1038-00010 · Cascade Retail Holdings · Engagement

outside-counsel-guidelines-acknowledgment.docx DOCUMENT Finance & Banking

24 / 38 ← → ✕

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, NY 10022

Practice Group: Privacy & Data Security

Telephone: (212) 554-7800 Facsimile: (212) 554-7801

June 4, 2025

Meredith Tanaka General Counsel Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119

Re: Acknowledgment of Cascade Retail Holdings Inc. Outside-Counsel Guidelines — Calderwood & Harkness LLP Matter No. 1038-00010 (US State Privacy Compliance Program)

Dear Ms. Tanaka:

1. Purpose of This Letter

Calderwood & Harkness LLP ("C&H" or the "Firm") hereby acknowledges receipt of the Outside-Counsel Guidelines of Cascade Retail Holdings Inc. ("Cascade" or "CRH") (the "Guidelines"), as provided to the Firm in connection with the engagement letter dated June 2, 2025 (the "Engagement Letter") governing our representation of Cascade in the design, development, and implementation of a comprehensive US state-privacy compliance program (the "Engagement"). This letter is submitted under C&H Matter Number 1038-00010.

We confirm that the Guidelines have been reviewed in their entirety by each member of the engagement team identified below, including the Responsible Partner, Billing Partner, Lead Associate, and Working Associate assigned to this matter. Each team member has been provided with a complete copy of the Guidelines and has been instructed to familiarize themselves with all provisions applicable to their respective roles and responsibilities in connection with the Engagement.

Having completed this review, Calderwood & Harkness LLP agrees to comply with the Guidelines in all material respects, subject only to the limited clarifications and qualifications set forth in Section 9 of this letter. We appreciate the thoughtful and thorough approach that Cascade has taken in establishing these Guidelines, and we recognize that they are designed to ensure alignment between outside counsel and the Company's expectations regarding quality of service, cost management, and protection of privileged and confidential information. We are committed to honoring both the letter and the spirit of the Guidelines throughout the course of our representation.

2. Engagement Team and Staffing Obligations

The Firm confirms that the following attorneys have been assigned to the Engagement, consistent with the staffing commitments set forth in the Engagement Letter:

Each of the foregoing attorneys has been selected for their substantive experience in US state privacy law, data-protection compliance, and regulatory enforcement matters, and each will contribute meaningfully to the deliverables contemplated by the Engagement Letter.

The Firm acknowledges and agrees to the following staffing requirements as set forth in the Guidelines:

(a) Prior Written Approval for Key Personnel Changes. No change to the Responsible Partner (Kevin Ostrowski) or the Lead Associate (Alan Burke) will be made without the prior written approval of Cascade. This includes any substitution, replacement, or reassignment of responsibilities, whether temporary or permanent, that would result in a different attorney serving in either of these roles.

(b) Prohibition on Contract Attorneys and Temporary Staff. The Firm will not assign, delegate, or subcontract any portion of the work under this Engagement to contract attorneys, temporary staff, or other non-permanent personnel of the Firm without the prior written approval of Diana Polk, Associate General Counsel and designated day-to-day client lead and Interim Chief Privacy Officer. This restriction applies regardless of whether such personnel would be billed at reduced rates or on a non-billable basis.

(c) No Training-Purpose Staffing. The Firm will not assign work under this Engagement to any attorney for the purpose of training or professional development. All timekeepers staffed on the matter must add substantive value commensurate with their billing rate and experience level. The Firm understands that Cascade expects each attorney's contribution to be necessary, non-duplicative, and directly tied to the deliverables and milestones outlined in the Engagement Letter.

(d) Staffing Continuity. The Firm commits to maintaining continuity of the engagement team identified above throughout Phase 1 of the Engagement (through December 31, 2025) and Phase 2 of the Engagement (January 1, 2026 through June 30, 2026). In the event that any team member becomes unavailable due to departure from the Firm, leave of absence, or other circumstances beyond the Firm's control, C&H will promptly notify Cascade and propose a suitable replacement for Cascade's written approval before any such replacement begins substantive work on the matter.

3. Billing and Fee Arrangement Compliance

Calderwood & Harkness LLP acknowledges and agrees to comply with Cascade's billing guidelines as set forth in the Guidelines and as supplemented by the fee arrangements established in the Engagement Letter. The Firm's specific acknowledgments in this regard are as follows:

(a) Blended Hourly Rates. All time incurred by Firm personnel on the Engagement will be billed at the blended hourly rates set forth in the Engagement Letter, which are as follows:

• Partner rate: $1,175 per hour

• Senior Associate rate: $785 per hour

• Associate rate: $625 per hour

These rates are fixed for the duration of the Engagement and will not be subject to annual increases or other adjustments unless agreed to in writing by Cascade.

(b) Phase 1 Fee Cap. Total fees for all work performed during Phase 1 of the Engagement — encompassing the privacy-law assessment, gap analysis, policy drafting, vendor-contract templates, and training materials, through December 31, 2025 — are subject to a hard cap of $2,600,000. The Firm will not bill or seek reimbursement for fees in excess of this cap without the prior written approval of Cascade. The Firm will monitor budget utilization against this cap on an ongoing basis and will promptly notify Cascade if the Firm projects that cumulative fees may approach or exceed ninety percent (90%) of the cap.

(c) Phase 2 Estimated Fees. Phase 2 of the Engagement — covering the period from January 1, 2026 through June 30, 2026 — is estimated to require fees in the range of $1,400,000 to $1,800,000. Phase 2 fees will be billed on an hourly basis at the rates set forth above, without a cap, but subject to quarterly budget updates to be provided by the Firm to Cascade. These quarterly budget updates will include a comparison of actual fees incurred to the estimated range, along with a narrative explanation of any variance and a revised projection for remaining work.

(d) Invoice Submission. Invoices will be submitted monthly, in arrears, with detailed task-based descriptions sufficient to permit Cascade's legal department to evaluate the reasonableness and necessity of the work performed. Each invoice will reference Matter No. 1038-00010 and will comply with the format and content requirements specified in the Guidelines, including without limitation the identification of each timekeeper, the date on which work was performed, the applicable billing rate, and the number of hours billed.

(e) Time-Entry Increments. All time entries will be recorded in increments of no more than one-tenth (0.1) of an hour. The Firm will not round up time entries or otherwise inflate the time recorded for any task.

(f) Block Billing Prohibited. Block billing — the practice of grouping multiple discrete tasks into a single time entry — is prohibited. Each discrete task performed by a timekeeper must be separately described in a distinct time entry, with sufficient detail to allow Cascade to assess the nature and necessity of the work.

(g) Expense Approvals. Any individual expense exceeding $500 requires the prior written approval of Meredith Tanaka, General Counsel, or Diana Polk, Associate General Counsel. The Firm will submit expense-approval requests in advance of incurring the expense and will include a description of the expense, its estimated cost, and the business justification.

(h) Travel Expenses. Travel expenses incurred in connection with the Engagement are subject to Cascade's corporate travel policy as provided to the Firm. Air travel is limited to economy or coach class for all domestic flights. First-class or business-class travel will not be reimbursed unless prior written approval has been obtained from Meredith Tanaka or Diana Polk. Hotel, ground transportation, and meal expenses must conform to Cascade's per-diem limits and other restrictions as specified in the corporate travel policy.

(i) Non-Reimbursable Administrative Costs. The Firm will not charge Cascade for internal administrative costs, including but not limited to word processing, local photocopying, library or database access fees (including Westmark Data Systems, Sundial Solutions, or comparable services), routine postage, and general office overhead. These costs are understood to be subsumed within the Firm's hourly rates.

(j) Payment Terms. Invoices are payable within forty-five (45) days of receipt by Cascade's accounts-payable department. The Firm acknowledges that Cascade's payment of any invoice does not constitute acceptance or approval of the charges contained therein, and Cascade retains the right to dispute any charges for a period of ninety (90) days following payment.

(k) Billing Partner Responsibility. Rachel Bernstein, Partner, is designated as the billing partner for this Engagement and will be responsible for the review, quality assurance, and submission of all invoices to Cascade. Ms. Bernstein will ensure that all invoices comply with the Guidelines and the terms of this acknowledgment letter before submission.

4. Coordination with Co-Counsel and Consultants

The Firm acknowledges the Guidelines' requirement that C&H coordinate its work with Cascade's other outside counsel and retained consultants in a manner that avoids duplication of effort, promotes efficiency, and ensures consistency in legal advice and work product. Specifically, the Firm acknowledges and agrees to the following:

(a) Whitfield Greaves LLP — Corporate & Securities Counsel. C&H will coordinate with Whitfield Greaves LLP, Cascade's outside corporate and securities counsel (lead partner: Carolyn J. Marsden; 1999 K Street NW, Suite 700, Washington, D.C. 20006), on all aspects of the Engagement that intersect with SEC disclosure obligations and board-governance matters related to the privacy compliance program. This coordination will be governed by the Common-Interest Agreement dated June 10, 2025, which has been executed by all relevant parties and sets forth the terms under which privileged and confidential information may be shared between C&H and Whitfield Greaves LLP without waiver of applicable privileges. C&H will ensure that all communications with Whitfield Greaves LLP are consistent with the terms and limitations of the Common-Interest Agreement.

(b) Fieldhaven Consulting Group LLC — Privacy-Program Technical Implementer. C&H will coordinate with Fieldhaven Consulting Group LLC, Cascade's retained privacy-program technical implementer (engagement lead: Marcus Ellerby; 350 Sansome Street, Suite 400, San Francisco, CA 94104), which is responsible for the technical implementation of the privacy compliance program under a separate fixed-fee statement of work in the amount of $3,150,000. C&H's coordination responsibilities with respect to Fieldhaven include the review and oversight of Fieldhaven's work product to ensure legal sufficiency and alignment with applicable US state privacy laws, including but not limited to the California Consumer Privacy Act (as amended by the CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Texas Data Privacy and Security Act, and other state privacy statutes in effect or scheduled to take effect during the term of the Engagement. For the avoidance of doubt, Fieldhaven is a non-legal service provider, and the sharing of privileged or work-product-protected materials with Fieldhaven is subject to the restrictions set forth in Section 5 of this letter.

(c) No Unauthorized Direction of Work or Expenditures. The Firm will not direct work to, approve expenditures by, or authorize scope changes for any co-counsel or consultant retained by Cascade without the prior authorization of Diana Polk or Meredith Tanaka. Any request from co-counsel or a consultant for additional work or expenditures that falls outside the scope of their respective engagement letters or statements of work will be referred to Cascade for decision.

(d) Avoidance of Duplication. The Firm commits to taking all reasonable steps to avoid duplication of effort across counsel and consultants. This includes establishing clear delineation of responsibilities at the outset of the Engagement, maintaining regular communication with Whitfield Greaves LLP and Fieldhaven Consulting Group LLC regarding work assignments and deliverables, and promptly flagging any areas of potential overlap to Diana Polk for resolution.

5. Privilege and Confidentiality Protocols

Calderwood & Harkness LLP acknowledges and agrees to comply with Cascade's privilege and confidentiality protocols as set forth in the Guidelines. The protection of attorney-client privilege, work-product protections, and the confidentiality of Cascade's information are of paramount importance in connection with this Engagement, and the Firm is committed to maintaining the highest standards of diligence in this regard. Specifically, the Firm acknowledges and agrees to the following:

(a) Marking of Communications. All communications regarding the Engagement — including emails, memoranda, letters, reports, presentations, and other written or electronic materials — will be marked "Privileged and Confidential — Attorney-Client Communication" and/or "Attorney Work Product," as appropriate, to clearly designate the privileged nature of such communications. The Firm will ensure that all members of the engagement team understand and consistently apply these marking requirements.

(b) Restrictions on Sharing with Third Parties. Privileged materials will not be shared with any third party, including without limitation Fieldhaven Consulting Group LLC, OnPoint Data Solutions Inc., Thornbridge Media Corp., or any other non-legal service provider, without the prior written authorization of Meredith Tanaka. The sole exception to this restriction is the sharing of materials with Whitfield Greaves LLP as expressly permitted under the Common-Interest Agreement dated June 10, 2025. In all cases where materials are shared with Whitfield Greaves LLP, C&H will ensure that such sharing is within the scope of the Common-Interest Agreement and will maintain a record of the materials shared.

(c) Privilege Log. Upon request by Cascade, C&H will prepare and maintain a privilege log identifying all materials over which attorney-client privilege or work-product protection is asserted, including a description of each document or communication sufficient to allow Cascade to assess the basis for the privilege assertion without disclosing the substance of the privileged content.

(d) Heightened Care for Regulatory Matters. The Firm acknowledges the particular sensitivity of communications involving regulatory matters related to this Engagement. Cascade has informed the Firm of the prior Federal Trade Commission civil investigative demand (FTC File No. 232-0147) and the inquiry from the California Attorney General's office, both of which relate to Cascade's data-collection and privacy practices. C&H will exercise special care in all communications touching on these regulatory matters to preserve attorney-client privilege and work-product protections, including by limiting distribution of such communications to those individuals with a need to know, avoiding the inclusion of privileged substance in communications with non-privileged recipients, and consulting with Meredith Tanaka before responding to any regulatory inquiry or producing any documents that could implicate privilege.

(e) Team Instruction. All members of the C&H engagement team will receive instruction on Cascade's privilege protocols before commencing any substantive work on the Engagement. This instruction will cover the marking requirements, third-party sharing restrictions, heightened-care protocols for regulatory matters, and the proper handling of privileged and confidential materials both within the Firm and in external communications. The Firm will confirm completion of this instruction to Diana Polk in writing.

6. Document Retention and Information Security

The Firm acknowledges and agrees to comply with Cascade's document-retention requirements and information-security standards as set forth in the Guidelines. The Firm recognizes the importance of these requirements given the nature of the Engagement, which will involve access to and analysis of significant volumes of Cascade's confidential and sensitive business and consumer data. The Firm's specific acknowledgments in this regard are as follows:

(a) Retention Period. All client files, whether in paper or electronic form, including correspondence, memoranda, work product, research materials, and any other documents created or received in connection with the Engagement, will be maintained securely for a minimum of seven (7) years following the conclusion of the Engagement, or for such longer period as Cascade may direct in writing. The Firm will not destroy, delete, or dispose of any client files during this retention period without the prior written consent of Cascade.

(b) Return or Destruction of Files. Upon the termination or conclusion of the Engagement, all original client documents and files — including paper originals, electronic files, and any copies thereof — will be returned to Cascade or securely destroyed, at Cascade's election. If Cascade elects destruction, the Firm will provide written certification of destruction to Cascade, specifying the date and method of destruction and confirming that all copies, including backup copies, have been destroyed. The Firm will cooperate with Cascade in establishing the logistics and timeline for any return or destruction of files.

(c) Encryption and Information-Security Standards. The Firm will comply with Cascade's information-security standards for the handling of confidential client data. This includes, without limitation, the encryption of all electronic files containing Cascade confidential information both in transit (including email attachments) and at rest (including files stored on Firm servers, portable storage devices, and any approved cloud-storage platforms). The Firm represents that its information-security infrastructure meets or exceeds the standards specified in Cascade's Information Security Requirements for Outside Counsel, a copy of which was provided to the Firm together with the Guidelines.

(d) Prohibited Storage. No Cascade confidential information will be stored on personal devices (including personal laptops, tablets, smartphones, or home computers), unsecured cloud-storage platforms (including consumer-grade file-sharing services), or external media (including USB drives, external hard drives, or optical media) without the prior written approval of Gregory Farris, Chief Information Security Officer, Cascade Retail Holdings Inc. The Firm will ensure that all members of the engagement team are informed of this prohibition and will take reasonable steps to monitor compliance.

(e) Data-Breach Notification. In the event of any actual or suspected data breach, security incident, or unauthorized access, disclosure, or loss involving Cascade confidential information — whether occurring on Firm systems, in transit, or at any other location — C&H will notify Diana Polk, Associate General Counsel, and Gregory Farris, Chief Information Security Officer, within twenty-four (24) hours of the Firm's discovery of the incident. The notification will include all available details regarding the nature and scope of the incident, the categories of information potentially affected, the steps taken to contain and remediate the incident, and the Firm's preliminary assessment of the impact. The Firm will cooperate fully with Cascade's investigation of any such incident and will provide updates as additional information becomes available.

7. Conflicts of Interest

Calderwood & Harkness LLP acknowledges and agrees to comply with Cascade's conflicts-of-interest policies as set forth in the Guidelines. The Firm has conducted a thorough conflicts review in connection with this Engagement and provides the following representations:

(a) Conflicts Check Completed. The Firm has completed a comprehensive conflicts check, documented in the Firm's internal Conflict-Check Clearance Memorandum dated June 1, 2025. The conflicts check covered Cascade Retail Holdings Inc. and each of its subsidiaries, including Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. The conflicts check also covered the following key counterparties and other entities identified by Cascade as relevant to the Engagement: Thornbridge Media Corp., OnPoint Data Solutions Inc., and Fieldhaven Consulting Group LLC.

(b) No Disqualifying Conflicts Identified. Based on the results of the conflicts check, no disqualifying conflicts of interest have been identified that would prevent or restrict the Firm's ability to represent Cascade in the Engagement.

(c) Counterparty Counsel. The Firm notes for the record that Kellner Park & Associates LLP (555 Mission Street, 32nd Floor, San Francisco, CA 94105; lead attorney Victor Sandoval) represents Thornbridge Media Corp. as counterparty counsel in the negotiation of the data-sharing agreement between Cascade and Thornbridge. C&H confirms that no conflicts arise from this adversarial representation. The Firm does not currently represent Thornbridge Media Corp. or Kellner Park & Associates LLP in any matter, and no attorney on the C&H engagement team has a personal or financial relationship with Thornbridge or Kellner Park that would create an actual or potential conflict.

(d) Ongoing Monitoring. The Firm will promptly notify Meredith Tanaka, General Counsel, of any new matter, engagement, relationship, or other circumstance that could give rise to a conflict of interest during the course of the Engagement. This obligation is continuing and applies to all matters accepted by the Firm during the pendency of the Engagement, whether or not such matters are related to the subject matter of this representation. In the event that a potential conflict is identified, C&H will take no action on the potentially conflicting matter until the issue has been discussed with Cascade and, if applicable, appropriate conflict waivers have been obtained.

8. Reporting and Communication

The Firm acknowledges and agrees to comply with Cascade's communication and reporting requirements as set forth in the Guidelines. Effective and transparent communication is essential to the success of the Engagement, and C&H is committed to keeping Cascade fully informed of the progress, status, and any issues arising in connection with our work. The Firm's specific acknowledgments in this regard are as follows:

(a) Primary Client Contacts. The Firm's primary client contacts for all substantive and administrative matters relating to the Engagement are Meredith Tanaka, General Counsel, and Diana Polk, Associate General Counsel and Interim Chief Privacy Officer. All significant communications from the Firm regarding the Engagement will be directed to both Ms. Tanaka and Ms. Polk unless otherwise instructed by Cascade.

(b) Communication of Significant Developments. All significant developments, strategic recommendations, and milestone deliverables will be communicated to Meredith Tanaka, with copies to Diana Polk. This includes, without limitation, the completion of each major phase of the gap analysis, the delivery of draft policies and procedures, the completion of vendor-contract template development, and any change in the Firm's assessment of the legal landscape that could materially affect the scope, timeline, or cost of the Engagement.

(c) Monthly Status Reports. The Firm will provide monthly written status reports to Cascade, on or before the tenth (10th) business day of each calendar month, summarizing the following: (i) a description of work completed during the preceding month; (ii) budget utilization to date against the Phase 1 fee cap of $2,600,000 (expressed in both dollar terms and as a percentage of the cap); (iii) upcoming milestones and anticipated deliverables for the next thirty-day (30-day) period; and (iv) identification of any issues, risks, or decisions requiring Cascade's input or authorization. During Phase 2, the monthly status reports will include the quarterly budget updates referenced in Section 3(c) of this letter.

(d) Urgent and Time-Sensitive Matters. In the event of any urgent or time-sensitive development — including but not limited to the receipt of any regulatory inquiry, subpoena, civil investigative demand, enforcement action, or litigation threat related to the subject matter of the Engagement — the Firm will communicate immediately by telephone to both Meredith Tanaka and Diana Polk, followed by written confirmation of the substance of the communication within the same business day. The Firm understands that delays in communicating such developments could have material adverse consequences for Cascade and will treat the obligation of immediate notification as among its highest priorities.

9. Limited Clarifications and Qualifications

While the Firm agrees to comply with the Guidelines in all material respects, C&H respectfully notes the following limited clarifications and qualifications:

(a) Professional and Ethical Obligations. The Firm's obligation to comply with the Guidelines is at all times subject to C&H's independent professional and ethical obligations under the New York Rules of Professional Conduct, as adopted by the Appellate Division of the Supreme Court of the State of New York, and the rules of professional conduct of any other jurisdiction in which C&H attorneys assigned to this Engagement are admitted to practice. Nothing in the Guidelines or in this acknowledgment letter will be construed to require or permit any attorney of the Firm to act in a manner inconsistent with these professional obligations.

(b) Resolution of Conflicts with Professional-Responsibility Rules. To the extent any provision of the Guidelines conflicts with applicable professional-responsibility rules — including without limitation rules governing the attorney's duty of competence, the duty of candor, the duty to exercise independent professional judgment, or the rules governing the protection of client confidences — C&H will promptly notify Cascade of the conflict and the parties will work together in good faith to resolve the conflict in a manner that preserves both Cascade's interests and the Firm's compliance with its professional obligations.

(c) Relationship to the Engagement Letter. The Firm's agreement to the Guidelines does not alter, amend, or supersede the terms of the Engagement Letter dated June 2, 2025, which governs the scope of the representation, the fee arrangements, the limitation-of-liability provisions, and other material terms of the attorney-client relationship. In the event of any conflict or inconsistency between the Guidelines and the Engagement Letter, the terms of the Engagement Letter will control, unless Cascade provides written direction to the contrary specifying that a particular provision of the Guidelines is intended to prevail over a conflicting provision of the Engagement Letter.

10. Closing

We are grateful for the opportunity to represent Cascade Retail Holdings Inc. in this important compliance initiative, and we are committed to delivering the highest quality legal service throughout the course of the Engagement. The breadth and complexity of the evolving US state privacy landscape demand a rigorous, well-coordinated approach, and we are confident that the engagement team assembled for this matter is well suited to meet Cascade's objectives.

We look forward to the Phase 1 kickoff and data-mapping workshop currently scheduled for June 16, 2025, at which we anticipate reviewing the project plan, confirming workstream assignments, and beginning the preliminary data-inventory and mapping exercise in coordination with Diana Polk's team and Fieldhaven Consulting Group LLC.

We respectfully request that Cascade countersign this letter in the space provided below and return a copy to Calderwood & Harkness LLP for our files, confirming mutual agreement to the terms and acknowledgments set forth herein. A countersigned copy may be returned by email to Kevin Ostrowski at kostrowski@calderwoodharkness.com or by mail to the address set forth above.

Very truly yours,

CALDERWOOD & HARKNESS LLP

By: ________

Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022

ACKNOWLEDGED AND AGREED:

CASCADE RETAIL HOLDINGS INC.

By: ________

Name: Meredith Tanaka

Title: General Counsel

Date: ________

cc: Rachel Bernstein, Partner, Calderwood & Harkness LLP cc: Alan Burke, Senior Associate, Calderwood & Harkness LLP cc: Diana Polk, Associate General Counsel, Cascade Retail Holdings Inc.

Encl.: None (Guidelines previously received; Engagement Letter dated June 2, 2025 on file)

Name	Role	Practice Group
Kevin Ostrowski	Responsible Partner	Privacy & Data Security
Rachel Bernstein	Billing Partner	Privacy & Data Security
Alan Burke	Lead Associate (Senior Associate)	Privacy & Data Security
Sara Hendricks	Working Associate	Privacy & Data Security

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
Practice Group: Privacy & Data Security
Telephone: (212) 554-7800 Facsimile: (212) 554-7801
June 4, 2025
Meredith Tanaka General Counsel Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Re: Acknowledgment of Cascade Retail Holdings Inc. Outside-Counsel Guidelines — Calderwood & Harkness LLP Matter No. 1038-00010 (US State Privacy Compliance Program)
Dear Ms. Tanaka:
1. Purpose of This Letter
Calderwood & Harkness LLP ("C&H" or the "Firm") hereby acknowledges receipt of the Outside-Counsel Guidelines of Cascade Retail Holdings Inc. ("Cascade" or "CRH") (the "Guidelines"), as provided to the Firm in connection with the engagement letter dated June 2, 2025 (the "Engagement Letter") governing our representation of Cascade in the design, development, and implementation of a comprehensive US state-privacy compliance program (the "Engagement"). This letter is submitted under C&H Matter Number 1038-00010.
We confirm that the Guidelines have been reviewed in their entirety by each member of the engagement team identified below, including the Responsible Partner, Billing Partner, Lead Associate, and Working Associate assigned to this matter. Each team member has been provided with a complete copy of the Guidelines and has been instructed to familiarize themselves with all provisions applicable to their respective roles and responsibilities in connection with the Engagement.
Having completed this review, Calderwood & Harkness LLP agrees to comply with the Guidelines in all material respects, subject only to the limited clarifications and qualifications set forth in Section 9 of this letter. We appreciate the thoughtful and thorough approach that Cascade has taken in establishing these Guidelines, and we recognize that they are designed to ensure alignment between outside counsel and the Company's expectations regarding quality of service, cost management, and protection of privileged and confidential information. We are committed to honoring both the letter and the spirit of the Guidelines throughout the course of our representation.
2. Engagement Team and Staffing Obligations
The Firm confirms that the following attorneys have been assigned to the Engagement, consistent with the staffing commitments set forth in the Engagement Letter:
Each of the foregoing attorneys has been selected for their substantive experience in US state privacy law, data-protection compliance, and regulatory enforcement matters, and each will contribute meaningfully to the deliverables contemplated by the Engagement Letter.
The Firm acknowledges and agrees to the following staffing requirements as set forth in the Guidelines:
(a) Prior Written Approval for Key Personnel Changes. No change to the Responsible Partner (Kevin Ostrowski) or the Lead Associate (Alan Burke) will be made without the prior written approval of Cascade. This includes any substitution, replacement, or reassignment of responsibilities, whether temporary or permanent, that would result in a different attorney serving in either of these roles.
(b) Prohibition on Contract Attorneys and Temporary Staff. The Firm will not assign, delegate, or subcontract any portion of the work under this Engagement to contract attorneys, temporary staff, or other non-permanent personnel of the Firm without the prior written approval of Diana Polk, Associate General Counsel and designated day-to-day client lead and Interim Chief Privacy Officer. This restriction applies regardless of whether such personnel would be billed at reduced rates or on a non-billable basis.
(c) No Training-Purpose Staffing. The Firm will not assign work under this Engagement to any attorney for the purpose of training or professional development. All timekeepers staffed on the matter must add substantive value commensurate with their billing rate and experience level. The Firm understands that Cascade expects each attorney's contribution to be necessary, non-duplicative, and directly tied to the deliverables and milestones outlined in the Engagement Letter.
(d) Staffing Continuity. The Firm commits to maintaining continuity of the engagement team identified above throughout Phase 1 of the Engagement (through December 31, 2025) and Phase 2 of the Engagement (January 1, 2026 through June 30, 2026). In the event that any team member becomes unavailable due to departure from the Firm, leave of absence, or other circumstances beyond the Firm's control, C&H will promptly notify Cascade and propose a suitable replacement for Cascade's written approval before any such replacement begins substantive work on the matter.
3. Billing and Fee Arrangement Compliance
Calderwood & Harkness LLP acknowledges and agrees to comply with Cascade's billing guidelines as set forth in the Guidelines and as supplemented by the fee arrangements established in the Engagement Letter. The Firm's specific acknowledgments in this regard are as follows:
(a) Blended Hourly Rates. All time incurred by Firm personnel on the Engagement will be billed at the blended hourly rates set forth in the Engagement Letter, which are as follows:
•  Partner rate: $1,175 per hour
•  Senior Associate rate: $785 per hour
•  Associate rate: $625 per hour
These rates are fixed for the duration of the Engagement and will not be subject to annual increases or other adjustments unless agreed to in writing by Cascade.
(b) Phase 1 Fee Cap. Total fees for all work performed during Phase 1 of the Engagement — encompassing the privacy-law assessment, gap analysis, policy drafting, vendor-contract templates, and training materials, through December 31, 2025 — are subject to a hard cap of $2,600,000. The Firm will not bill or seek reimbursement for fees in excess of this cap without the prior written approval of Cascade. The Firm will monitor budget utilization against this cap on an ongoing basis and will promptly notify Cascade if the Firm projects that cumulative fees may approach or exceed ninety percent (90%) of the cap.
(c) Phase 2 Estimated Fees. Phase 2 of the Engagement — covering the period from January 1, 2026 through June 30, 2026 — is estimated to require fees in the range of $1,400,000 to $1,800,000. Phase 2 fees will be billed on an hourly basis at the rates set forth above, without a cap, but subject to quarterly budget updates to be provided by the Firm to Cascade. These quarterly budget updates will include a comparison of actual fees incurred to the estimated range, along with a narrative explanation of any variance and a revised projection for remaining work.
(d) Invoice Submission. Invoices will be submitted monthly, in arrears, with detailed task-based descriptions sufficient to permit Cascade's legal department to evaluate the reasonableness and necessity of the work performed. Each invoice will reference Matter No. 1038-00010 and will comply with the format and content requirements specified in the Guidelines, including without limitation the identification of each timekeeper, the date on which work was performed, the applicable billing rate, and the number of hours billed.
(e) Time-Entry Increments. All time entries will be recorded in increments of no more than one-tenth (0.1) of an hour. The Firm will not round up time entries or otherwise inflate the time recorded for any task.
(f) Block Billing Prohibited. Block billing — the practice of grouping multiple discrete tasks into a single time entry — is prohibited. Each discrete task performed by a timekeeper must be separately described in a distinct time entry, with sufficient detail to allow Cascade to assess the nature and necessity of the work.
(g) Expense Approvals. Any individual expense exceeding $500 requires the prior written approval of Meredith Tanaka, General Counsel, or Diana Polk, Associate General Counsel. The Firm will submit expense-approval requests in advance of incurring the expense and will include a description of the expense, its estimated cost, and the business justification.
(h) Travel Expenses. Travel expenses incurred in connection with the Engagement are subject to Cascade's corporate travel policy as provided to the Firm. Air travel is limited to economy or coach class for all domestic flights. First-class or business-class travel will not be reimbursed unless prior written approval has been obtained from Meredith Tanaka or Diana Polk. Hotel, ground transportation, and meal expenses must conform to Cascade's per-diem limits and other restrictions as specified in the corporate travel policy.
(i) Non-Reimbursable Administrative Costs. The Firm will not charge Cascade for internal administrative costs, including but not limited to word processing, local photocopying, library or database access fees (including Westmark Data Systems, Sundial Solutions, or comparable services), routine postage, and general office overhead. These costs are understood to be subsumed within the Firm's hourly rates.
(j) Payment Terms. Invoices are payable within forty-five (45) days of receipt by Cascade's accounts-payable department. The Firm acknowledges that Cascade's payment of any invoice does not constitute acceptance or approval of the charges contained therein, and Cascade retains the right to dispute any charges for a period of ninety (90) days following payment.
(k) Billing Partner Responsibility. Rachel Bernstein, Partner, is designated as the billing partner for this Engagement and will be responsible for the review, quality assurance, and submission of all invoices to Cascade. Ms. Bernstein will ensure that all invoices comply with the Guidelines and the terms of this acknowledgment letter before submission.
4. Coordination with Co-Counsel and Consultants
The Firm acknowledges the Guidelines' requirement that C&H coordinate its work with Cascade's other outside counsel and retained consultants in a manner that avoids duplication of effort, promotes efficiency, and ensures consistency in legal advice and work product. Specifically, the Firm acknowledges and agrees to the following:
(a) Whitfield Greaves LLP — Corporate & Securities Counsel. C&H will coordinate with Whitfield Greaves LLP, Cascade's outside corporate and securities counsel (lead partner: Carolyn J. Marsden; 1999 K Street NW, Suite 700, Washington, D.C. 20006), on all aspects of the Engagement that intersect with SEC disclosure obligations and board-governance matters related to the privacy compliance program. This coordination will be governed by the Common-Interest Agreement dated June 10, 2025, which has been executed by all relevant parties and sets forth the terms under which privileged and confidential information may be shared between C&H and Whitfield Greaves LLP without waiver of applicable privileges. C&H will ensure that all communications with Whitfield Greaves LLP are consistent with the terms and limitations of the Common-Interest Agreement.
(b) Fieldhaven Consulting Group LLC — Privacy-Program Technical Implementer. C&H will coordinate with Fieldhaven Consulting Group LLC, Cascade's retained privacy-program technical implementer (engagement lead: Marcus Ellerby; 350 Sansome Street, Suite 400, San Francisco, CA 94104), which is responsible for the technical implementation of the privacy compliance program under a separate fixed-fee statement of work in the amount of $3,150,000. C&H's coordination responsibilities with respect to Fieldhaven include the review and oversight of Fieldhaven's work product to ensure legal sufficiency and alignment with applicable US state privacy laws, including but not limited to the California Consumer Privacy Act (as amended by the CPRA), the Colorado Privacy Act, the Connecticut Data Privacy Act, the Virginia Consumer Data Protection Act, the Texas Data Privacy and Security Act, and other state privacy statutes in effect or scheduled to take effect during the term of the Engagement. For the avoidance of doubt, Fieldhaven is a non-legal service provider, and the sharing of privileged or work-product-protected materials with Fieldhaven is subject to the restrictions set forth in Section 5 of this letter.
(c) No Unauthorized Direction of Work or Expenditures. The Firm will not direct work to, approve expenditures by, or authorize scope changes for any co-counsel or consultant retained by Cascade without the prior authorization of Diana Polk or Meredith Tanaka. Any request from co-counsel or a consultant for additional work or expenditures that falls outside the scope of their respective engagement letters or statements of work will be referred to Cascade for decision.
(d) Avoidance of Duplication. The Firm commits to taking all reasonable steps to avoid duplication of effort across counsel and consultants. This includes establishing clear delineation of responsibilities at the outset of the Engagement, maintaining regular communication with Whitfield Greaves LLP and Fieldhaven Consulting Group LLC regarding work assignments and deliverables, and promptly flagging any areas of potential overlap to Diana Polk for resolution.
5. Privilege and Confidentiality Protocols
Calderwood & Harkness LLP acknowledges and agrees to comply with Cascade's privilege and confidentiality protocols as set forth in the Guidelines. The protection of attorney-client privilege, work-product protections, and the confidentiality of Cascade's information are of paramount importance in connection with this Engagement, and the Firm is committed to maintaining the highest standards of diligence in this regard. Specifically, the Firm acknowledges and agrees to the following:
(a) Marking of Communications. All communications regarding the Engagement — including emails, memoranda, letters, reports, presentations, and other written or electronic materials — will be marked "Privileged and Confidential — Attorney-Client Communication" and/or "Attorney Work Product," as appropriate, to clearly designate the privileged nature of such communications. The Firm will ensure that all members of the engagement team understand and consistently apply these marking requirements.
(b) Restrictions on Sharing with Third Parties. Privileged materials will not be shared with any third party, including without limitation Fieldhaven Consulting Group LLC, OnPoint Data Solutions Inc., Thornbridge Media Corp., or any other non-legal service provider, without the prior written authorization of Meredith Tanaka. The sole exception to this restriction is the sharing of materials with Whitfield Greaves LLP as expressly permitted under the Common-Interest Agreement dated June 10, 2025. In all cases where materials are shared with Whitfield Greaves LLP, C&H will ensure that such sharing is within the scope of the Common-Interest Agreement and will maintain a record of the materials shared.
(c) Privilege Log. Upon request by Cascade, C&H will prepare and maintain a privilege log identifying all materials over which attorney-client privilege or work-product protection is asserted, including a description of each document or communication sufficient to allow Cascade to assess the basis for the privilege assertion without disclosing the substance of the privileged content.
(d) Heightened Care for Regulatory Matters. The Firm acknowledges the particular sensitivity of communications involving regulatory matters related to this Engagement. Cascade has informed the Firm of the prior Federal Trade Commission civil investigative demand (FTC File No. 232-0147) and the inquiry from the California Attorney General's office, both of which relate to Cascade's data-collection and privacy practices. C&H will exercise special care in all communications touching on these regulatory matters to preserve attorney-client privilege and work-product protections, including by limiting distribution of such communications to those individuals with a need to know, avoiding the inclusion of privileged substance in communications with non-privileged recipients, and consulting with Meredith Tanaka before responding to any regulatory inquiry or producing any documents that could implicate privilege.
(e) Team Instruction. All members of the C&H engagement team will receive instruction on Cascade's privilege protocols before commencing any substantive work on the Engagement. This instruction will cover the marking requirements, third-party sharing restrictions, heightened-care protocols for regulatory matters, and the proper handling of privileged and confidential materials both within the Firm and in external communications. The Firm will confirm completion of this instruction to Diana Polk in writing.
6. Document Retention and Information Security
The Firm acknowledges and agrees to comply with Cascade's document-retention requirements and information-security standards as set forth in the Guidelines. The Firm recognizes the importance of these requirements given the nature of the Engagement, which will involve access to and analysis of significant volumes of Cascade's confidential and sensitive business and consumer data. The Firm's specific acknowledgments in this regard are as follows:
(a) Retention Period. All client files, whether in paper or electronic form, including correspondence, memoranda, work product, research materials, and any other documents created or received in connection with the Engagement, will be maintained securely for a minimum of seven (7) years following the conclusion of the Engagement, or for such longer period as Cascade may direct in writing. The Firm will not destroy, delete, or dispose of any client files during this retention period without the prior written consent of Cascade.
(b) Return or Destruction of Files. Upon the termination or conclusion of the Engagement, all original client documents and files — including paper originals, electronic files, and any copies thereof — will be returned to Cascade or securely destroyed, at Cascade's election. If Cascade elects destruction, the Firm will provide written certification of destruction to Cascade, specifying the date and method of destruction and confirming that all copies, including backup copies, have been destroyed. The Firm will cooperate with Cascade in establishing the logistics and timeline for any return or destruction of files.
(c) Encryption and Information-Security Standards. The Firm will comply with Cascade's information-security standards for the handling of confidential client data. This includes, without limitation, the encryption of all electronic files containing Cascade confidential information both in transit (including email attachments) and at rest (including files stored on Firm servers, portable storage devices, and any approved cloud-storage platforms). The Firm represents that its information-security infrastructure meets or exceeds the standards specified in Cascade's Information Security Requirements for Outside Counsel, a copy of which was provided to the Firm together with the Guidelines.
(d) Prohibited Storage. No Cascade confidential information will be stored on personal devices (including personal laptops, tablets, smartphones, or home computers), unsecured cloud-storage platforms (including consumer-grade file-sharing services), or external media (including USB drives, external hard drives, or optical media) without the prior written approval of Gregory Farris, Chief Information Security Officer, Cascade Retail Holdings Inc. The Firm will ensure that all members of the engagement team are informed of this prohibition and will take reasonable steps to monitor compliance.
(e) Data-Breach Notification. In the event of any actual or suspected data breach, security incident, or unauthorized access, disclosure, or loss involving Cascade confidential information — whether occurring on Firm systems, in transit, or at any other location — C&H will notify Diana Polk, Associate General Counsel, and Gregory Farris, Chief Information Security Officer, within twenty-four (24) hours of the Firm's discovery of the incident. The notification will include all available details regarding the nature and scope of the incident, the categories of information potentially affected, the steps taken to contain and remediate the incident, and the Firm's preliminary assessment of the impact. The Firm will cooperate fully with Cascade's investigation of any such incident and will provide updates as additional information becomes available.
7. Conflicts of Interest
Calderwood & Harkness LLP acknowledges and agrees to comply with Cascade's conflicts-of-interest policies as set forth in the Guidelines. The Firm has conducted a thorough conflicts review in connection with this Engagement and provides the following representations:
(a) Conflicts Check Completed. The Firm has completed a comprehensive conflicts check, documented in the Firm's internal Conflict-Check Clearance Memorandum dated June 1, 2025. The conflicts check covered Cascade Retail Holdings Inc. and each of its subsidiaries, including Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. The conflicts check also covered the following key counterparties and other entities identified by Cascade as relevant to the Engagement: Thornbridge Media Corp., OnPoint Data Solutions Inc., and Fieldhaven Consulting Group LLC.
(b) No Disqualifying Conflicts Identified. Based on the results of the conflicts check, no disqualifying conflicts of interest have been identified that would prevent or restrict the Firm's ability to represent Cascade in the Engagement.
(c) Counterparty Counsel. The Firm notes for the record that Kellner Park & Associates LLP (555 Mission Street, 32nd Floor, San Francisco, CA 94105; lead attorney Victor Sandoval) represents Thornbridge Media Corp. as counterparty counsel in the negotiation of the data-sharing agreement between Cascade and Thornbridge. C&H confirms that no conflicts arise from this adversarial representation. The Firm does not currently represent Thornbridge Media Corp. or Kellner Park & Associates LLP in any matter, and no attorney on the C&H engagement team has a personal or financial relationship with Thornbridge or Kellner Park that would create an actual or potential conflict.
(d) Ongoing Monitoring. The Firm will promptly notify Meredith Tanaka, General Counsel, of any new matter, engagement, relationship, or other circumstance that could give rise to a conflict of interest during the course of the Engagement. This obligation is continuing and applies to all matters accepted by the Firm during the pendency of the Engagement, whether or not such matters are related to the subject matter of this representation. In the event that a potential conflict is identified, C&H will take no action on the potentially conflicting matter until the issue has been discussed with Cascade and, if applicable, appropriate conflict waivers have been obtained.
8. Reporting and Communication
The Firm acknowledges and agrees to comply with Cascade's communication and reporting requirements as set forth in the Guidelines. Effective and transparent communication is essential to the success of the Engagement, and C&H is committed to keeping Cascade fully informed of the progress, status, and any issues arising in connection with our work. The Firm's specific acknowledgments in this regard are as follows:
(a) Primary Client Contacts. The Firm's primary client contacts for all substantive and administrative matters relating to the Engagement are Meredith Tanaka, General Counsel, and Diana Polk, Associate General Counsel and Interim Chief Privacy Officer. All significant communications from the Firm regarding the Engagement will be directed to both Ms. Tanaka and Ms. Polk unless otherwise instructed by Cascade.
(b) Communication of Significant Developments. All significant developments, strategic recommendations, and milestone deliverables will be communicated to Meredith Tanaka, with copies to Diana Polk. This includes, without limitation, the completion of each major phase of the gap analysis, the delivery of draft policies and procedures, the completion of vendor-contract template development, and any change in the Firm's assessment of the legal landscape that could materially affect the scope, timeline, or cost of the Engagement.
(c) Monthly Status Reports. The Firm will provide monthly written status reports to Cascade, on or before the tenth (10th) business day of each calendar month, summarizing the following: (i) a description of work completed during the preceding month; (ii) budget utilization to date against the Phase 1 fee cap of $2,600,000 (expressed in both dollar terms and as a percentage of the cap); (iii) upcoming milestones and anticipated deliverables for the next thirty-day (30-day) period; and (iv) identification of any issues, risks, or decisions requiring Cascade's input or authorization. During Phase 2, the monthly status reports will include the quarterly budget updates referenced in Section 3(c) of this letter.
(d) Urgent and Time-Sensitive Matters. In the event of any urgent or time-sensitive development — including but not limited to the receipt of any regulatory inquiry, subpoena, civil investigative demand, enforcement action, or litigation threat related to the subject matter of the Engagement — the Firm will communicate immediately by telephone to both Meredith Tanaka and Diana Polk, followed by written confirmation of the substance of the communication within the same business day. The Firm understands that delays in communicating such developments could have material adverse consequences for Cascade and will treat the obligation of immediate notification as among its highest priorities.
9. Limited Clarifications and Qualifications
While the Firm agrees to comply with the Guidelines in all material respects, C&H respectfully notes the following limited clarifications and qualifications:
(a) Professional and Ethical Obligations. The Firm's obligation to comply with the Guidelines is at all times subject to C&H's independent professional and ethical obligations under the New York Rules of Professional Conduct, as adopted by the Appellate Division of the Supreme Court of the State of New York, and the rules of professional conduct of any other jurisdiction in which C&H attorneys assigned to this Engagement are admitted to practice. Nothing in the Guidelines or in this acknowledgment letter will be construed to require or permit any attorney of the Firm to act in a manner inconsistent with these professional obligations.
(b) Resolution of Conflicts with Professional-Responsibility Rules. To the extent any provision of the Guidelines conflicts with applicable professional-responsibility rules — including without limitation rules governing the attorney's duty of competence, the duty of candor, the duty to exercise independent professional judgment, or the rules governing the protection of client confidences — C&H will promptly notify Cascade of the conflict and the parties will work together in good faith to resolve the conflict in a manner that preserves both Cascade's interests and the Firm's compliance with its professional obligations.
(c) Relationship to the Engagement Letter. The Firm's agreement to the Guidelines does not alter, amend, or supersede the terms of the Engagement Letter dated June 2, 2025, which governs the scope of the representation, the fee arrangements, the limitation-of-liability provisions, and other material terms of the attorney-client relationship. In the event of any conflict or inconsistency between the Guidelines and the Engagement Letter, the terms of the Engagement Letter will control, unless Cascade provides written direction to the contrary specifying that a particular provision of the Guidelines is intended to prevail over a conflicting provision of the Engagement Letter.
10. Closing
We are grateful for the opportunity to represent Cascade Retail Holdings Inc. in this important compliance initiative, and we are committed to delivering the highest quality legal service throughout the course of the Engagement. The breadth and complexity of the evolving US state privacy landscape demand a rigorous, well-coordinated approach, and we are confident that the engagement team assembled for this matter is well suited to meet Cascade's objectives.
We look forward to the Phase 1 kickoff and data-mapping workshop currently scheduled for June 16, 2025, at which we anticipate reviewing the project plan, confirming workstream assignments, and beginning the preliminary data-inventory and mapping exercise in coordination with Diana Polk's team and Fieldhaven Consulting Group LLC.
We respectfully request that Cascade countersign this letter in the space provided below and return a copy to Calderwood & Harkness LLP for our files, confirming mutual agreement to the terms and acknowledgments set forth herein. A countersigned copy may be returned by email to Kevin Ostrowski at kostrowski@calderwoodharkness.com or by mail to the address set forth above.
Very truly yours,
CALDERWOOD & HARKNESS LLP
By: ________
Kevin Ostrowski Partner, Privacy & Data Security Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
ACKNOWLEDGED AND AGREED:
CASCADE RETAIL HOLDINGS INC.
By: ________
Name: Meredith Tanaka
Title: General Counsel
Date: ________
cc: Rachel Bernstein, Partner, Calderwood & Harkness LLP cc: Alan Burke, Senior Associate, Calderwood & Harkness LLP cc: Diana Polk, Associate General Counsel, Cascade Retail Holdings Inc.
Encl.: None (Guidelines previously received; Engagement Letter dated June 2, 2025 on file)
Name | Role | Practice Group
Kevin Ostrowski | Responsible Partner | Privacy & Data Security
Rachel Bernstein | Billing Partner | Privacy & Data Security
Alan Burke | Lead Associate (Senior Associate) | Privacy & Data Security
Sara Hendricks | Working Associate | Privacy & Data Security

CALDERWOOD & HARKNESS LLP 600 Lexington Avenue, 28th Floor New York, NY 10022

CALDERWOOD & HARKNESS LLP

ACKNOWLEDGED AND AGREED:

CASCADE RETAIL HOLDINGS INC.

Record

Parties

Dates

Amounts