common-interest agreement is anticipated to be executed between the two firms, with Cascade's consent, prior to the commencement of joint work. This co-counsel relationship presents no conflict under any applicable rule or firm policy.
5.4 Kellner Park & Associates LLP — Counterparty Counsel; No Conflict
Kellner Park & Associates LLP, through its partner Victor Sandoval, represents Thornbridge Media Corp. in connection with the anticipated restructuring and renegotiation of the data-sharing agreements between Cascade and Thornbridge. KP&A will therefore serve as counterparty counsel in a commercial-transaction negotiation component of the Proposed Engagement.
The conflicts search confirms that Calderwood & Harkness does not currently represent, and has not within the past five years represented, Kellner Park & Associates LLP or any of its partners, associates, or clients in a manner that would create a concurrent conflict under Rule 1.7 or a successive conflict under Rule 1.9. Mr. Sandoval does not appear in the firm's Conflicts System in any capacity. Additionally, the negotiation at issue is a commercial transaction (restructuring of a data-sharing agreement), not litigation or an adversarial adjudicative proceeding, which further mitigates any potential concern. No conflict exists, and no waiver or consent is required.
5.5 Thornbridge Media Corp. — Counterparty; No Conflict
Thornbridge Media Corp. is classified as a negotiation counterparty with respect to the data-sharing agreement restructuring component of the Proposed Engagement. The conflicts search confirms that Calderwood & Harkness has no current or recent representation of Thornbridge Media Corp. or any of its principals, including Robert Shin (CEO) and Leah Voss (General Counsel). Neither Thornbridge nor any of its known affiliates appear in the firm's Conflicts System as a current or former client, or as a counterparty to a current Calderwood & Harkness client in a manner that would give rise to a conflict.
Because Thornbridge is a negotiation counterparty in a commercial-transaction context rather than a litigation adversary, and because Calderwood & Harkness has no prior or current attorney-client relationship with Thornbridge, no conflict of interest exists under Rule 1.7 or Rule 1.9. The firm is free to represent Cascade in negotiations with Thornbridge without restriction.
5.6 Other Searched Entities — No Conflicts
The conflicts search returned negative results for each of the following entities. Calderwood & Harkness does not currently represent, and has not within the past five years represented, any of these entities in any matter:
•  OnPoint Data Solutions Inc. — No appearances in the Conflicts System as a client, counterparty, or material third party in any Calderwood & Harkness matter.
•  Fieldhaven Consulting Group LLC — No appearances in the Conflicts System. As noted in Section 3.2, Fieldhaven is a vendor to Cascade and will not be a client of Calderwood & Harkness.
•  Lakemont Audit Partners LLP — No appearances in the Conflicts System as a client. Lakemont does appear in the Conflicts System as the independent auditor of three current Calderwood & Harkness clients in unrelated matters; however, this does not create a conflict, as the firm does not represent Lakemont itself and there is no adversity between Cascade and Lakemont.
•  Ridgepoint Insurance Brokers Inc. — No appearances in the Conflicts System as a client or counterparty.
•  Northcastle Indemnity Company — No appearances in the Conflicts System as a client. Northcastle appears as the identified insurer in two other Calderwood & Harkness matters involving other clients, but Calderwood & Harkness does not represent Northcastle, and no adversity between Cascade and Northcastle has been identified or is anticipated.
No conflicts were identified with respect to any of the above entities.
6. Engagement Team Confirmation
The following attorneys have been designated as the proposed engagement team for the Proposed Engagement. Each team member's name was searched in the Conflicts System for individual-level conflicts, and each team member was independently asked to confirm whether he or she has any personal, financial, familial, or prior-employment relationships with any of the entities or individuals identified in Sections 2 and 3 of this memorandum.
None of the above-listed team members has any personal, financial, or prior-employment relationship with any of the searched entities or individuals. None of the team members holds any securities in Cascade Retail Holdings Inc. or any other entity identified in Sections 2 or 3. None of the team members has a familial or close personal relationship with any officer, director, general counsel, or other key individual identified in this memorandum. Confirmations were obtained by email from each team member on May 31, 2025, and copies of such confirmations are maintained in the conflicts file for this matter.
7. Scope of Engagement and Nature of Matter
For purposes of providing context relevant to the conflicts analysis, the scope and nature of the Proposed Engagement are summarized below. A full description of the engagement scope will be set forth in the engagement letter to be delivered to Cascade upon clearance.
The Proposed Engagement encompasses the design, build, and implementation of a comprehensive US state-privacy compliance program for Cascade Retail Holdings Inc. and its subsidiaries. The compliance program will address the requirements of the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA, Cal. Civ. Code §§ 1798.100 et seq.), and eighteen additional state privacy statutes that are either currently in effect or will become effective during the engagement period, including the laws of Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Texas, Oregon, Delaware, New Hampshire, New Jersey, Nebraska, Minnesota, Maryland, Kentucky, and Rhode Island.
The compliance program will encompass all of Cascade's US-facing data-processing activities, including:
(a) Direct-to-consumer retail operations (both e-commerce and brick-and-mortar);
(b) Third-party seller marketplace operations (Cascade Digital Marketplace LLC);
(c) Loyalty program and stored-value card programs (Cascade Rewards Corp.);
(d) Advertising technology and customer analytics operations (Peakview Analytics Inc.);
(e) Warehousing, fulfillment, and logistics operations, to the extent they involve the processing of personal information (Ridgeline Fulfillment Services Inc.);
(f) Vendor and service-provider data practices, including the negotiation and documentation of data-processing agreements with third-party vendors and data-sharing partners; and
(g) Employee and human-resources data practices, to the extent covered by applicable state privacy statutes.
The engagement is structured in two phases:
Phase 1 — Assessment, Gap Analysis, and Policy Development (anticipated June 2, 2025, through December 31, 2025): Calderwood & Harkness will conduct a comprehensive assessment of Cascade's current privacy practices against the requirements of each applicable state privacy statute; prepare a detailed gap analysis; draft and revise consumer-facing privacy notices, internal privacy policies, and data-processing procedures; develop standardized vendor data-processing agreement templates and data-sharing agreement terms; prepare consumer-rights request fulfillment protocols; develop employee training materials; and advise on the restructuring of the Thornbridge data-sharing arrangement.
Phase 2 — Implementation Support (anticipated January 1, 2026, through June 30, 2026): Calderwood & Harkness will provide legal support for the implementation of the compliance program, including review and approval of Fieldhaven Consulting Group's technical implementations for legal sufficiency, coordination with Whitfield Greaves LLP on SEC-disclosure and board-governance matters, negotiation of data-processing agreements with identified vendors and partners, and ongoing legal advice as new state privacy statutes become effective during the implementation period.
The Proposed Engagement does not include the representation of Cascade in any litigation, enforcement proceedings, or regulatory investigations. The firm is aware that Cascade was the subject of a closed Federal Trade Commission inquiry (FTC File No. 232-0147, closed with no action in February 2024) and a resolved informal inquiry from the California Attorney General's Office (closed with no further action in November 2024). These prior regulatory matters have been reviewed and do not give rise to any conflicts of interest. Should Cascade require representation in any future litigation, enforcement proceeding, or regulatory investigation, a separate engagement letter and a supplemental conflicts check would be required.
8. Conditions and Ongoing Monitoring
The conflict clearance documented in this memorandum is based on information available as of June 1, 2025, including the information provided by Cascade during preliminary engagement discussions, the corporate-organization chart provided by Meredith Tanaka, the preliminary data-mapping report prepared by Fieldhaven Consulting Group LLC dated May 19, 2025, and the results of the conflicts searches conducted on May 30 and May 31, 2025.
The following ongoing monitoring obligations and recommendations are noted:
(a) Updated Searches Upon Identification of New Parties. The conflicts check should be updated promptly if new counterparties, adverse parties, or significant third parties are identified during the course of the engagement. In particular, the Fieldhaven data-mapping report dated May 19, 2025, identified forty-seven advertising and analytics partners with which Cascade shares consumer data or from which Cascade receives data. Only the most significant of these — Thornbridge Media Corp. — was included in the initial conflicts search. As the remaining partners are identified by name and evaluated during Phase 1, supplemental conflicts searches should be conducted for each.
(b) Re-Screening of Vendors Requiring DPA Negotiations. The Fieldhaven data-mapping report identifies twenty-three advertising and analytics partners that currently lack data-processing agreements ("DPAs") with Cascade. To the extent that Calderwood & Harkness is asked to negotiate DPAs with any of these vendors, the vendor entity and its outside counsel (if any) must be run through the Conflicts System before negotiations commence. This is particularly important because the negotiation of DPA terms may create relationships that implicate Rules 1.7 and 1.9.
(c) Periodic Re-Screening. Periodic re-screening of all identified parties is recommended at quarterly intervals during the engagement (i.e., at approximately September 1, 2025; December 1, 2025; March 1, 2026; and June 1, 2026) to account for any intervening changes in the firm's client base or matter portfolio that could give rise to new conflicts.
(d) Prompt Reporting Obligation. All members of the engagement team are reminded of their obligation under Calderwood & Harkness's Conflicts Policy to promptly report to the responsible partner (Kevin Ostrowski) any newly identified potential conflict of interest, including any personal, financial, or relational conflict, that may arise at any point during the engagement. This obligation extends to situations in which a team member learns of a new Calderwood & Harkness engagement involving any party that is or could become a counterparty or adverse party in the Cascade matter.
9. Recommendation and Approval
Prepared by:
Alan Burke Senior Associate, Privacy & Data Security Calderwood & Harkness LLP
Recommendation: Based on the comprehensive conflicts check documented in this memorandum, including searches of all entities and individuals identified in Sections 2 and 3 above, review of all current and recently closed matters, review of all lateral-hire portability disclosures for the proposed engagement team, and individual confirmations from each team member, there are no impediments under the New York Rules of Professional Conduct or under Calderwood & Harkness LLP's internal conflicts policies to the firm's acceptance of the Proposed Engagement with Cascade Retail Holdings Inc. (Matter No. 1038-00010). The engagement may proceed, subject to the execution of an engagement letter in accordance with the firm's standard intake procedures and the ongoing monitoring obligations described in Section 8.
Approved by:
CALDERWOOD & HARKNESS LLP
By: ________
Name: Kevin Ostrowski
Title: Partner, Privacy & Data Security
Date: June _, 2025
This memorandum and the underlying conflicts search results, including all email confirmations from engagement team members, will be maintained in the firm's conflicts files under Matter Number 1038-00010 in accordance with Calderwood & Harkness LLP's document-retention policies. This memorandum is confidential, constitutes attorney work product, and is not to be distributed outside Calderwood & Harkness LLP.
To: | Kevin Ostrowski, Partner, Privacy & Data Security
From: | Alan Burke, Senior Associate, Privacy & Data Security
Re: | Conflict-Check Clearance — Proposed Engagement of Cascade Retail Holdings Inc. (US State Privacy Compliance Program)
Matter Number: | 1038-00010
Classification: | Internal — Not for Distribution Outside Calderwood & Harkness LLP
Team Member | Role | Conflict Status
Kevin Ostrowski, Partner | Responsible Partner, Privacy & Data Security | No conflicts identified
Rachel Bernstein, Partner | Billing Partner, Privacy & Data Security | No conflicts identified
Alan Burke, Senior Associate | Lead Associate, Privacy & Data Security | No conflicts identified
Sara Hendricks, Associate | Working Associate, Privacy & Data Security | No conflicts identified

MEMORANDUM — CONFIDENTIAL — ATTORNEY WORK PRODUCT

CALDERWOOD & HARKNESS LLP

Record

Parties

Dates

Amounts