1038-00010 · Cascade Retail Holdings · Engagement

engagement-letter-cascade-privacy-program.docx DOCUMENT Finance & Banking

23 / 38 ← → ✕

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, New York 10022

Practice Group: Privacy & Data Security Telephone: (212) 596-4400 Facsimile: (212) 596-4401 www.calderwoodharkness.com

June 2, 2025

VIA ELECTRONIC MAIL AND Sundial Data Systems

Meredith Tanaka, Esq. General Counsel Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119

Re: Engagement of Calderwood & Harkness LLP — US State Privacy Compliance Program Matter Number: 1038-00010

Dear Ms. Tanaka:

1. Purpose and Formation of Engagement

Calderwood & Harkness LLP ("C&H" or the "Firm") is pleased to confirm its engagement by Cascade Retail Holdings Inc. ("Cascade" or the "Company"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: CSRD), to design, build, and implement a comprehensive US state-privacy compliance program (the "Privacy Program" or the "Program"). This letter (the "Engagement Letter") sets forth the terms and conditions of the Firm's representation of Cascade and shall be effective as of June 2, 2025 (the "Effective Date").

This engagement follows from a series of productive discussions between Kevin Ostrowski of this Firm and you regarding the scope, structure, phasing, and resource requirements of the Privacy Program, including the meetings held on April 14, 2025, May 5, 2025, and May 20, 2025, as well as subsequent email correspondence and telephone calls. We appreciate the thoroughness of those discussions and the detailed background materials you and your team have provided, which have enabled us to develop the engagement framework described herein.

We want to be clear at the outset that C&H's representation of Cascade is limited to the matters described in this Engagement Letter. This engagement does not extend to any other legal matters, nor does it create an attorney-client relationship with respect to any matters beyond the scope set forth herein, unless separately agreed in writing by both parties. Any expansion of the scope of C&H's representation of Cascade will be documented in a supplemental engagement letter or amendment to this Engagement Letter, executed by authorized representatives of both parties.

2. Client Identification

For purposes of this engagement, the "Client" shall mean Cascade Retail Holdings Inc. (EIN: 84-3192057), together with the following wholly owned subsidiaries, to the extent that their operations fall within the scope of the Privacy Program as defined in Section 3 below:

(a) Cascade Digital Marketplace LLC (a Delaware limited liability company; EIN: 85-4107638), which operates Cascade's third-party seller marketplace platform;

(b) Ridgeline Fulfillment Services Inc. (a Washington corporation; EIN: 91-1647823), which provides warehousing, logistics, and fulfillment services in support of Cascade's retail and e-commerce operations;

(c) Peakview Analytics Inc. (a Delaware corporation; EIN: 87-2250194), which operates Cascade's advertising technology stack and customer analytics platform; and

(d) Cascade Rewards Corp. (a Delaware corporation; EIN: 86-3381729), which administers the Cascade Rewards loyalty program and stored-value card programs.

Unless the context otherwise requires, references to "Cascade," the "Company," or the "Client" throughout this Engagement Letter shall include the foregoing subsidiaries to the extent relevant to the Privacy Program.

The primary client contact for this engagement shall be Meredith Tanaka, General Counsel, Cascade Retail Holdings Inc. The day-to-day client contact shall be Diana Polk, Associate General Counsel, who is currently serving as Interim Chief Privacy Officer. C&H will direct routine communications and work-product deliverables to Ms. Polk and will consult with you directly on strategic decisions, material scope changes, budget matters, and any issues of particular sensitivity.

3. Scope of Engagement

3.1 General Scope

C&H will design, build, and support the implementation of a comprehensive US state-privacy compliance program covering the full range of state consumer privacy statutes applicable to Cascade's operations. As of the Effective Date, the privacy regulatory landscape relevant to Cascade encompasses the following nineteen (19) enacted state privacy statutes:

(i) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA");

(ii) the Virginia Consumer Data Protection Act ("VCDPA");

(iii) the Colorado Privacy Act ("Colorado CPA");

(iv) the Connecticut Data Privacy Act ("CTDPA");

(v) the Utah Consumer Privacy Act ("UCPA");

(vi) the Iowa Consumer Data Protection Act ("ICDPA");

(vii) the Indiana Consumer Data Protection Act ("INCDPA");

(viii) the Tennessee Information Protection Act ("TIPA");

(ix) the Montana Consumer Data Privacy Act ("MCDPA");

(x) the Texas Data Privacy and Security Act ("TDPSA");

(xi) the Oregon Consumer Privacy Act ("OCPA");

(xii) the Delaware Personal Data Privacy Act ("DPDPA");

(xiii) the New Jersey Data Privacy Act ("NJDPA");

(xiv) the New Hampshire Data Privacy Act ("NHDPA");

(xv) the Nebraska Data Privacy Act ("NDPA");

(xvi) the Minnesota Consumer Data Privacy Act ("Minnesota MCDPA");

(xvii) the Maryland Online Data Privacy Act ("MODPA");

(xviii) the Kentucky Data Privacy Act ("KYDPA"); and

(xix) such additional state privacy statutes as may become effective or be enacted through the 2025–2026 legislative sessions and that are applicable to Cascade's operations (subject to Section 6.2 regarding scope changes and the Phase 1 Fee Cap).

The Privacy Program must comprehensively address the following aspects of Cascade's business operations:

(a) Cascade's direct-to-consumer retail operations, which currently comprise one hundred eighty-six (186) retail locations across thirty-one (31) US states, together with the Company's e-commerce platform accessible at www.cascade.com and through the Cascade mobile application;

(b) The third-party seller marketplace operated by Cascade Digital Marketplace LLC, which currently hosts approximately 3,800 third-party sellers and involves the collection, processing, and sharing of substantial consumer data in connection with marketplace transactions;

(c) The Cascade Rewards loyalty program, administered by Cascade Rewards Corp., with approximately 41.2 million registered members as of the date of this Engagement Letter, involving the collection and use of purchase history, preferences, demographic information, precise geolocation data, and stored-value card data;

(d) Cascade's advertising technology stack, operated through Peakview Analytics Inc., including programmatic advertising, behavioral targeting, cross-device tracking, audience segmentation, and data enrichment activities conducted through partnerships with third-party data providers and demand-side platforms; and

(e) The data practices of key vendors and service providers engaged by Cascade and its subsidiaries, currently comprising forty-seven (47) third-party advertising and analytics partners, as well as additional technology vendors, fulfillment partners, and service providers whose data-processing activities fall within the scope of applicable state privacy statutes.

3.2 Phase 1: Assessment, Gap Analysis, Policy Drafting, Vendor-Contract Templates, and Training Materials

Period: June 2, 2025 through December 31, 2025

Phase 1 will encompass the foundational assessment, analysis, and document-drafting work streams necessary to bring Cascade's privacy practices into compliance with applicable state privacy statutes and to establish the governance infrastructure for a sustainable, enterprise-wide privacy program. The specific deliverables and work streams for Phase 1 are as follows:

Assessment and Analysis Deliverables:

(a) Multi-State Privacy Law Applicability Analysis and Matrix. C&H will prepare a comprehensive analysis identifying which state privacy statutes apply to each of Cascade's business units and subsidiaries, including a detailed applicability matrix mapping statutory thresholds (revenue, data-volume triggers, and other jurisdictional criteria) against each entity's operations.

(b) Data-Mapping Review. C&H will conduct a thorough legal review of the data-mapping report prepared by Fieldhaven Consulting Group LLC (dated May 19, 2025) and will identify legally significant data flows — including cross-border data transfers, data-sharing arrangements with third parties, data flows through the advertising technology stack, and data flows involving sensitive personal information — that implicate specific compliance obligations under applicable state statutes.

(c) Comprehensive Gap-Analysis Report. C&H will prepare a detailed gap-analysis report identifying compliance deficiencies across all applicable state privacy statutes. The report will include risk ratings (high, medium, low) for each identified deficiency, specific statutory references, and prioritized remediation recommendations. The gap-analysis report will be structured to allow the Company's management and board to understand the current state of compliance and the work required to achieve the target state.

(d) Sensitive Personal Information Analysis. C&H will prepare a focused analysis of Cascade's collection, use, and sharing of sensitive personal information as defined under the various applicable statutes, including precise geolocation data, payment card and financial account data, account credentials and authentication data, and any other categories of data classified as "sensitive" under one or more applicable statutes. This analysis will identify heightened consent requirements, processing limitations, and disclosure obligations triggered by Cascade's handling of sensitive data categories.

(e) Third-Party Data-Sharing Risk Assessment and Vendor Classification. C&H will assess the privacy risks associated with Cascade's data-sharing relationships with third parties, including the forty-seven (47) advertising and analytics partners and other material vendors. C&H will prepare a vendor classification framework categorizing each material vendor as a "service provider/processor," "contractor," "third party," or equivalent classification under applicable statutes, and will identify remediation steps for any misclassified or inadequately documented relationships.

(f) Privileged Summary of Prior Regulatory Interactions. C&H will prepare a privileged and confidential memorandum summarizing Cascade's prior regulatory interactions relevant to the Privacy Program, including the Federal Trade Commission Civil Investigative Demand (FTC CID File No. 232-0147) and the California Attorney General inquiry, and assessing the implications of those interactions for the design of the Privacy Program.

(g) Children's Privacy and Age-Gating Analysis. C&H will analyze Cascade's compliance obligations under the Children's Online Privacy Protection Act ("COPPA") and the California Age-Appropriate Design Code Act ("AADC"), including an assessment of whether Cascade's e-commerce platform, mobile application, or marketplace are "directed to children" or are "likely to be accessed by children" under applicable standards, and will recommend age-gating and age-estimation measures as warranted.

Consumer-Facing and Internal Privacy Notices:

(h) Privacy Policy Suite. C&H will draft a comprehensive suite of consumer-facing privacy notices, including:

(i) an omnibus privacy policy covering Cascade's direct-to-consumer retail and e-commerce operations;

(ii) a California-specific addendum addressing CCPA/CPRA-specific notice requirements, including the notice at collection, right-to-know categories and disclosures, and financial-incentive notice for the Cascade Rewards program;

(iii) a state-specific consumer rights supplement addressing the varying rights frameworks under each applicable state statute; and

(iv) a cookie and tracking technologies notice for cascade.com and the Cascade mobile application, coordinated with the deployment of the consent-management platform.

(i) Employee and Job-Applicant Privacy Notice. C&H will draft a privacy notice addressed to Cascade's employees and job applicants, as required under applicable state statutes (including, in particular, the CCPA/CPRA's employee-data provisions).

(j) Loyalty Program Privacy Notice. C&H will draft a standalone privacy notice for the Cascade Rewards loyalty program, addressing the unique data-collection and data-use practices associated with the program, including stored-value card data, purchase-history analytics, and the financial-incentive provisions of the CCPA/CPRA.

(k) Third-Party Marketplace Seller Privacy Notice. C&H will draft a privacy notice for the third-party sellers on Cascade Digital Marketplace LLC's platform, informing sellers of the data Cascade collects about them and their customers in connection with marketplace transactions.

Vendor Agreements and Data Processing Agreements:

(l) Master DPA Templates. C&H will draft master data processing agreement ("DPA") templates for use with Cascade's service providers and contractors, designed to satisfy the contractual requirements of all applicable state privacy statutes and incorporating appropriate flow-down obligations, audit rights, sub-processor requirements, and breach-notification provisions.

(m) Thornbridge Media Corp. Data-Sharing Agreement. C&H will lead the restructuring and negotiation of the data-sharing agreement between Cascade (through Peakview Analytics Inc.) and Thornbridge Media Corp., to bring the agreement into compliance with applicable state privacy statutes and to appropriately allocate data-protection obligations between the parties. Thornbridge Media Corp. is represented by Kellner Park & Associates LLP (Victor Sandoval, lead counsel).

(n) OnPoint Data Solutions Inc. DPA Rider/Amendment. C&H will draft and negotiate a DPA rider or amendment to the existing agreement with OnPoint Data Solutions Inc., Cascade's consent-management platform ("CMP") vendor, to ensure that the agreement satisfies the contractual requirements of applicable state privacy statutes and adequately addresses the data-processing activities inherent in the CMP deployment.

(o) Fieldhaven Consulting Group LLC SOW Data-Protection Terms Review. C&H will review the data-protection terms in Fieldhaven Consulting Group LLC's statement of work to assess their adequacy under applicable state privacy statutes and recommend any necessary amendments.

(p) Vendor DPA Rollout Plan. C&H will prepare a prioritized rollout plan for the deployment of the master DPA template to Cascade's remaining vendors and service providers, including recommended sequencing, negotiation guidance, and tracking mechanisms.

(q) Marketplace Seller Data-Use Terms Addendum. C&H will draft an addendum to Cascade Digital Marketplace LLC's standard marketplace seller agreement addressing data-use restrictions, data-sharing limitations, and seller obligations under applicable state privacy statutes.

Governance, Procedures, and Training:

(r) Privacy Governance Charter and Board Resolution. C&H will draft a Privacy Governance Charter establishing the organizational structure, roles, and responsibilities for the Privacy Program, including the reporting relationship between the Chief Privacy Officer and the Audit & Risk Committee of Cascade's Board of Directors. C&H will also draft a board resolution for the Audit & Risk Committee's adoption of the Charter.

(s) Internal Privacy Policy and Procedures Manual. C&H will draft a comprehensive internal privacy policy and procedures manual for use by Cascade employees, covering data-handling standards, incident-response protocols, permissible uses and disclosures, and escalation procedures.

(t) Data Retention and Disposal Schedule. C&H will prepare a data retention and disposal schedule applicable to Cascade's personal-information holdings, aligned with applicable state privacy statute requirements and coordinated with Cascade's existing records-management practices.

(u) Data Subject Request (DSR) Standard Operating Procedures. C&H will draft detailed standard operating procedures for the receipt, verification, processing, and fulfillment of consumer data subject requests — including requests to know, delete, correct, opt out of sale/sharing, and limit use of sensitive personal information — across all applicable state privacy statutes.

(v) Privacy Impact Assessment (PIA) Framework and Template. C&H will develop a privacy impact assessment framework and template for use in evaluating new products, features, data uses, and vendor relationships that involve the processing of personal information.

(w) Employee Privacy Training Program. C&H will develop an outline and materials for an employee privacy training program, covering the key requirements of applicable state privacy statutes, Cascade's internal privacy policies, and the procedures employees must follow when handling personal information or responding to consumer inquiries.

(x) Phase 1 Compliance-Readiness Certification Memorandum. At the conclusion of Phase 1, C&H will deliver a privileged memorandum certifying the state of Cascade's compliance readiness across all applicable state privacy statutes, identifying any remaining open items, and recommending next steps for Phase 2.

(y) Board Presentation Memorandum. C&H will prepare a memorandum suitable for presentation to the Audit & Risk Committee of Cascade's Board of Directors summarizing the Privacy Program, its design, current compliance status, key risks, and the roadmap for Phase 2.

3.3 Phase 2: Implementation Support, Ongoing Monitoring, Training, and Regulatory Response

Period: January 1, 2026 through June 30, 2026

Phase 2 will encompass the following work streams:

(a) Ongoing Legal Support for Technical Implementation. C&H will provide ongoing legal advice and guidance in connection with the technical implementation of privacy controls, including the deployment and configuration of the consent-management platform (OnPoint Data Solutions Inc.), DSR automation workflows, data-mapping tool integration, and related technology implementations. C&H's role in this regard is advisory; technical implementation will be performed by Fieldhaven Consulting Group LLC and Cascade's internal IT team.

(b) Regulatory Monitoring and Updates. C&H will monitor the enactment and implementation of new state privacy statutes and material amendments to existing statutes, and will advise Cascade on any compliance adjustments required as additional statutes take effect during the Phase 2 period. C&H will provide periodic regulatory update memoranda, anticipated on a monthly basis or more frequently as warranted by legislative developments.

(c) Training Delivery Support. C&H will support Cascade's internal team in the delivery of the employee privacy training program developed during Phase 1, including the provision of subject-matter expert presentations, live Q&A sessions, and written training supplements as needed.

(d) Regulatory Inquiry and Response Support. Should Cascade receive any regulatory inquiries, information requests, or informal communications from state attorneys general, the California Privacy Protection Agency ("CPPA"), the Federal Trade Commission, or other regulatory authorities during the Phase 2 period in connection with the subject matter of this engagement, C&H will provide advisory support and assist in the preparation of responses, subject to the scope exclusions set forth in Section 3.4 below.

(e) First Annual Privacy-Program Assessment. C&H will conduct the first annual assessment of the Privacy Program, targeted for completion by June 30, 2026, evaluating the effectiveness of the program, identifying areas for improvement, and recommending adjustments in light of regulatory developments and operational changes.

(f) CPO Hiring and Organizational Advisory. C&H will advise Cascade on the hiring of a permanent Chief Privacy Officer, including the development of a position description, organizational reporting structure, and recommended qualifications, and will provide guidance on the transition of program oversight from the Interim CPO (Diana Polk) to a permanent CPO.

The specific scope of Phase 2 may be further defined and adjusted by mutual agreement of the parties as Phase 1 nears completion and the Company's implementation needs become more clearly defined. Any material scope expansions will be documented in a supplemental engagement letter or written amendment to this Engagement Letter.

3.4 Exclusions from Scope

The following matters are expressly excluded from the scope of this engagement:

(a) Litigation, Enforcement, and Government Investigations. This engagement does not include the representation of Cascade in connection with any litigation, regulatory enforcement proceedings, or government investigations (including, without limitation, any matters arising from the FTC CID File No. 232-0147 or the California Attorney General inquiry referenced herein). Any such representation would require a separate engagement letter with terms appropriate to the nature and scope of the matter.

(b) Securities, Corporate Governance, and SEC Disclosure. Securities law compliance, corporate governance matters, and SEC disclosure obligations (including privacy-related risk-factor disclosures and proxy statement disclosures) will continue to be handled by Whitfield Greaves LLP (Carolyn J. Marsden, lead partner). C&H will coordinate with Whitfield Greaves on matters at the intersection of the Privacy Program and SEC disclosure under a separate common-interest agreement, as further described in Section 7 below.

(c) Technical Implementation. The technical implementation of privacy controls — including the deployment and configuration of the consent-management platform, data-mapping tools, and DSR-workflow automation systems — will be performed by Fieldhaven Consulting Group LLC (Marcus Ellerby, engagement lead) under a separate engagement directly with Cascade. C&H will oversee Fieldhaven's work product for legal sufficiency and provide legal guidance to ensure that technical implementations satisfy applicable statutory requirements, but C&H does not assume responsibility for the technical implementation itself, including system performance, availability, or technical defects.

(d) Cybersecurity Incident Response and Insurance. Cybersecurity incident response planning and execution, cyber and privacy liability insurance procurement and renewal, and insurance coverage analysis are excluded from this engagement. The Company's insurance broker is Ridgepoint Insurance Brokers Inc., and the Company's primary cyber/privacy liability carrier is Northcastle Indemnity Company.

(e) Independent Audit and SOC 2. Independent audit matters and SOC 2 Type II audit engagements remain with Lakemont Audit Partners LLP (Sheila Brogan, engagement partner) and are not within the scope of C&H's representation.

4. Engagement Team and Staffing

The following attorneys will serve as the core engagement team for this matter:

Kevin Ostrowski — Responsible Partner, Privacy & Data Security. Mr. Ostrowski will have overall responsibility for the engagement, including client relationship management, strategic direction, supervision and quality assurance of all work product, and service as the primary contact for strategic decisions. Mr. Ostrowski will participate directly in key deliverables, including the gap-analysis report, the Thornbridge Media Corp. negotiation, the Privacy Governance Charter, and the board presentation memorandum.

Rachel Bernstein — Billing Partner, Privacy & Data Security. Ms. Bernstein will oversee billing, fee arrangement administration, and compliance with Cascade's outside-counsel guidelines. Ms. Bernstein will also provide supplemental substantive support on selected work streams as needed, drawing on her extensive experience with multi-state consumer privacy compliance programs.

Alan Burke — Lead Associate (Senior Associate), Privacy & Data Security. Mr. Burke will serve as the day-to-day engagement manager, coordinating all work streams and serving as the primary point of contact for Diana Polk. Mr. Burke will serve as the lead drafting attorney for the gap-analysis report, DPA templates, the Thornbridge Media Corp. data-sharing agreement, the Privacy Governance Charter, and internal policies and procedures.

Sara Hendricks — Working Associate, Privacy & Data Security. Ms. Hendricks will provide drafting support for consumer-facing privacy notices, conduct state-law research and analysis, support the data-mapping legal review, and assist in the development of employee training materials.

C&H reserves the right to assign additional attorneys, including partners, associates, and legal specialists, or to adjust staffing as necessary to meet engagement milestones and deliver high-quality work product on a timely basis. The Client's primary contact will be notified of any material staffing changes. Notwithstanding the foregoing, any change to the Responsible Partner or Billing Partner requires prior written notice to the Client, and the Client shall have the right to discuss any such proposed change before it takes effect.

5. Key Milestones and Timeline

The following table sets forth the target dates for key milestones of the engagement. These milestones represent the parties' current expectations and are subject to adjustment by mutual agreement. Timely performance of these milestones depends upon the cooperation of the Client and its personnel, the timely delivery of information and work product by third parties (including Fieldhaven Consulting Group LLC, OnPoint Data Solutions Inc., and Thornbridge Media Corp.), and the absence of unanticipated regulatory developments or material changes in scope.

C&H will provide the Client with regular status reports tracking progress against these milestones. If any milestone is at risk due to dependencies beyond C&H's control, C&H will promptly notify the Client and propose revised timelines. The parties will work together in good faith to resolve any scheduling issues and to keep the engagement on track.

6. Fees and Billing Arrangements

6.1 Hourly Rates

Fees for this engagement will be calculated on a blended hourly basis at the following rates, which reflect a discount from C&H's standard 2025 rates in recognition of the scope and duration of this engagement:

These rates are effective for the initial engagement period from the Effective Date through June 30, 2026. Any rate adjustments after June 30, 2026 will require sixty (60) days' prior written notice to the Client and will not take effect until the expiration of such notice period. Rate adjustments, if any, will be consistent with the Firm's annual rate-review process and competitive market conditions.

6.2 Phase 1 Fee Cap

Total fees for Phase 1 of this engagement (June 2, 2025 through December 31, 2025) shall not exceed Two Million Six Hundred Thousand Dollars ($2,600,000) (the "Phase 1 Fee Cap"). The Phase 1 Fee Cap applies to all attorney time expended by C&H in connection with the Phase 1 deliverables and work streams described in Section 3.2 above.

The Phase 1 Fee Cap does not include:

(a) disbursements and out-of-pocket expenses, which will be billed separately as described in Section 6.4 below;

(b) fees for work outside the defined Phase 1 scope, including, without limitation, work in connection with regulatory inquiries, enforcement actions, litigation, or other matters excluded from scope under Section 3.4; or

(c) fees for compliance work relating to state privacy statutes enacted or becoming effective after the Effective Date that are beyond the nineteen (19) statutes identified in Section 3.1, to the extent such work materially expands the Phase 1 scope as mutually determined by the parties.

If the scope of Phase 1 changes materially during the engagement period — whether due to the enactment of new state privacy statutes, unanticipated regulatory developments, changes in Cascade's business operations, or other factors — the parties will discuss in good faith whether an adjustment to the Phase 1 Fee Cap is warranted. Any adjustment to the Phase 1 Fee Cap will be documented in writing and signed by both parties before becoming effective. C&H will provide the Client with periodic budget reports tracking actual fees against the Phase 1 Fee Cap, with the first such report to be delivered no later than August 1, 2025, and monthly thereafter.

6.3 Phase 2 Fees

Phase 2 of this engagement (January 1, 2026 through June 30, 2026) will be billed on an hourly basis at the rates set forth in Section 6.1 above. Based on the currently anticipated scope of Phase 2 as described in Section 3.3, C&H estimates that Phase 2 fees will range from $1,400,000 to $1,800,000. This estimate is provided for planning purposes only and is not a fee cap, ceiling, or guarantee.

Phase 2 is not subject to a fee cap. Actual Phase 2 fees may vary depending on the scope of work required, the pace of regulatory developments, the volume of regulatory inquiries, the extent of implementation support needed, and other factors. C&H will provide monthly budget updates to the Client during Phase 2, including a comparison of actual fees to the initial estimate and an updated forecast for the remainder of the phase.

If Phase 2 scope and fees are projected to exceed the upper end of the initial estimate by a material amount, C&H will promptly notify the Client and discuss options for managing costs, including potential scope adjustments, alternative fee arrangements, or other measures.

6.4 Expenses and Disbursements

The Client will reimburse C&H for reasonable out-of-pocket expenses incurred in connection with the engagement, including but not limited to:

(a) travel expenses (airfare, ground transportation, and hotel accommodations) for trips to Cascade's Seattle headquarters and other locations reasonably necessary in connection with the engagement;

(b) meals and incidentals during engagement-related travel;

(d) outside vendor costs (e.g., specialized research services, expert consultants retained at Client's request);

(e) electronic legal research charges (Westmark Data Systems, Sundial Solutions, and similar services); and

(f) courier and delivery charges.

Expenses are not included in the Phase 1 Fee Cap and will be billed separately on monthly invoices. Any single expense or commitment to incur expenses exceeding $5,000 requires prior approval from the Client's primary contact (Meredith Tanaka) or day-to-day contact (Diana Polk).

6.5 Billing and Payment

C&H will issue monthly invoices for fees and expenses incurred during the preceding calendar month. Invoices will include reasonable detail regarding the services rendered during the billing period, including the name and level of each timekeeper, the hours worked by each timekeeper, a description of the services performed, and itemized expense descriptions.

Payment is due within thirty (30) days of the invoice date. Invoices and billing correspondence should be directed to:

Meredith Tanaka, Esq. General Counsel Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119

Email: m.tanaka@cascaderetail.com

All billing inquiries, including questions regarding invoice detail, staffing, rate application, or expense items, may be directed to Rachel Bernstein, Billing Partner, at (212) 596-4418 or r.bernstein@calderwoodharkness.com. C&H is committed to transparent and responsive billing practices, and we welcome open dialogue regarding fees and expenses at any time during the engagement.

7. Coordination with Other Advisors

This engagement will require coordination with several other professional advisors engaged by Cascade. C&H's coordination responsibilities and relationships with those advisors are described below:

(a) Whitfield Greaves LLP. C&H will coordinate with Whitfield Greaves LLP (Carolyn J. Marsden, lead partner) on SEC-disclosure and corporate-governance aspects of the Privacy Program. This coordination will address, among other things, privacy-related risk-factor disclosures, proxy statement disclosures regarding privacy governance, and the interplay between the Privacy Governance Charter and Cascade's existing corporate governance framework. Such coordination will be conducted pursuant to a common-interest agreement to be negotiated and executed by C&H, Whitfield Greaves, and Cascade. Until such common-interest agreement is in place, C&H will not share privileged communications or work product with Whitfield Greaves without the Client's prior authorization.

(b) Fieldhaven Consulting Group LLC. C&H will oversee Fieldhaven Consulting Group LLC's work product for legal sufficiency and will provide legal guidance to ensure that Fieldhaven's technical implementations satisfy applicable statutory requirements. Fieldhaven's engagement is directly with Cascade under a separate fixed-fee statement of work (contract value: $3,150,000, payable in three milestone installments). C&H does not represent Fieldhaven, and C&H is not responsible for Fieldhaven's performance, work quality, timelines, or technical deliverables. C&H's oversight role is limited to reviewing Fieldhaven's work product from a legal-compliance perspective.

(c) OnPoint Data Solutions Inc. C&H will review and advise the Client on the OnPoint Data Solutions Inc. CMP SaaS contract (three-year term; annual license fee of $480,000; total contract value of $1,440,000), including the negotiation of a DPA rider or amendment as described in Section 3.2(n). C&H does not represent OnPoint and has no advisory relationship with OnPoint.

(d) Thornbridge Media Corp. C&H will lead the negotiation with Thornbridge Media Corp. and its outside counsel, Kellner Park & Associates LLP (Victor Sandoval), for the restructured data-sharing agreement described in Section 3.2(m). All communications with Thornbridge and its counsel will be conducted at the direction of and on behalf of Cascade.

C&H does not represent and is not responsible for the work, advice, performance, or deliverables of any other advisor to Cascade. While C&H will endeavor to coordinate effectively with Cascade's other advisors as described above, C&H's obligations under this Engagement Letter are limited to the scope of work described herein.

8. Confidentiality and Privilege

All communications between C&H and Cascade, and between C&H and Cascade's officers, employees, and agents, in connection with this engagement are intended to be protected by the attorney-client privilege and the attorney work-product doctrine to the fullest extent permitted by applicable law. C&H will take reasonable steps to maintain and protect these privileges throughout the engagement.

C&H will treat all information received from the Client in connection with this engagement as confidential and will not disclose such information to any third party without the Client's prior authorization, except as required by applicable law, court order, or C&H's professional obligations under the New York Rules of Professional Conduct.

Any sharing of privileged communications or work product with Whitfield Greaves LLP will be governed by the common-interest agreement referenced in Section 7(a) above. Such sharing will not be undertaken until the common-interest agreement is fully executed.

C&H's oversight of Fieldhaven Consulting Group LLC's work product and C&H's communications with Fieldhaven personnel will be structured to preserve the attorney-client privilege and work-product protection to the extent possible. Specific protocols for privilege preservation in the context of the Fieldhaven relationship — including the designation of communications as privileged, the use of privilege labels and legends, and the scope of information-sharing between C&H and Fieldhaven — will be established during the Phase 1 kickoff meeting and documented in a written privilege protocol to be distributed to the engagement team and relevant Fieldhaven personnel.

9. Conflicts of Interest

In connection with this engagement, C&H has conducted a comprehensive conflicts-of-interest check covering the Client and each of its subsidiaries identified in Section 2, as well as the following key counterparties and advisors:

• Thornbridge Media Corp.

• OnPoint Data Solutions Inc.

• Fieldhaven Consulting Group LLC

• Kellner Park & Associates LLP

• Whitfield Greaves LLP

Based on the results of this conflicts check, C&H confirms that no disqualifying conflicts of interest currently exist that would preclude C&H from undertaking this engagement.

If a conflict of interest arises during the course of the engagement, C&H will promptly notify the Client and will take appropriate action in accordance with the New York Rules of Professional Conduct, including, where applicable, seeking the Client's informed consent to continued representation or withdrawing from the engagement or the conflicting matter.

The Client acknowledges that C&H is a large, multi-practice law firm and that C&H represents a substantial number of clients across a wide range of industries and practice areas. C&H may represent other clients in matters unrelated to this engagement that could involve entities or individuals tangentially related to Cascade's business, including vendors, competitors, or business partners of Cascade. Such representations do not constitute conflicts of interest absent a direct adversity to Cascade in the same matter or a substantially related matter, and the Client consents to C&H's continued representation of such clients in unrelated matters.

10. Document Retention

C&H will maintain all engagement files, including correspondence, memoranda, drafts, final work product, and internal records, in accordance with the Firm's document-retention policy and the Client's outside-counsel guidelines, to the extent those guidelines have been provided to C&H and are consistent with C&H's professional obligations.

Upon termination or conclusion of the engagement, C&H will return or destroy Client materials in accordance with the Client's written instructions, subject to C&H's obligations under applicable law and professional conduct rules to retain certain records (including, for example, records necessary to demonstrate the nature and scope of services rendered). C&H will cooperate with the Client to facilitate the orderly transfer of files and work product to the Client or to successor counsel.

11. Termination

Either party may terminate this engagement at any time upon thirty (30) days' prior written notice to the other party. Written notice of termination shall be directed to the contacts identified in Section 2 (for the Client) and Section 4 (for C&H).

Upon termination, C&H will take all steps reasonably necessary to protect the Client's interests, including facilitating the transition of pending matters and work product to successor counsel designated by the Client, providing reasonable cooperation during the transition period, and complying with all applicable professional-conduct obligations regarding withdrawal from representation.

The Client will remain responsible for all fees and expenses properly incurred through the effective date of termination. With respect to work performed during the Phase 1 period, the Client's fee obligation will be subject to the Phase 1 Fee Cap as described in Section 6.2, pro-rated if appropriate to reflect the scope of work completed as of the date of termination.

Termination of this engagement will not affect the parties' obligations under Section 8 (Confidentiality and Privilege) or Section 12 (Limitation of Liability), which shall survive termination.

12. Limitation of Liability

C&H's aggregate liability to the Client arising out of or relating to this engagement, whether based in contract, tort, negligence, professional malpractice, or any other theory of liability, shall not exceed the total fees actually paid by the Client to C&H for the phase of the engagement (Phase 1 or Phase 2, as applicable) giving rise to the claim. For the avoidance of doubt, if a claim relates to work performed during Phase 1, C&H's aggregate liability shall not exceed the total fees actually paid by the Client for Phase 1 work; if a claim relates to work performed during Phase 2, C&H's aggregate liability shall not exceed the total fees actually paid by the Client for Phase 2 work.

This limitation of liability does not apply to claims arising from C&H's willful misconduct or gross negligence. In no event shall C&H be liable for consequential, incidental, special, punitive, or exemplary damages, regardless of whether C&H has been advised of the possibility of such damages.

The Client acknowledges that the fees charged for this engagement reflect the allocation of risk set forth in this Section 12, and that a different fee arrangement would be required in the absence of this limitation.

13. Governing Law and Dispute Resolution

This Engagement Letter shall be governed by, and construed in accordance with, the laws of the State of New York, without giving effect to its conflict-of-laws principles.

Any dispute, claim, or controversy arising out of or relating to this Engagement Letter or the engagement contemplated hereby, including disputes regarding the formation, validity, interpretation, performance, breach, or termination of this Engagement Letter, shall be resolved exclusively by binding arbitration administered in New York, New York, in accordance with the Commercial Arbitration Rules of the American Arbitration Association then in effect. The arbitration shall be conducted before a single arbitrator with experience in legal-malpractice or professional-services disputes, selected in accordance with the AAA rules. The arbitrator's award shall be final and binding, and judgment on the award may be entered in any court of competent jurisdiction. Each party shall bear its own costs and attorneys' fees in connection with any arbitration, except that the arbitrator may allocate costs and fees in the award if the arbitrator determines that a party's claims or defenses were frivolous or brought in bad faith.

14. Outside-Counsel Guidelines

C&H acknowledges receipt of Cascade Retail Holdings Inc.'s Outside-Counsel Guidelines (revised January 2025) and agrees to comply with those guidelines to the extent they are consistent with the terms of this Engagement Letter, C&H's professional obligations, and the New York Rules of Professional Conduct. In the event of any conflict between the Outside-Counsel Guidelines and the terms of this Engagement Letter, the terms of this Engagement Letter shall control.

A separate acknowledgment letter confirming C&H's receipt of and agreement to the Outside-Counsel Guidelines, and noting any exceptions or clarifications, will be provided by C&H within ten (10) business days of the Effective Date.

15. Acceptance and Execution

This Engagement Letter, together with the enclosures referenced below and incorporated herein by reference, constitutes the entire agreement between the parties with respect to the terms and conditions of C&H's engagement by Cascade as described herein, and supersedes all prior discussions, negotiations, proposals, and understandings, whether oral or written, relating to the subject matter of this Engagement Letter.

This Engagement Letter may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Execution and delivery of this Engagement Letter by electronic means (including PDF or Brightwater Software) shall be valid and effective for all purposes.

We are excited to work with Cascade and its talented legal team on this important initiative. If the foregoing terms are acceptable, please sign and return a copy of this Engagement Letter at your earliest convenience. We are prepared to commence work immediately upon execution.

[Signature Page Follows]

CALDERWOOD & HARKNESS LLP

By: ________

Name: Kevin Ostrowski

Title: Partner, Privacy & Data Security

Date: ________

ACCEPTED AND AGREED:

CASCADE RETAIL HOLDINGS INC.

By: ________

Name: Meredith Tanaka

Title: General Counsel

Date: ________

Enclosures:

Enclosure A: C&H Standard Terms of Engagement (incorporated by reference)

Enclosure B: Engagement Team Biographies

cc: Diana Polk, Associate General Counsel, Cascade Retail Holdings Inc. Rachel Bernstein, Partner, Calderwood & Harkness LLP Thomas R. Cavanaugh, Chief Executive Officer, Cascade Retail Holdings Inc.

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, New York 10022
Practice Group: Privacy & Data Security Telephone: (212) 596-4400 Facsimile: (212) 596-4401 www.calderwoodharkness.com
June 2, 2025
VIA ELECTRONIC MAIL AND Sundial Data Systems
Meredith Tanaka, Esq. General Counsel Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Re: Engagement of Calderwood & Harkness LLP — US State Privacy Compliance Program Matter Number: 1038-00010
Dear Ms. Tanaka:
1. Purpose and Formation of Engagement
Calderwood & Harkness LLP ("C&H" or the "Firm") is pleased to confirm its engagement by Cascade Retail Holdings Inc. ("Cascade" or the "Company"), a Delaware corporation publicly traded on the Nasdaq Stock Market (ticker: CSRD), to design, build, and implement a comprehensive US state-privacy compliance program (the "Privacy Program" or the "Program"). This letter (the "Engagement Letter") sets forth the terms and conditions of the Firm's representation of Cascade and shall be effective as of June 2, 2025 (the "Effective Date").
This engagement follows from a series of productive discussions between Kevin Ostrowski of this Firm and you regarding the scope, structure, phasing, and resource requirements of the Privacy Program, including the meetings held on April 14, 2025, May 5, 2025, and May 20, 2025, as well as subsequent email correspondence and telephone calls. We appreciate the thoroughness of those discussions and the detailed background materials you and your team have provided, which have enabled us to develop the engagement framework described herein.
We want to be clear at the outset that C&H's representation of Cascade is limited to the matters described in this Engagement Letter. This engagement does not extend to any other legal matters, nor does it create an attorney-client relationship with respect to any matters beyond the scope set forth herein, unless separately agreed in writing by both parties. Any expansion of the scope of C&H's representation of Cascade will be documented in a supplemental engagement letter or amendment to this Engagement Letter, executed by authorized representatives of both parties.
2. Client Identification
For purposes of this engagement, the "Client" shall mean Cascade Retail Holdings Inc. (EIN: 84-3192057), together with the following wholly owned subsidiaries, to the extent that their operations fall within the scope of the Privacy Program as defined in Section 3 below:
(a) Cascade Digital Marketplace LLC (a Delaware limited liability company; EIN: 85-4107638), which operates Cascade's third-party seller marketplace platform;
(b) Ridgeline Fulfillment Services Inc. (a Washington corporation; EIN: 91-1647823), which provides warehousing, logistics, and fulfillment services in support of Cascade's retail and e-commerce operations;
(c) Peakview Analytics Inc. (a Delaware corporation; EIN: 87-2250194), which operates Cascade's advertising technology stack and customer analytics platform; and
(d) Cascade Rewards Corp. (a Delaware corporation; EIN: 86-3381729), which administers the Cascade Rewards loyalty program and stored-value card programs.
Unless the context otherwise requires, references to "Cascade," the "Company," or the "Client" throughout this Engagement Letter shall include the foregoing subsidiaries to the extent relevant to the Privacy Program.
The primary client contact for this engagement shall be Meredith Tanaka, General Counsel, Cascade Retail Holdings Inc. The day-to-day client contact shall be Diana Polk, Associate General Counsel, who is currently serving as Interim Chief Privacy Officer. C&H will direct routine communications and work-product deliverables to Ms. Polk and will consult with you directly on strategic decisions, material scope changes, budget matters, and any issues of particular sensitivity.
3. Scope of Engagement
3.1 General Scope
C&H will design, build, and support the implementation of a comprehensive US state-privacy compliance program covering the full range of state consumer privacy statutes applicable to Cascade's operations. As of the Effective Date, the privacy regulatory landscape relevant to Cascade encompasses the following nineteen (19) enacted state privacy statutes:
(i) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA");
(ii) the Virginia Consumer Data Protection Act ("VCDPA");
(iii) the Colorado Privacy Act ("Colorado CPA");
(iv) the Connecticut Data Privacy Act ("CTDPA");
(v) the Utah Consumer Privacy Act ("UCPA");
(vi) the Iowa Consumer Data Protection Act ("ICDPA");
(vii) the Indiana Consumer Data Protection Act ("INCDPA");
(viii) the Tennessee Information Protection Act ("TIPA");
(ix) the Montana Consumer Data Privacy Act ("MCDPA");
(x) the Texas Data Privacy and Security Act ("TDPSA");
(xi) the Oregon Consumer Privacy Act ("OCPA");
(xii) the Delaware Personal Data Privacy Act ("DPDPA");
(xiii) the New Jersey Data Privacy Act ("NJDPA");
(xiv) the New Hampshire Data Privacy Act ("NHDPA");
(xv) the Nebraska Data Privacy Act ("NDPA");
(xvi) the Minnesota Consumer Data Privacy Act ("Minnesota MCDPA");
(xvii) the Maryland Online Data Privacy Act ("MODPA");
(xviii) the Kentucky Data Privacy Act ("KYDPA"); and
(xix) such additional state privacy statutes as may become effective or be enacted through the 2025–2026 legislative sessions and that are applicable to Cascade's operations (subject to Section 6.2 regarding scope changes and the Phase 1 Fee Cap).
The Privacy Program must comprehensively address the following aspects of Cascade's business operations:
(a) Cascade's direct-to-consumer retail operations, which currently comprise one hundred eighty-six (186) retail locations across thirty-one (31) US states, together with the Company's e-commerce platform accessible at www.cascade.com and through the Cascade mobile application;
(b) The third-party seller marketplace operated by Cascade Digital Marketplace LLC, which currently hosts approximately 3,800 third-party sellers and involves the collection, processing, and sharing of substantial consumer data in connection with marketplace transactions;
(c) The Cascade Rewards loyalty program, administered by Cascade Rewards Corp., with approximately 41.2 million registered members as of the date of this Engagement Letter, involving the collection and use of purchase history, preferences, demographic information, precise geolocation data, and stored-value card data;
(d) Cascade's advertising technology stack, operated through Peakview Analytics Inc., including programmatic advertising, behavioral targeting, cross-device tracking, audience segmentation, and data enrichment activities conducted through partnerships with third-party data providers and demand-side platforms; and
(e) The data practices of key vendors and service providers engaged by Cascade and its subsidiaries, currently comprising forty-seven (47) third-party advertising and analytics partners, as well as additional technology vendors, fulfillment partners, and service providers whose data-processing activities fall within the scope of applicable state privacy statutes.
3.2 Phase 1: Assessment, Gap Analysis, Policy Drafting, Vendor-Contract Templates, and Training Materials
Period: June 2, 2025 through December 31, 2025
Phase 1 will encompass the foundational assessment, analysis, and document-drafting work streams necessary to bring Cascade's privacy practices into compliance with applicable state privacy statutes and to establish the governance infrastructure for a sustainable, enterprise-wide privacy program. The specific deliverables and work streams for Phase 1 are as follows:
Assessment and Analysis Deliverables:
(a) Multi-State Privacy Law Applicability Analysis and Matrix. C&H will prepare a comprehensive analysis identifying which state privacy statutes apply to each of Cascade's business units and subsidiaries, including a detailed applicability matrix mapping statutory thresholds (revenue, data-volume triggers, and other jurisdictional criteria) against each entity's operations.
(b) Data-Mapping Review. C&H will conduct a thorough legal review of the data-mapping report prepared by Fieldhaven Consulting Group LLC (dated May 19, 2025) and will identify legally significant data flows — including cross-border data transfers, data-sharing arrangements with third parties, data flows through the advertising technology stack, and data flows involving sensitive personal information — that implicate specific compliance obligations under applicable state statutes.
(c) Comprehensive Gap-Analysis Report. C&H will prepare a detailed gap-analysis report identifying compliance deficiencies across all applicable state privacy statutes. The report will include risk ratings (high, medium, low) for each identified deficiency, specific statutory references, and prioritized remediation recommendations. The gap-analysis report will be structured to allow the Company's management and board to understand the current state of compliance and the work required to achieve the target state.
(d) Sensitive Personal Information Analysis. C&H will prepare a focused analysis of Cascade's collection, use, and sharing of sensitive personal information as defined under the various applicable statutes, including precise geolocation data, payment card and financial account data, account credentials and authentication data, and any other categories of data classified as "sensitive" under one or more applicable statutes. This analysis will identify heightened consent requirements, processing limitations, and disclosure obligations triggered by Cascade's handling of sensitive data categories.
(e) Third-Party Data-Sharing Risk Assessment and Vendor Classification. C&H will assess the privacy risks associated with Cascade's data-sharing relationships with third parties, including the forty-seven (47) advertising and analytics partners and other material vendors. C&H will prepare a vendor classification framework categorizing each material vendor as a "service provider/processor," "contractor," "third party," or equivalent classification under applicable statutes, and will identify remediation steps for any misclassified or inadequately documented relationships.
(f) Privileged Summary of Prior Regulatory Interactions. C&H will prepare a privileged and confidential memorandum summarizing Cascade's prior regulatory interactions relevant to the Privacy Program, including the Federal Trade Commission Civil Investigative Demand (FTC CID File No. 232-0147) and the California Attorney General inquiry, and assessing the implications of those interactions for the design of the Privacy Program.
(g) Children's Privacy and Age-Gating Analysis. C&H will analyze Cascade's compliance obligations under the Children's Online Privacy Protection Act ("COPPA") and the California Age-Appropriate Design Code Act ("AADC"), including an assessment of whether Cascade's e-commerce platform, mobile application, or marketplace are "directed to children" or are "likely to be accessed by children" under applicable standards, and will recommend age-gating and age-estimation measures as warranted.
Consumer-Facing and Internal Privacy Notices:
(h) Privacy Policy Suite. C&H will draft a comprehensive suite of consumer-facing privacy notices, including:
(i) an omnibus privacy policy covering Cascade's direct-to-consumer retail and e-commerce operations;
(ii) a California-specific addendum addressing CCPA/CPRA-specific notice requirements, including the notice at collection, right-to-know categories and disclosures, and financial-incentive notice for the Cascade Rewards program;
(iii) a state-specific consumer rights supplement addressing the varying rights frameworks under each applicable state statute; and
(iv) a cookie and tracking technologies notice for cascade.com and the Cascade mobile application, coordinated with the deployment of the consent-management platform.
(i) Employee and Job-Applicant Privacy Notice. C&H will draft a privacy notice addressed to Cascade's employees and job applicants, as required under applicable state statutes (including, in particular, the CCPA/CPRA's employee-data provisions).
(j) Loyalty Program Privacy Notice. C&H will draft a standalone privacy notice for the Cascade Rewards loyalty program, addressing the unique data-collection and data-use practices associated with the program, including stored-value card data, purchase-history analytics, and the financial-incentive provisions of the CCPA/CPRA.
(k) Third-Party Marketplace Seller Privacy Notice. C&H will draft a privacy notice for the third-party sellers on Cascade Digital Marketplace LLC's platform, informing sellers of the data Cascade collects about them and their customers in connection with marketplace transactions.
Vendor Agreements and Data Processing Agreements:
(l) Master DPA Templates. C&H will draft master data processing agreement ("DPA") templates for use with Cascade's service providers and contractors, designed to satisfy the contractual requirements of all applicable state privacy statutes and incorporating appropriate flow-down obligations, audit rights, sub-processor requirements, and breach-notification provisions.
(m) Thornbridge Media Corp. Data-Sharing Agreement. C&H will lead the restructuring and negotiation of the data-sharing agreement between Cascade (through Peakview Analytics Inc.) and Thornbridge Media Corp., to bring the agreement into compliance with applicable state privacy statutes and to appropriately allocate data-protection obligations between the parties. Thornbridge Media Corp. is represented by Kellner Park & Associates LLP (Victor Sandoval, lead counsel).
(n) OnPoint Data Solutions Inc. DPA Rider/Amendment. C&H will draft and negotiate a DPA rider or amendment to the existing agreement with OnPoint Data Solutions Inc., Cascade's consent-management platform ("CMP") vendor, to ensure that the agreement satisfies the contractual requirements of applicable state privacy statutes and adequately addresses the data-processing activities inherent in the CMP deployment.
(o) Fieldhaven Consulting Group LLC SOW Data-Protection Terms Review. C&H will review the data-protection terms in Fieldhaven Consulting Group LLC's statement of work to assess their adequacy under applicable state privacy statutes and recommend any necessary amendments.
(p) Vendor DPA Rollout Plan. C&H will prepare a prioritized rollout plan for the deployment of the master DPA template to Cascade's remaining vendors and service providers, including recommended sequencing, negotiation guidance, and tracking mechanisms.
(q) Marketplace Seller Data-Use Terms Addendum. C&H will draft an addendum to Cascade Digital Marketplace LLC's standard marketplace seller agreement addressing data-use restrictions, data-sharing limitations, and seller obligations under applicable state privacy statutes.
Governance, Procedures, and Training:
(r) Privacy Governance Charter and Board Resolution. C&H will draft a Privacy Governance Charter establishing the organizational structure, roles, and responsibilities for the Privacy Program, including the reporting relationship between the Chief Privacy Officer and the Audit & Risk Committee of Cascade's Board of Directors. C&H will also draft a board resolution for the Audit & Risk Committee's adoption of the Charter.
(s) Internal Privacy Policy and Procedures Manual. C&H will draft a comprehensive internal privacy policy and procedures manual for use by Cascade employees, covering data-handling standards, incident-response protocols, permissible uses and disclosures, and escalation procedures.
(t) Data Retention and Disposal Schedule. C&H will prepare a data retention and disposal schedule applicable to Cascade's personal-information holdings, aligned with applicable state privacy statute requirements and coordinated with Cascade's existing records-management practices.
(u) Data Subject Request (DSR) Standard Operating Procedures. C&H will draft detailed standard operating procedures for the receipt, verification, processing, and fulfillment of consumer data subject requests — including requests to know, delete, correct, opt out of sale/sharing, and limit use of sensitive personal information — across all applicable state privacy statutes.
(v) Privacy Impact Assessment (PIA) Framework and Template. C&H will develop a privacy impact assessment framework and template for use in evaluating new products, features, data uses, and vendor relationships that involve the processing of personal information.
(w) Employee Privacy Training Program. C&H will develop an outline and materials for an employee privacy training program, covering the key requirements of applicable state privacy statutes, Cascade's internal privacy policies, and the procedures employees must follow when handling personal information or responding to consumer inquiries.
(x) Phase 1 Compliance-Readiness Certification Memorandum. At the conclusion of Phase 1, C&H will deliver a privileged memorandum certifying the state of Cascade's compliance readiness across all applicable state privacy statutes, identifying any remaining open items, and recommending next steps for Phase 2.
(y) Board Presentation Memorandum. C&H will prepare a memorandum suitable for presentation to the Audit & Risk Committee of Cascade's Board of Directors summarizing the Privacy Program, its design, current compliance status, key risks, and the roadmap for Phase 2.
3.3 Phase 2: Implementation Support, Ongoing Monitoring, Training, and Regulatory Response
Period: January 1, 2026 through June 30, 2026
Phase 2 will encompass the following work streams:
(a) Ongoing Legal Support for Technical Implementation. C&H will provide ongoing legal advice and guidance in connection with the technical implementation of privacy controls, including the deployment and configuration of the consent-management platform (OnPoint Data Solutions Inc.), DSR automation workflows, data-mapping tool integration, and related technology implementations. C&H's role in this regard is advisory; technical implementation will be performed by Fieldhaven Consulting Group LLC and Cascade's internal IT team.
(b) Regulatory Monitoring and Updates. C&H will monitor the enactment and implementation of new state privacy statutes and material amendments to existing statutes, and will advise Cascade on any compliance adjustments required as additional statutes take effect during the Phase 2 period. C&H will provide periodic regulatory update memoranda, anticipated on a monthly basis or more frequently as warranted by legislative developments.
(c) Training Delivery Support. C&H will support Cascade's internal team in the delivery of the employee privacy training program developed during Phase 1, including the provision of subject-matter expert presentations, live Q&A sessions, and written training supplements as needed.
(d) Regulatory Inquiry and Response Support. Should Cascade receive any regulatory inquiries, information requests, or informal communications from state attorneys general, the California Privacy Protection Agency ("CPPA"), the Federal Trade Commission, or other regulatory authorities during the Phase 2 period in connection with the subject matter of this engagement, C&H will provide advisory support and assist in the preparation of responses, subject to the scope exclusions set forth in Section 3.4 below.
(e) First Annual Privacy-Program Assessment. C&H will conduct the first annual assessment of the Privacy Program, targeted for completion by June 30, 2026, evaluating the effectiveness of the program, identifying areas for improvement, and recommending adjustments in light of regulatory developments and operational changes.
(f) CPO Hiring and Organizational Advisory. C&H will advise Cascade on the hiring of a permanent Chief Privacy Officer, including the development of a position description, organizational reporting structure, and recommended qualifications, and will provide guidance on the transition of program oversight from the Interim CPO (Diana Polk) to a permanent CPO.
The specific scope of Phase 2 may be further defined and adjusted by mutual agreement of the parties as Phase 1 nears completion and the Company's implementation needs become more clearly defined. Any material scope expansions will be documented in a supplemental engagement letter or written amendment to this Engagement Letter.
3.4 Exclusions from Scope
The following matters are expressly excluded from the scope of this engagement:
(a) Litigation, Enforcement, and Government Investigations. This engagement does not include the representation of Cascade in connection with any litigation, regulatory enforcement proceedings, or government investigations (including, without limitation, any matters arising from the FTC CID File No. 232-0147 or the California Attorney General inquiry referenced herein). Any such representation would require a separate engagement letter with terms appropriate to the nature and scope of the matter.
(b) Securities, Corporate Governance, and SEC Disclosure. Securities law compliance, corporate governance matters, and SEC disclosure obligations (including privacy-related risk-factor disclosures and proxy statement disclosures) will continue to be handled by Whitfield Greaves LLP (Carolyn J. Marsden, lead partner). C&H will coordinate with Whitfield Greaves on matters at the intersection of the Privacy Program and SEC disclosure under a separate common-interest agreement, as further described in Section 7 below.
(c) Technical Implementation. The technical implementation of privacy controls — including the deployment and configuration of the consent-management platform, data-mapping tools, and DSR-workflow automation systems — will be performed by Fieldhaven Consulting Group LLC (Marcus Ellerby, engagement lead) under a separate engagement directly with Cascade. C&H will oversee Fieldhaven's work product for legal sufficiency and provide legal guidance to ensure that technical implementations satisfy applicable statutory requirements, but C&H does not assume responsibility for the technical implementation itself, including system performance, availability, or technical defects.
(d) Cybersecurity Incident Response and Insurance. Cybersecurity incident response planning and execution, cyber and privacy liability insurance procurement and renewal, and insurance coverage analysis are excluded from this engagement. The Company's insurance broker is Ridgepoint Insurance Brokers Inc., and the Company's primary cyber/privacy liability carrier is Northcastle Indemnity Company.
(e) Independent Audit and SOC 2. Independent audit matters and SOC 2 Type II audit engagements remain with Lakemont Audit Partners LLP (Sheila Brogan, engagement partner) and are not within the scope of C&H's representation.
4. Engagement Team and Staffing
The following attorneys will serve as the core engagement team for this matter:
Kevin Ostrowski — Responsible Partner, Privacy & Data Security. Mr. Ostrowski will have overall responsibility for the engagement, including client relationship management, strategic direction, supervision and quality assurance of all work product, and service as the primary contact for strategic decisions. Mr. Ostrowski will participate directly in key deliverables, including the gap-analysis report, the Thornbridge Media Corp. negotiation, the Privacy Governance Charter, and the board presentation memorandum.
Rachel Bernstein — Billing Partner, Privacy & Data Security. Ms. Bernstein will oversee billing, fee arrangement administration, and compliance with Cascade's outside-counsel guidelines. Ms. Bernstein will also provide supplemental substantive support on selected work streams as needed, drawing on her extensive experience with multi-state consumer privacy compliance programs.
Alan Burke — Lead Associate (Senior Associate), Privacy & Data Security. Mr. Burke will serve as the day-to-day engagement manager, coordinating all work streams and serving as the primary point of contact for Diana Polk. Mr. Burke will serve as the lead drafting attorney for the gap-analysis report, DPA templates, the Thornbridge Media Corp. data-sharing agreement, the Privacy Governance Charter, and internal policies and procedures.
Sara Hendricks — Working Associate, Privacy & Data Security. Ms. Hendricks will provide drafting support for consumer-facing privacy notices, conduct state-law research and analysis, support the data-mapping legal review, and assist in the development of employee training materials.
C&H reserves the right to assign additional attorneys, including partners, associates, and legal specialists, or to adjust staffing as necessary to meet engagement milestones and deliver high-quality work product on a timely basis. The Client's primary contact will be notified of any material staffing changes. Notwithstanding the foregoing, any change to the Responsible Partner or Billing Partner requires prior written notice to the Client, and the Client shall have the right to discuss any such proposed change before it takes effect.
5. Key Milestones and Timeline
The following table sets forth the target dates for key milestones of the engagement. These milestones represent the parties' current expectations and are subject to adjustment by mutual agreement. Timely performance of these milestones depends upon the cooperation of the Client and its personnel, the timely delivery of information and work product by third parties (including Fieldhaven Consulting Group LLC, OnPoint Data Solutions Inc., and Thornbridge Media Corp.), and the absence of unanticipated regulatory developments or material changes in scope.
C&H will provide the Client with regular status reports tracking progress against these milestones. If any milestone is at risk due to dependencies beyond C&H's control, C&H will promptly notify the Client and propose revised timelines. The parties will work together in good faith to resolve any scheduling issues and to keep the engagement on track.
6. Fees and Billing Arrangements
6.1 Hourly Rates
Fees for this engagement will be calculated on a blended hourly basis at the following rates, which reflect a discount from C&H's standard 2025 rates in recognition of the scope and duration of this engagement:
These rates are effective for the initial engagement period from the Effective Date through June 30, 2026. Any rate adjustments after June 30, 2026 will require sixty (60) days' prior written notice to the Client and will not take effect until the expiration of such notice period. Rate adjustments, if any, will be consistent with the Firm's annual rate-review process and competitive market conditions.
6.2 Phase 1 Fee Cap
Total fees for Phase 1 of this engagement (June 2, 2025 through December 31, 2025) shall not exceed Two Million Six Hundred Thousand Dollars ($2,600,000) (the "Phase 1 Fee Cap"). The Phase 1 Fee Cap applies to all attorney time expended by C&H in connection with the Phase 1 deliverables and work streams described in Section 3.2 above.
The Phase 1 Fee Cap does not include:
(a) disbursements and out-of-pocket expenses, which will be billed separately as described in Section 6.4 below;
(b) fees for work outside the defined Phase 1 scope, including, without limitation, work in connection with regulatory inquiries, enforcement actions, litigation, or other matters excluded from scope under Section 3.4; or
(c) fees for compliance work relating to state privacy statutes enacted or becoming effective after the Effective Date that are beyond the nineteen (19) statutes identified in Section 3.1, to the extent such work materially expands the Phase 1 scope as mutually determined by the parties.
If the scope of Phase 1 changes materially during the engagement period — whether due to the enactment of new state privacy statutes, unanticipated regulatory developments, changes in Cascade's business operations, or other factors — the parties will discuss in good faith whether an adjustment to the Phase 1 Fee Cap is warranted. Any adjustment to the Phase 1 Fee Cap will be documented in writing and signed by both parties before becoming effective. C&H will provide the Client with periodic budget reports tracking actual fees against the Phase 1 Fee Cap, with the first such report to be delivered no later than August 1, 2025, and monthly thereafter.
6.3 Phase 2 Fees
Phase 2 of this engagement (January 1, 2026 through June 30, 2026) will be billed on an hourly basis at the rates set forth in Section 6.1 above. Based on the currently anticipated scope of Phase 2 as described in Section 3.3, C&H estimates that Phase 2 fees will range from $1,400,000 to $1,800,000. This estimate is provided for planning purposes only and is not a fee cap, ceiling, or guarantee.
Phase 2 is not subject to a fee cap. Actual Phase 2 fees may vary depending on the scope of work required, the pace of regulatory developments, the volume of regulatory inquiries, the extent of implementation support needed, and other factors. C&H will provide monthly budget updates to the Client during Phase 2, including a comparison of actual fees to the initial estimate and an updated forecast for the remainder of the phase.
If Phase 2 scope and fees are projected to exceed the upper end of the initial estimate by a material amount, C&H will promptly notify the Client and discuss options for managing costs, including potential scope adjustments, alternative fee arrangements, or other measures.
6.4 Expenses and Disbursements
The Client will reimburse C&H for reasonable out-of-pocket expenses incurred in connection with the engagement, including but not limited to:
(a) travel expenses (airfare, ground transportation, and hotel accommodations) for trips to Cascade's Seattle headquarters and other locations reasonably necessary in connection with the engagement;
(b) meals and incidentals during engagement-related travel;
(c) document production, printing, and copying costs;
(d) outside vendor costs (e.g., specialized research services, expert consultants retained at Client's request);
(e) electronic legal research charges (Westmark Data Systems, Sundial Solutions, and similar services); and
(f) courier and delivery charges.
Expenses are not included in the Phase 1 Fee Cap and will be billed separately on monthly invoices. Any single expense or commitment to incur expenses exceeding $5,000 requires prior approval from the Client's primary contact (Meredith Tanaka) or day-to-day contact (Diana Polk).
6.5 Billing and Payment
C&H will issue monthly invoices for fees and expenses incurred during the preceding calendar month. Invoices will include reasonable detail regarding the services rendered during the billing period, including the name and level of each timekeeper, the hours worked by each timekeeper, a description of the services performed, and itemized expense descriptions.
Payment is due within thirty (30) days of the invoice date. Invoices and billing correspondence should be directed to:
Meredith Tanaka, Esq. General Counsel Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Email: m.tanaka@cascaderetail.com
All billing inquiries, including questions regarding invoice detail, staffing, rate application, or expense items, may be directed to Rachel Bernstein, Billing Partner, at (212) 596-4418 or r.bernstein@calderwoodharkness.com. C&H is committed to transparent and responsive billing practices, and we welcome open dialogue regarding fees and expenses at any time during the engagement.
7. Coordination with Other Advisors
This engagement will require coordination with several other professional advisors engaged by Cascade. C&H's coordination responsibilities and relationships with those advisors are described below:
(a) Whitfield Greaves LLP. C&H will coordinate with Whitfield Greaves LLP (Carolyn J. Marsden, lead partner) on SEC-disclosure and corporate-governance aspects of the Privacy Program. This coordination will address, among other things, privacy-related risk-factor disclosures, proxy statement disclosures regarding privacy governance, and the interplay between the Privacy Governance Charter and Cascade's existing corporate governance framework. Such coordination will be conducted pursuant to a common-interest agreement to be negotiated and executed by C&H, Whitfield Greaves, and Cascade. Until such common-interest agreement is in place, C&H will not share privileged communications or work product with Whitfield Greaves without the Client's prior authorization.
(b) Fieldhaven Consulting Group LLC. C&H will oversee Fieldhaven Consulting Group LLC's work product for legal sufficiency and will provide legal guidance to ensure that Fieldhaven's technical implementations satisfy applicable statutory requirements. Fieldhaven's engagement is directly with Cascade under a separate fixed-fee statement of work (contract value: $3,150,000, payable in three milestone installments). C&H does not represent Fieldhaven, and C&H is not responsible for Fieldhaven's performance, work quality, timelines, or technical deliverables. C&H's oversight role is limited to reviewing Fieldhaven's work product from a legal-compliance perspective.
(c) OnPoint Data Solutions Inc. C&H will review and advise the Client on the OnPoint Data Solutions Inc. CMP SaaS contract (three-year term; annual license fee of $480,000; total contract value of $1,440,000), including the negotiation of a DPA rider or amendment as described in Section 3.2(n). C&H does not represent OnPoint and has no advisory relationship with OnPoint.
(d) Thornbridge Media Corp. C&H will lead the negotiation with Thornbridge Media Corp. and its outside counsel, Kellner Park & Associates LLP (Victor Sandoval), for the restructured data-sharing agreement described in Section 3.2(m). All communications with Thornbridge and its counsel will be conducted at the direction of and on behalf of Cascade.
C&H does not represent and is not responsible for the work, advice, performance, or deliverables of any other advisor to Cascade. While C&H will endeavor to coordinate effectively with Cascade's other advisors as described above, C&H's obligations under this Engagement Letter are limited to the scope of work described herein.
8. Confidentiality and Privilege
All communications between C&H and Cascade, and between C&H and Cascade's officers, employees, and agents, in connection with this engagement are intended to be protected by the attorney-client privilege and the attorney work-product doctrine to the fullest extent permitted by applicable law. C&H will take reasonable steps to maintain and protect these privileges throughout the engagement.
C&H will treat all information received from the Client in connection with this engagement as confidential and will not disclose such information to any third party without the Client's prior authorization, except as required by applicable law, court order, or C&H's professional obligations under the New York Rules of Professional Conduct.
Any sharing of privileged communications or work product with Whitfield Greaves LLP will be governed by the common-interest agreement referenced in Section 7(a) above. Such sharing will not be undertaken until the common-interest agreement is fully executed.
C&H's oversight of Fieldhaven Consulting Group LLC's work product and C&H's communications with Fieldhaven personnel will be structured to preserve the attorney-client privilege and work-product protection to the extent possible. Specific protocols for privilege preservation in the context of the Fieldhaven relationship — including the designation of communications as privileged, the use of privilege labels and legends, and the scope of information-sharing between C&H and Fieldhaven — will be established during the Phase 1 kickoff meeting and documented in a written privilege protocol to be distributed to the engagement team and relevant Fieldhaven personnel.
9. Conflicts of Interest
In connection with this engagement, C&H has conducted a comprehensive conflicts-of-interest check covering the Client and each of its subsidiaries identified in Section 2, as well as the following key counterparties and advisors:
•  Thornbridge Media Corp.
•  OnPoint Data Solutions Inc.
•  Fieldhaven Consulting Group LLC
•  Kellner Park & Associates LLP
•  Whitfield Greaves LLP
Based on the results of this conflicts check, C&H confirms that no disqualifying conflicts of interest currently exist that would preclude C&H from undertaking this engagement.
If a conflict of interest arises during the course of the engagement, C&H will promptly notify the Client and will take appropriate action in accordance with the New York Rules of Professional Conduct, including, where applicable, seeking the Client's informed consent to continued representation or withdrawing from the engagement or the conflicting matter.
The Client acknowledges that C&H is a large, multi-practice law firm and that C&H represents a substantial number of clients across a wide range of industries and practice areas. C&H may represent other clients in matters unrelated to this engagement that could involve entities or individuals tangentially related to Cascade's business, including vendors, competitors, or business partners of Cascade. Such representations do not constitute conflicts of interest absent a direct adversity to Cascade in the same matter or a substantially related matter, and the Client consents to C&H's continued representation of such clients in unrelated matters.
10. Document Retention
C&H will maintain all engagement files, including correspondence, memoranda, drafts, final work product, and internal records, in accordance with the Firm's document-retention policy and the Client's outside-counsel guidelines, to the extent those guidelines have been provided to C&H and are consistent with C&H's professional obligations.
Upon termination or conclusion of the engagement, C&H will return or destroy Client materials in accordance with the Client's written instructions, subject to C&H's obligations under applicable law and professional conduct rules to retain certain records (including, for example, records necessary to demonstrate the nature and scope of services rendered). C&H will cooperate with the Client to facilitate the orderly transfer of files and work product to the Client or to successor counsel.
11. Termination
Either party may terminate this engagement at any time upon thirty (30) days' prior written notice to the other party. Written notice of termination shall be directed to the contacts identified in Section 2 (for the Client) and Section 4 (for C&H).
Upon termination, C&H will take all steps reasonably necessary to protect the Client's interests, including facilitating the transition of pending matters and work product to successor counsel designated by the Client, providing reasonable cooperation during the transition period, and complying with all applicable professional-conduct obligations regarding withdrawal from representation.
The Client will remain responsible for all fees and expenses properly incurred through the effective date of termination. With respect to work performed during the Phase 1 period, the Client's fee obligation will be subject to the Phase 1 Fee Cap as described in Section 6.2, pro-rated if appropriate to reflect the scope of work completed as of the date of termination.
Termination of this engagement will not affect the parties' obligations under Section 8 (Confidentiality and Privilege) or Section 12 (Limitation of Liability), which shall survive termination.
12. Limitation of Liability
C&H's aggregate liability to the Client arising out of or relating to this engagement, whether based in contract, tort, negligence, professional malpractice, or any other theory of liability, shall not exceed the total fees actually paid by the Client to C&H for the phase of the engagement (Phase 1 or Phase 2, as applicable) giving rise to the claim. For the avoidance of doubt, if a claim relates to work performed during Phase 1, C&H's aggregate liability shall not exceed the total fees actually paid by the Client for Phase 1 work; if a claim relates to work performed during Phase 2, C&H's aggregate liability shall not exceed the total fees actually paid by the Client for Phase 2 work.
This limitation of liability does not apply to claims arising from C&H's willful misconduct or gross negligence. In no event shall C&H be liable for consequential, incidental, special, punitive, or exemplary damages, regardless of whether C&H has been advised of the possibility of such damages.
The Client acknowledges that the fees charged for this engagement reflect the allocation of risk set forth in this Section 12, and that a different fee arrangement would be required in the absence of this limitation.
13. Governing Law and Dispute Resolution
This Engagement Letter shall be governed by, and construed in accordance with, the laws of the State of New York, without giving effect to its conflict-of-laws principles.
Any dispute, claim, or controversy arising out of or relating to this Engagement Letter or the engagement contemplated hereby, including disputes regarding the formation, validity, interpretation, performance, breach, or termination of this Engagement Letter, shall be resolved exclusively by binding arbitration administered in New York, New York, in accordance with the Commercial Arbitration Rules of the American Arbitration Association then in effect. The arbitration shall be conducted before a single arbitrator with experience in legal-malpractice or professional-services disputes, selected in accordance with the AAA rules. The arbitrator's award shall be final and binding, and judgment on the award may be entered in any court of competent jurisdiction. Each party shall bear its own costs and attorneys' fees in connection with any arbitration, except that the arbitrator may allocate costs and fees in the award if the arbitrator determines that a party's claims or defenses were frivolous or brought in bad faith.
14. Outside-Counsel Guidelines
C&H acknowledges receipt of Cascade Retail Holdings Inc.'s Outside-Counsel Guidelines (revised January 2025) and agrees to comply with those guidelines to the extent they are consistent with the terms of this Engagement Letter, C&H's professional obligations, and the New York Rules of Professional Conduct. In the event of any conflict between the Outside-Counsel Guidelines and the terms of this Engagement Letter, the terms of this Engagement Letter shall control.
A separate acknowledgment letter confirming C&H's receipt of and agreement to the Outside-Counsel Guidelines, and noting any exceptions or clarifications, will be provided by C&H within ten (10) business days of the Effective Date.
15. Acceptance and Execution
This Engagement Letter, together with the enclosures referenced below and incorporated herein by reference, constitutes the entire agreement between the parties with respect to the terms and conditions of C&H's engagement by Cascade as described herein, and supersedes all prior discussions, negotiations, proposals, and understandings, whether oral or written, relating to the subject matter of this Engagement Letter.
This Engagement Letter may be executed in counterparts, each of which shall be deemed an original and all of which together shall constitute one and the same instrument. Execution and delivery of this Engagement Letter by electronic means (including PDF or Brightwater Software) shall be valid and effective for all purposes.
We are excited to work with Cascade and its talented legal team on this important initiative. If the foregoing terms are acceptable, please sign and return a copy of this Engagement Letter at your earliest convenience. We are prepared to commence work immediately upon execution.
[Signature Page Follows]
CALDERWOOD & HARKNESS LLP
By: ________
Name: Kevin Ostrowski
Title: Partner, Privacy & Data Security
Date: ________
ACCEPTED AND AGREED:
CASCADE RETAIL HOLDINGS INC.
By: ________
Name: Meredith Tanaka
Title: General Counsel
Date: ________
Enclosures:
Enclosure A: C&H Standard Terms of Engagement (incorporated by reference)
Enclosure B: Engagement Team Biographies
cc: Diana Polk, Associate General Counsel, Cascade Retail Holdings Inc. Rachel Bernstein, Partner, Calderwood & Harkness LLP Thomas R. Cavanaugh, Chief Executive Officer, Cascade Retail Holdings Inc.
Target Date | Milestone
June 2, 2025 | Engagement opened; Engagement Letter executed
June 16, 2025 | Phase 1 kickoff meeting and data-mapping workshop (Seattle)
August 15, 2025 | Gap-analysis report delivered
September 12, 2025 | Privacy-policy suite (external consumer-facing notices) — initial drafts delivered
September 30, 2025 | Master vendor DPA template finalized
October 31, 2025 | Thornbridge Media Corp. data-sharing agreement restructured and executed
November 13, 2025 | Board meeting — Privacy Governance Charter adoption by Audit & Risk Committee
December 1, 2025 | Consumer rights workflow (DSR) go-live (in coordination with Fieldhaven)
December 15, 2025 | CMP deployment on cascade.com and Cascade mobile application (in coordination with OnPoint/Fieldhaven)
December 31, 2025 | Phase 1 completion; Phase 1 compliance-readiness certification memorandum delivered
January 1, 2026 | Phase 2 opens
June 30, 2026 | First annual privacy-program assessment completed
Timekeeper Level | Hourly Rate
Partner | $1,175
Senior Associate | $785
Associate | $625

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, New York 10022

CALDERWOOD & HARKNESS LLP

ACCEPTED AND AGREED:

CASCADE RETAIL HOLDINGS INC.

Record

Parties

Dates

Amounts