MEMORANDUM
PRIVILEGED & CONFIDENTIAL — ATTORNEY WORK PRODUCT
TO: Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP
FROM: Alan Burke, Senior Associate, Privacy & Data Security, Calderwood & Harkness LLP
DATE: June 6, 2025
RE: Cascade Retail Holdings Inc. — US State Privacy Compliance Program — Phase 1 Work Plan & Staffing
MATTER NO.: 1038-00010
STATUS: For Review and Approval
This memorandum is a confidential attorney-client communication and constitutes attorney work product prepared in anticipation of litigation and for the purpose of providing legal advice. It is not intended for disclosure to any third party and should not be disclosed without the prior written consent of Calderwood & Harkness LLP and Cascade Retail Holdings Inc.
Right-click to update Table of Contents
I. EXECUTIVE SUMMARY
The purpose of this memorandum is to set forth the comprehensive work plan, milestone schedule, staffing allocations, and budget framework for Phase 1 of the United States state-privacy compliance program for Cascade Retail Holdings Inc. ("Cascade" or "CRH"), a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD.
This engagement was opened on June 2, 2025, pursuant to the engagement letter executed between Calderwood & Harkness LLP ("C&H") and Cascade Retail Holdings Inc. (attention: Meredith Tanaka, General Counsel). The engagement letter sets forth the terms and conditions governing the attorney-client relationship, including the fee structure, billing arrangements, and scope of representation.
Phase 1 Scope. Phase 1 encompasses the assessment, gap analysis, policy drafting, vendor-contract templates, governance framework, and training materials necessary to bring Cascade into substantial compliance with the currently applicable universe of nineteen (19) US state comprehensive privacy statutes. The Phase 1 engagement period runs through December 31, 2025. During this period, C&H will produce a series of interrelated deliverables organized across five workstreams, culminating in a privileged compliance-readiness certification memorandum addressed to Cascade's General Counsel.
Phase 1 Fee Cap. The total fees for Phase 1 are subject to a cap of $2,600,000, calculated on a blended hourly-rate basis as set forth in the engagement letter. This cap encompasses all attorney time and standard overhead costs. Disbursements for travel, third-party research databases, and similar out-of-pocket expenses are billed separately as provided in the engagement letter and are not included within the fee cap.
Phase 2 Overview. Phase 2 of the engagement, covering implementation support from January 1, 2026 through June 30, 2026, is currently estimated at $1,400,000 to $1,800,000 on a standard hourly basis without a fee cap. Phase 2 is not addressed in detail in this memorandum and will be the subject of a separate work plan to be prepared in the fourth quarter of 2025.
Coordination with Other Advisors. This memorandum also addresses the coordination framework between C&H and two other advisory firms engaged by Cascade in connection with the privacy compliance program:
(a) Fieldhaven Consulting Group LLC ("Fieldhaven"), a technology consulting firm retained by Cascade under a fixed-fee statement of work totaling $3,150,000 to perform technical implementation work including consent-management platform deployment, data-mapping and inventory tooling, and data-subject-request workflow automation; and
(b) Whitfield Greaves LLP ("Whitfield Greaves"), Cascade's existing corporate and securities counsel (lead partner: Carolyn J. Marsden), which will coordinate with C&H on board-governance matters, SEC-disclosure implications, and related corporate-law issues arising from the privacy program.
The sections that follow provide a detailed client and matter overview, engagement team composition, milestone schedule, workstream decomposition, budget management framework, coordination protocols, risk factors, and reporting structures. This memorandum is submitted for Kevin Ostrowski's review and approval before distribution to the broader engagement team and, as appropriate, to the client team.
II. CLIENT & MATTER OVERVIEW
A. Client Profile
Corporate Information. The client is Cascade Retail Holdings Inc., a corporation organized and existing under the laws of the State of Delaware. Cascade is publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD. Its principal executive offices are located at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119.
Key Personnel. The following individuals comprise the senior leadership team relevant to this engagement:
• Thomas R. Cavanaugh — Chief Executive Officer
• Meredith Tanaka — General Counsel
• Diana Polk — Associate General Counsel and Interim Chief Privacy Officer; day-to-day client lead and principal liaison for C&H
• Gregory Farris — Chief Information Security Officer
• Priya Nandakumar — Vice President, Data & Analytics
• Jason Leclaire — Vice President, Marketing & Customer Engagement
Business Overview. Cascade reported fiscal year 2024 revenue of approximately $3.87 billion. The company employs approximately 22,500 individuals across 186 retail locations in 31 US states, as well as dedicated e-commerce fulfillment centers. Cascade's consumer-facing digital properties are substantial: the Cascade Rewards loyalty program has approximately 41.2 million registered members, and the company processes approximately 94 million online transactions annually. These figures underscore the volume and sensitivity of consumer personal information that Cascade collects, processes, and shares across its various business lines.
Key Subsidiaries in Scope. Four Cascade subsidiaries are within the scope of Phase 1 and present distinct privacy-compliance considerations:
1. Cascade Digital Marketplace LLC ("CDM") — CDM operates a third-party seller marketplace with approximately 3,800 active sellers. CDM's operations implicate controller-processor distinctions under multiple state privacy statutes, as third-party sellers both contribute and access consumer data through the marketplace platform.
2. Ridgeline Fulfillment Services Inc. ("Ridgeline") — Ridgeline provides warehousing and logistics services for both Cascade's first-party e-commerce operations and CDM sellers. Ridgeline processes consumer shipping addresses, order details, and related logistics data.
3. Peakview Analytics Inc. ("Peakview") — Peakview is Cascade's advertising technology and customer analytics subsidiary. Peakview processes approximately 2.1 billion consumer-event data records per month, including browsing behavior, purchase history, and advertising-attribution data. Peakview's data-processing activities are among the highest-risk elements of the compliance program due to the volume and sensitivity of data processed and the advertising-technology regulatory environment.
4. Cascade Rewards Corp. — Cascade Rewards Corp. administers the Cascade Rewards loyalty program and stored-value card programs. The loyalty program's 41.2 million members generate detailed purchase-history, preference, and behavioral data that is used across Cascade's marketing and analytics functions.
B. Regulatory Landscape
As of the date this engagement was opened, Cascade's operations are subject to nineteen (19) state comprehensive privacy statutes that are either currently in effect or will become effective during the Phase 1 engagement period. These statutes, listed in approximate order of enactment or effective date, are as follows:
1. California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA)
2. Virginia Consumer Data Protection Act (VCDPA)
3. Colorado Privacy Act (CPA)
4. Connecticut Data Privacy Act (CTDPA)
5. Utah Consumer Privacy Act (UCPA)
6. Iowa Consumer Data Protection Act (ICDPA)
7. Indiana Consumer Data Protection Act (INCDPA)
8. Tennessee Information Protection Act (TIPA)
9. Montana Consumer Data Privacy Act (MCDPA)
10. Texas Data Privacy and Security Act (TDPSA)
11. Oregon Consumer Privacy Act (OCPA)
12. Delaware Personal Data Privacy Act (DPDPA)
13. New Jersey Data Privacy Act (NJDPA)
14. New Hampshire Data Privacy Act (NHDPA)
15. Nebraska Data Privacy Act (NDPA)
16. Minnesota Consumer Data Privacy Act (Minnesota MCDPA)
17. Maryland Online Data Privacy Act (MODPA)
18. Kentucky Data Privacy Act (KYDPA)
19. Additional statutes enacted or becoming effective through 2025–2026
It bears emphasis that Cascade ships e-commerce orders to consumers in all 50 states plus the District of Columbia. While not all states have enacted comprehensive privacy statutes, Cascade's nationwide e-commerce footprint means that additional state laws may become applicable during the Phase 1 period as new legislation is enacted or existing legislation takes effect. The multi-state applicability matrix (discussed below in the workstream decomposition) will provide a detailed statute-by-statute analysis of applicability thresholds, including revenue, consumer-count, and data-processing volume triggers.
C. Key Known Compliance Gaps
Fieldhaven Consulting Group LLC produced a comprehensive data-mapping report dated May 19, 2025 (the "Fieldhaven Data-Mapping Report"), which forms the foundational factual basis for C&H's Phase 1 assessment and gap-analysis work. Based on the Fieldhaven Data-Mapping Report and C&H's preliminary review of Cascade's existing privacy program, seven primary compliance gaps have been identified that will serve as the principal remediation drivers for the Phase 1 engagement:
Gap 1 — Outdated Online Privacy Policy. Cascade's public-facing online privacy policy was last substantively updated in March 2022. The current policy does not address fourteen (14) of the nineteen (19) applicable state privacy statutes, including statutes that have since become effective and that impose affirmative disclosure obligations. The policy fails to include required disclosures regarding categories of personal information collected, purposes of processing, categories of third parties to whom data is disclosed, and consumer rights under applicable state laws.
Gap 2 — No Universal Opt-Out Mechanism. Cascade does not currently honor the Global Privacy Control ("GPC") signal or any equivalent universal opt-out mechanism on cascade.com or the Cascade mobile application. The CCPA/CPRA, Colorado CPA, Connecticut CTDPA, Texas TDPSA, Oregon OCPA, Montana MCDPA, Delaware DPDPA, and several other state statutes either require or will require recognition of universal opt-out signals. Cascade's current website contains no "Do Not Sell or Share My Personal Information" link of the type required under CCPA/CPRA.
Gap 3 — Commingled Data Lake. Third-party seller data originating from the Cascade Digital Marketplace is commingled with first-party customer data in a single enterprise data lake without role-based access controls or logical segmentation. This commingling creates significant risk under statutes that distinguish between controller and processor obligations, and under CCPA/CPRA provisions governing "business purposes" and "commercial purposes" uses of consumer personal information.
Gap 4 — Missing Data-Processing Agreements. Twenty-three (23) of Cascade's forty-seven (47) third-party advertising and analytics partners lack executed data-processing agreements ("DPAs"). Under the CCPA/CPRA, service providers, contractors, and third parties must be subject to contractual restrictions that limit the use, retention, and disclosure of personal information. Similar contractual requirements exist under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and virtually all other applicable state statutes. The absence of executed DPAs with nearly half of Cascade's advertising and analytics partners represents a material compliance deficiency.
Gap 5 — Sensitive Personal Information Processing Without Consent. Cascade's mobile application collects precise geolocation data from consumers who have enabled location services. Under the CCPA/CPRA, precise geolocation is classified as "sensitive personal information," and its processing for purposes beyond those reasonably expected by the consumer requires separate opt-in consent or, at minimum, the right to limit use. Cascade does not currently obtain such consent and does not provide a mechanism to limit the use of sensitive personal information.
Gap 6 — No Data-Retention Schedule. Cascade has no documented data-retention schedule governing the retention periods for customer-transaction data, loyalty-program data, or other categories of consumer personal information. Multiple state statutes impose data-minimization obligations that require controllers to limit retention to periods reasonably necessary to fulfill the purposes for which the data was collected. The absence of a retention schedule exposes Cascade to risk under these provisions and complicates its ability to respond to deletion requests.
Gap 7 — Deficient Data-Subject Request ("DSR") Portal. Cascade's existing consumer-rights request portal lacks CCPA-standard identity verification procedures and does not include the appeal-process functionality required under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other state laws. Additionally, Cascade's average DSR response time for fiscal year 2024 was 27 calendar days, which, while within the 45-day statutory maximum under CCPA/CPRA, exceeds the target of 15 business days or fewer that the compliance program is designed to achieve.
Additional Data Points. The following additional data points from the Fieldhaven Data-Mapping Report and Cascade's internal reporting are relevant to the scope and design of Phase 1:
• Total DSRs received in FY2024: approximately 38,400 (access requests: approximately 12,800; deletion requests: approximately 19,100; opt-out of sale/sharing requests: approximately 6,500).
• Categories of cookies and tracking technologies deployed on cascade.com: 12 categories.
• Total third-party advertising and analytics partners: 47.
D. Regulatory History Bearing on Program Design
Two prior regulatory interactions are relevant to the design of the compliance program and are summarized below. A more detailed privileged summary memorandum will be prepared during Phase 1A.
FTC Civil Investigative Demand. On September 14, 2023, the Federal Trade Commission issued a Civil Investigative Demand ("CID") to Cascade (FTC File No. 232-0147) regarding allegations of dark-pattern design in the Cascade mobile application's unsubscribe flow. The investigation focused on the number of steps required to cancel a Cascade Rewards subscription and the placement and visibility of cancellation options within the mobile-app interface. The matter was closed on April 3, 2024, with no action taken by the FTC. While no enforcement action resulted, the CID underscores the FTC's attention to Cascade's consumer-facing digital practices and informs the design principles for the compliance program's consumer-facing interfaces.
California Attorney General Informal Inquiry. On February 6, 2024, the California Attorney General's office sent an informal inquiry letter to Cascade regarding the adequacy of Cascade's sale-and-sharing disclosures on cascade.com. Cascade responded on March 8, 2024, through outside counsel. No enforcement action was initiated. However, the inquiry specifically highlighted two deficiencies: (i) the absence of a prominently placed "Do Not Sell or Share My Personal Information" link on cascade.com, and (ii) inadequate contractual protections in Cascade's agreements with service providers and third parties regarding the use and disclosure of consumer personal information. Both of these deficiencies remain unaddressed as of the date of this memorandum and are direct drivers for Workstreams 2 and 3 of Phase 1.
III. ENGAGEMENT TEAM & STAFFING ALLOCATIONS
A. Calderwood & Harkness LLP Team
The following table sets forth the C&H engagement team, together with each team member's role, hourly rate, estimated Phase 1 hours, and estimated Phase 1 fees. All rates are as set forth in the engagement letter dated June 2, 2025.
The estimated total of approximately $2,236,000 provides a buffer of approximately $364,000 against the Phase 1 fee cap of $2,600,000. This buffer is reserved for scope contingencies, additional partner review cycles beyond those currently estimated, and potential negotiation complexity associated with the Thornbridge Media Corp. data-sharing agreement restructuring (discussed in Workstream 3 below).
Partner rates are set at $1,175 per hour for both Kevin Ostrowski (Responsible Partner) and Rachel Bernstein (Billing Partner). The senior associate rate for Alan Burke is $785 per hour, and the associate rate for Sara Hendricks is $625 per hour. These rates are consistent with the firm's standard rate schedule as applied to the engagement letter.
B. Role Descriptions & Responsibilities
Kevin Ostrowski — Responsible Partner. Kevin will provide overall engagement oversight and manage the client relationship with Meredith Tanaka (General Counsel) and, as appropriate, Thomas R. Cavanaugh (CEO). Kevin will perform final review of all major deliverables, including the gap-analysis report, board presentation materials, and the compliance-readiness certification memorandum. Kevin will lead the presentation to Cascade's Audit & Risk Committee at the November 13, 2025 board meeting and will provide strategic direction on the Thornbridge Media Corp. negotiation. Kevin's estimated 350 hours reflect his senior supervisory role across all workstreams, with the heaviest involvement in Workstreams 1 (gap analysis), 3 (Thornbridge negotiation), and 5 (compliance certification).
Rachel Bernstein — Billing Partner. Rachel serves as the billing partner responsible for fee-cap monitoring and periodic client billing review in accordance with the firm's standard billing-partner protocols. In addition to her billing responsibilities, Rachel will provide substantive input on the regulatory-enforcement risk assessment and on California-specific compliance issues, drawing on her extensive experience with CCPA/CPRA enforcement matters. Rachel's estimated 100 hours reflect her targeted substantive contributions and ongoing billing-oversight role.
Alan Burke — Lead Associate (Senior Associate). Alan will serve as the day-to-day project manager for the engagement and will be the primary point of contact for Diana Polk (Cascade's day-to-day client lead) and Marcus Ellerby (Fieldhaven's engagement lead). Alan will serve as the primary drafter of the gap-analysis report, the third-party data-sharing risk assessment, the vendor DPA templates (service-provider and contractor), the Thornbridge Media Corp. restructured data-sharing agreement, and the privacy governance documents. Alan will lead negotiations with Victor Sandoval of Kellner Park & Associates LLP regarding the Thornbridge agreement and will serve as the coordination point with Fieldhaven and Whitfield Greaves LLP (Carolyn J. Marsden). Alan will also maintain the running budget tracker and prepare monthly budget reports for Kevin Ostrowski and Rachel Bernstein. Alan's estimated 1,100 hours reflect his central role across all five workstreams.
Sara Hendricks — Working Associate. Sara will serve as the primary drafter of the multi-state applicability matrix, the sensitive-personal-information analysis memorandum, the children's privacy and age-gating analysis memorandum, the omnibus privacy policy and all supplemental notices (California addendum, state-specific rights supplement, cookie and tracking-technology notice, employee and applicant privacy notice, Cascade Rewards loyalty-program privacy notice, and marketplace seller privacy notice), the DSR standard operating procedures, the employee privacy training materials, the OnPoint Data Solutions DPA rider, and the Fieldhaven data-protection terms review memorandum. Sara will also provide research support across all workstreams as needed. Sara's estimated 1,350 hours reflect the substantial volume of drafting and research required, particularly in Workstreams 1, 2, and 4.
C. Cascade Client Team Contacts
The following individuals comprise the Cascade client team for purposes of this engagement. C&H personnel should direct communications as indicated below:
• Meredith Tanaka (General Counsel) — Primary client contact for matters requiring General Counsel approval. Meredith is the approver of all external-facing deliverables, including the omnibus privacy policy and supplemental notices. Monthly status calls will be scheduled with Meredith. All formal deliverable transmittals should be directed to Meredith with a copy to Diana Polk.
• Diana Polk (Associate General Counsel / Interim Chief Privacy Officer) — Day-to-day client lead and principal liaison for C&H. Diana will serve as the primary reviewer for all draft deliverables before escalation to Meredith Tanaka for final approval. Biweekly status calls will be conducted with Diana. Diana is coordinating the CPO hiring process and will serve in the Interim CPO capacity for the duration of Phase 1.
• Gregory Farris (Chief Information Security Officer) — Information security coordination and technical controls input. Greg will provide subject-matter expertise on data-security measures, incident-response procedures, and data-mapping validation. C&H will coordinate with Greg on technical aspects of the DSR workflow, consent-management platform configuration, and data-lake access controls.
• Priya Nandakumar (Vice President, Data & Analytics) — Data-mapping subject-matter expert and Peakview Analytics coordination. Priya will provide detailed information on Cascade's data-processing activities, analytics platforms, cookie and tracking-technology deployments, and the Peakview advertising-technology stack. Priya's input will be critical to the sensitive-PI analysis and the third-party data-sharing risk assessment.
• Jason Leclaire (Vice President, Marketing & Customer Engagement) — Advertising technology operations, the Thornbridge Media Corp. relationship, and Cascade Rewards loyalty-program operations. Jason's team manages the day-to-day relationship with Thornbridge and with Cascade's other third-party advertising and analytics partners. Jason's input will be essential to the vendor DPA rollout plan and the loyalty-program privacy notice.
• Ellen Marchetti (Director; Chair, Audit & Risk Committee) — Board-level oversight of the privacy compliance program. Ellen will be the recipient of the board presentation memorandum and will chair the Audit & Risk Committee meeting on November 13, 2025, at which C&H will present the Privacy Governance Charter for adoption.
IV. PHASE 1 MILESTONE SCHEDULE
A. Master Timeline
The following table sets forth the complete Phase 1 milestone schedule, including target dates, deliverables, lead personnel, and key dependencies. Milestones marked in bold represent critical-path deliverables that gate subsequent workstreams or represent major engagement checkpoints.
B. Workstream Decomposition
The Phase 1 work plan is organized into five workstreams, each of which comprises a set of related deliverables and activities. The workstreams are sequenced to ensure that upstream deliverables gate downstream activities, with the gap-analysis report (Workstream 1) serving as the critical-path milestone for all subsequent workstreams.
Workstream 1: Assessment & Gap Analysis (Phase 1A — June–August 2025)
Deliverables:
(a) Multi-state applicability matrix — a detailed spreadsheet mapping each of the 19 applicable state privacy statutes against Cascade's operations, revenue thresholds, consumer-count thresholds, and data-processing activities to confirm jurisdictional applicability and identify any statutes that may not apply due to threshold limitations or exemptions;
(b) Data-mapping review memorandum — a legal review of the Fieldhaven Data-Mapping Report dated May 19, 2025, identifying areas where the data inventory is incomplete or requires supplementation for purposes of legal compliance analysis;
(c) Sensitive personal information analysis memorandum — a comprehensive analysis of Cascade's processing of sensitive personal information (including precise geolocation data from the Cascade mobile application, payment card data, account credentials, and other categories classified as "sensitive" under the CCPA/CPRA and other applicable state statutes), together with recommendations for consent mechanisms and limitation-of-use controls;
(d) Children's privacy and age-gating analysis memorandum — an analysis of Cascade's obligations under the Children's Online Privacy Protection Act ("COPPA") and the California Age-Appropriate Design Code Act ("AADC"), including recommendations for age-gating and parental-consent mechanisms on cascade.com and the Cascade mobile application;
(e) Third-party data-sharing risk assessment — a classification of all 47 advertising and analytics partners into CCPA/CPRA categories (service providers, contractors, and third parties), identification of the 23 partners lacking executed DPAs, and a risk-prioritization framework for the DPA rollout;
(f) FTC and California Attorney General inquiry summary memorandum — a privileged memorandum summarizing the FTC Civil Investigative Demand (File No. 232-0147) and the California Attorney General informal inquiry, analyzing the compliance implications of both interactions, and identifying remediation items that remain open; and
(g) Gap-analysis report — a comprehensive gap-analysis report evaluating Cascade's current compliance posture against all 19 applicable state statutes, organized by compliance domain (notices and disclosures; consumer rights; data processing agreements; data minimization and retention; sensitive PI; consent mechanisms; governance and accountability), with specific remediation recommendations and priority rankings.
Key Activities. Workstream 1 activities will include a thorough review of the Fieldhaven Data-Mapping Report; structured interviews with key Cascade stakeholders (Diana Polk, Gregory Farris, Priya Nandakumar, and Jason Leclaire) to validate data flows and processing activities; legal research on all 19 applicable state statutes, including implementing regulations and published enforcement guidance; and classification and risk assessment of all 47 third-party advertising and analytics partners.
Critical Path. The gap-analysis report, targeted for delivery on August 15, 2025, is the critical-path milestone for the entire Phase 1 engagement. All subsequent workstreams — policy drafting (Workstream 2), contracts and vendor management (Workstream 3), governance and internal controls (Workstream 4), and compliance certification (Workstream 5) — depend on the findings and recommendations of the gap-analysis report. Any delay in the gap-analysis report will cascade through the remaining Phase 1 timeline.
Workstream 2: Policy & Notice Drafting (Phase 1B — August–September 2025)
Deliverables:
(a) Omnibus privacy policy — a comprehensive, multi-state privacy policy for cascade.com and the Cascade mobile application, addressing all required disclosures under the 19 applicable state statutes, including categories of personal information collected, purposes of processing, categories of third parties to whom data is disclosed, retention periods (by reference to the data-retention schedule), and consumer rights;
(b) California-specific disclosures addendum — a supplemental addendum to the omnibus privacy policy providing the specific CCPA/CPRA-required disclosures, including the "Notice at Collection," categories of personal information sold or shared, sensitive personal information disclosures, and financial-incentive program notices (for the Cascade Rewards loyalty program);
(c) State-specific rights supplement — a supplemental section or linked page detailing the consumer rights available under each applicable state statute, organized by state, with links to the DSR portal;
(d) Cookie and tracking-technology notice — a standalone notice describing the 12 categories of cookies and tracking technologies deployed on cascade.com and the Cascade mobile application, integrated with the OnPoint consent-management platform;
(e) Employee and applicant privacy notice — a privacy notice addressed to Cascade's approximately 22,500 employees and job applicants, covering the categories of personal information collected in the employment context, purposes of processing, and applicable rights under state employment-privacy provisions;
(f) Cascade Rewards loyalty-program privacy notice — a privacy notice specific to the Cascade Rewards program, addressing the collection and use of loyalty-program data, the treatment of purchase-history and preference data, and any financial-incentive disclosures required under CCPA/CPRA; and
(g) Marketplace seller privacy notice — a privacy notice for the approximately 3,800 sellers on the Cascade Digital Marketplace, addressing the personal information collected from sellers and the data-sharing arrangements between CDM and Cascade.
Key Activities. Workstream 2 activities will include initial drafting by Sara Hendricks with review and revisions by Alan Burke, followed by internal C&H quality-review cycles. Draft notices will be submitted to Diana Polk for initial client review, with final approval by Meredith Tanaka. Coordination with Jason Leclaire will be required for the loyalty-program notice and the marketing/advertising-related disclosures within the omnibus privacy policy. Coordination with Priya Nandakumar will be required for the cookie notice and the analytics-related disclosures.
Target. All notice drafts are targeted for delivery to the client by September 12, 2025. Client review and revision cycles are expected to extend through September and into early October, with final versions incorporated into the CMP deployment and website update prior to the December 15, 2025 CMP go-live date.
Workstream 3: Contracts & Vendor Management (Phase 1C — August–October 2025)
Deliverables:
(a) Service-provider DPA template — a standardized data-processing agreement template for use with Cascade's service providers, incorporating the contractual requirements of all 19 applicable state statutes, including CCPA/CPRA service-provider provisions (Cal. Civ. Code § 1798.100(d)), and the equivalent provisions of the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other applicable laws;
(b) Contractor DPA template — a separate DPA template for use with contractors (as that term is defined under CCPA/CPRA), incorporating the additional contractual requirements applicable to contractors, including flow-down obligations and audit rights;
(c) Thornbridge Media Corp. restructured data-sharing agreement — a restructured agreement with Thornbridge Media Corp. ("Thornbridge"), Cascade's largest advertising and media partner (annual spend: $18.4 million), reflecting compliant data-sharing arrangements under all applicable state statutes. The existing agreement with Thornbridge does not satisfy CCPA/CPRA requirements and must be substantially restructured. This negotiation will be conducted with Thornbridge's outside counsel, Victor Sandoval of Kellner Park & Associates LLP, and Thornbridge's internal team (Leah Voss and Robert Shin);
(d) Thornbridge negotiation issues list and redline commentary — an internal privileged memorandum analyzing key negotiation issues, documenting C&H's positions on contested terms, and tracking the evolution of redlines throughout the negotiation;
(e) OnPoint Data Solutions DPA rider / amendment — a data-processing addendum to the existing OnPoint CMP SaaS agreement, addressing the processing of consumer personal information by OnPoint in connection with the consent-management platform. The rider will be negotiated with OnPoint's contract team, led by Danielle Ferrero;
(f) Fieldhaven data-protection terms review memorandum — a review of the data-handling and data-protection provisions in Fieldhaven's statement of work, with recommendations for amendments to ensure adequate contractual protections for consumer personal information accessed by Fieldhaven in the course of the technology implementation;
(g) Vendor DPA rollout plan — a strategic plan for deploying executed DPAs to the 23 third-party advertising and analytics partners identified as lacking contractual coverage, including a prioritization framework based on risk, data volume, and processing sensitivity; and
(h) Marketplace seller data-use terms — terms-of-service addendum for the approximately 3,800 sellers on the Cascade Digital Marketplace, establishing data-use restrictions, data-sharing limitations, and consumer-rights cooperation obligations for marketplace sellers.
Key Activities. Workstream 3 activities will begin with template drafting in August 2025, immediately following the issuance of the gap-analysis report. The DPA templates are expected to require multiple internal review cycles given the need to harmonize the contractual requirements of 19 state statutes into workable, commercially reasonable templates. The Thornbridge negotiation is expected to be the most complex and time-intensive component of Workstream 3, given the significance of the Thornbridge relationship to Cascade's advertising operations and the likely resistance from Thornbridge to the contractual restrictions required under CCPA/CPRA and other state statutes.
Critical Path. The DPA templates are targeted for finalization by September 30, 2025, to enable the vendor DPA rollout and the Thornbridge negotiation to proceed on schedule. The Thornbridge agreement is targeted for execution by October 31, 2025. Any delay in DPA template finalization will affect both the vendor rollout timeline and the Thornbridge negotiation schedule.
Workstream 4: Governance, Policies & Internal Controls (Phase 1D — September–December 2025)
Deliverables:
(a) Privacy Governance Charter (board resolution) — a draft board resolution establishing a formal privacy governance framework for Cascade, including the creation of a permanent Chief Privacy Officer position, the designation of the Audit & Risk Committee as the board-level privacy oversight body, reporting cadences, and escalation protocols. The charter will be drafted in coordination with Carolyn J. Marsden of Whitfield Greaves LLP to ensure alignment with corporate governance best practices and the SEC disclosure framework;
(b) Internal privacy policy and procedures manual — a comprehensive company-wide internal policy document establishing Cascade's privacy-related policies, procedures, and responsibilities, including data-classification standards, data-handling procedures, incident-response protocols, and employee obligations;
(c) Data retention and disposal schedule — a detailed schedule specifying retention periods for each category of personal information identified in the data-mapping inventory, together with disposal procedures and exception-management protocols. The retention schedule will be developed based on the findings of the Fieldhaven Data-Mapping Report and C&H's gap-analysis report;
(d) DSR standard operating procedures — step-by-step procedures for the intake, identity verification, processing, and fulfillment of data-subject requests, including access, deletion, correction, opt-out of sale/sharing, and opt-out of profiling requests. The SOPs will include the appeal-process functionality required under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other applicable state laws. The SOPs are designed to achieve a target response time of 15 business days or fewer, compared to the current average of 27 calendar days;
(e) Privacy impact assessment ("PIA") framework and template — a framework and standardized template for conducting privacy impact assessments on new products, services, data uses, and technology deployments, as required under the Colorado CPA, Connecticut CTDPA, Virginia VCDPA, and other applicable state statutes; and
(f) Employee privacy training materials — training slides, an accompanying outline, and an acknowledgment form designed for deployment to Cascade's approximately 22,500 employees. The training materials will cover the fundamentals of the privacy compliance program, employee obligations under the internal privacy policy, DSR handling procedures, and incident-reporting protocols.
Key Activities. Workstream 4 activities will be concentrated in the September through December 2025 timeframe, building on the findings and recommendations of the gap-analysis report. The Privacy Governance Charter is a high-priority deliverable, as it must be ready for adoption at the November 13, 2025 Cascade Board of Directors meeting. C&H will coordinate closely with Carolyn J. Marsden of Whitfield Greaves LLP on the governance charter to ensure that it addresses any SEC reporting considerations (including proxy statement disclosures and 10-K risk factor updates) and is consistent with Delaware corporate governance law.
The DSR SOPs will be developed in coordination with Fieldhaven's DSR automation tool (Fieldhaven Milestone 3) and Cascade's internal IT team under Gregory Farris's oversight. The SOPs must be finalized and tested prior to the DSR workflow go-live date of December 1, 2025.
Critical Path. The board resolution for the Privacy Governance Charter must be prepared and circulated to Whitfield Greaves and the Cascade legal team by late October or early November 2025 to allow adequate review time prior to the November 13, 2025 board meeting. The DSR SOPs must be finalized in advance of the December 1, 2025 DSR workflow go-live date.
Workstream 5: Compliance Certification & Reporting (Phase 1E — December 2025)
Deliverables:
(a) Phase 1 compliance-readiness certification memorandum — a privileged memorandum addressed to Meredith Tanaka (General Counsel) certifying the status of Cascade's compliance program as of December 31, 2025, identifying all completed remediation activities, documenting any residual compliance gaps or open items, assessing remaining risk, and setting forth priority recommendations for Phase 2; and
(b) Board presentation memorandum — a privileged memorandum prepared for the Audit & Risk Committee (Chair: Ellen Marchetti) summarizing the Phase 1 engagement, the compliance posture achieved, and the recommended Phase 2 activities.
Key Activities. Workstream 5 activities will consist of a comprehensive review of all Phase 1 deliverables, a status assessment of each remediation activity, identification of residual risks, and preparation of the certification memorandum and board presentation materials. This workstream is a culmination of all prior workstreams and will require coordination across the full C&H engagement team. The first board-level report will be delivered at the November 13, 2025 Audit & Risk Committee meeting; the final certification memorandum and an updated board report will be delivered on or before December 31, 2025.
V. BUDGET MANAGEMENT
A. Phase 1 Fee Cap Analysis
The total Phase 1 fee cap, as established in the engagement letter dated June 2, 2025, is $2,600,000. The estimated fee allocation by workstream is set forth in the following table:
The fee allocation reflects the relative complexity and scope of each workstream. Workstream 1 (Assessment & Gap Analysis) and Workstream 3 (Contracts & Vendor Management) are the two most resource-intensive workstreams, together comprising approximately 47% of the estimated fees exclusive of contingency. The Thornbridge negotiation within Workstream 3 is the single highest-risk item from a budget perspective, as the negotiation timeline and complexity are difficult to predict with precision.
Billing Procedures. Monthly invoices will be submitted to Cascade with detailed time entries in accordance with the outside-counsel billing guidelines provided by Meredith Tanaka. Each time entry will include a narrative description of the work performed, the workstream to which the entry is attributed, and the applicable attorney's name and rate.
Budget Tracking. Alan Burke will maintain a running budget tracker that monitors actual time and fees against the estimated budget for each workstream and against the overall fee cap. Monthly budget reports will be prepared by Alan Burke and submitted to Kevin Ostrowski and Rachel Bernstein (billing partner) for review. Quarterly budget status updates will be communicated to Meredith Tanaka at the regularly scheduled monthly client call to provide transparency on fee-cap utilization.
B. Relationship to Other Program Costs (for Context Only)
The following costs are borne directly by Cascade and are not included within the C&H Phase 1 fee cap. They are documented here for contextual purposes to provide a complete picture of the overall program investment:
Fieldhaven Consulting Group LLC — Fixed-Fee SOW: $3,150,000. Fieldhaven's statement of work is structured around three milestone-based payments:
• Milestone 1 (data mapping complete): $945,000
• Milestone 2 (consent-management platform deployed): $1,102,500
• Milestone 3 (DSR automation workflow live): $1,102,500
OnPoint Data Solutions Inc. — CMP SaaS Contract: $1,440,000 (total contract value). OnPoint's consent-management platform SaaS agreement is a three-year term contract at an annual license fee of $480,000 per year. The total contract value over the three-year term is $1,440,000.
Phase 2 — C&H Estimated Fees: $1,400,000 – $1,800,000. Phase 2, covering implementation support from January 1, 2026 through June 30, 2026, will be billed on a standard hourly basis without a fee cap. The estimate of $1,400,000 to $1,800,000 is preliminary and will be refined in the Phase 2 work plan to be prepared in the fourth quarter of 2025.
C&H's role with respect to Fieldhaven and OnPoint is limited to overseeing Fieldhaven's work product for legal sufficiency and advising Cascade on the contractual terms of the OnPoint SaaS agreement. C&H does not direct Fieldhaven's or OnPoint's technical work, and the costs associated with those engagements are managed directly by Cascade.
VI. COORDINATION WITH FIELDHAVEN CONSULTING GROUP LLC
A. Role & Scope
Fieldhaven Consulting Group LLC ("Fieldhaven") has been retained by Cascade as a technology consultant to perform the technical implementation work necessary to support the privacy compliance program. Fieldhaven's engagement lead is Marcus Ellerby, based at Fieldhaven's San Francisco office at 350 Sansome Street, Suite 400, San Francisco, California 94104.
Fieldhaven's scope of work encompasses three principal technical workstreams: (i) deployment and configuration of data-mapping and inventory tooling to create and maintain a comprehensive data inventory; (ii) deployment and configuration of the OnPoint Data Solutions consent-management platform on cascade.com and the Cascade mobile application; and (iii) design, build, and deployment of a DSR-workflow automation tool to streamline the intake, processing, and fulfillment of consumer-rights requests.
C&H's role with respect to Fieldhaven is to oversee Fieldhaven's work product for legal sufficiency. This means that C&H will review Fieldhaven's technical deliverables to confirm that they satisfy the legal requirements of the 19 applicable state privacy statutes, but C&H will not direct Fieldhaven's technical implementation choices or project-management decisions. The distinction between legal oversight and technical direction is important for both scope-management and privilege-preservation purposes.
B. Coordination Touchpoints
The following coordination mechanisms will govern the working relationship between C&H and Fieldhaven throughout Phase 1:
Weekly Status Calls. Alan Burke and Sara Hendricks will participate in the weekly Fieldhaven/Cascade project status calls, which are expected to be scheduled on a recurring basis beginning with the Phase 1 kickoff on June 16, 2025. These calls will provide C&H with ongoing visibility into Fieldhaven's progress against its milestones and will enable real-time identification of legal issues arising from Fieldhaven's technical work.
Deliverable Review Gates. C&H will perform legal review and provide sign-off on the following Fieldhaven deliverables before they are accepted by Cascade as complete:
(i) Data-mapping tool output — C&H will review the data-mapping tool output for completeness relative to the categories of personal information defined under the CCPA/CPRA and other applicable state statutes. The data inventory must capture all categories of personal information collected, the sources of collection, the purposes of processing, the categories of third parties to whom data is disclosed, and the business or commercial purpose for each disclosure. Any gaps identified by C&H will be communicated to Fieldhaven for supplementation.
(ii) CMP configuration — C&H will review the configuration of the OnPoint consent-management platform to confirm compliance with all 19 state opt-out and opt-in requirements, including GPC signal recognition, the display and functionality of the "Do Not Sell or Share My Personal Information" link, the opt-in consent mechanism for sensitive personal information under CCPA/CPRA, and the state-specific consent requirements under the Colorado CPA, Connecticut CTDPA, and other applicable laws.
(iii) DSR automation workflow — C&H will review the DSR automation workflow for compliance with identity-verification standards (including the CCPA/CPRA's reasonable verification requirements), response-timeline management (target: 15 business days or fewer), and appeal-process functionality as required under the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other applicable state laws.
Milestone Alignment. The Fieldhaven and C&H milestone schedules are designed to be mutually reinforcing. Fieldhaven Milestone 1 (data mapping complete) is expected to precede C&H's gap-analysis report delivery date of August 15, 2025, as the gap-analysis report depends in part on the findings of the data-mapping tool. Fieldhaven Milestone 2 (CMP deployed) is aligned with C&H's CMP deployment oversight target of December 15, 2025. Fieldhaven Milestone 3 (DSR automation live) is aligned with C&H's DSR workflow go-live oversight target of December 1, 2025. If Fieldhaven's milestones slip, corresponding adjustments to C&H's oversight milestones will be required.
Data-Protection Terms. C&H will review the data-handling and data-protection provisions in Fieldhaven's statement of work and recommend any amendments necessary to ensure that Fieldhaven's access to and processing of consumer personal information is governed by adequate contractual protections. The Fieldhaven data-protection review memorandum is targeted for completion in July 2025.
VII. COORDINATION WITH WHITFIELD GREAVES LLP
A. Role & Scope
Whitfield Greaves LLP ("Whitfield Greaves") serves as Cascade's longstanding securities and corporate governance counsel. The lead partner on the Cascade relationship is Carolyn J. Marsden, based at Whitfield Greaves' Washington, D.C. office at 1999 K Street NW, Suite 700, Washington, D.C. 20006.
Whitfield Greaves' role in connection with the privacy compliance program is focused on the intersection of privacy governance with SEC-disclosure requirements and corporate governance. Specifically, Whitfield Greaves will coordinate with C&H on the following matters: (i) SEC-disclosure implications arising from the privacy compliance program, including proxy statement disclosures, 10-K risk factor updates, and any 8-K considerations triggered by material developments in the program or by regulatory actions; and (ii) the board-governance aspects of the privacy program, including the form and content of the Privacy Governance Charter and any related board resolutions.
B. Common-Interest Agreement
A common-interest agreement was executed on June 10, 2025, between Calderwood & Harkness LLP (Kevin Ostrowski) and Whitfield Greaves LLP (Carolyn J. Marsden) to permit the sharing of privileged communications between the two firms in connection with the Cascade privacy compliance program without waiver of the attorney-client privilege or the work-product doctrine. The common-interest agreement reflects the shared legal interest of both firms in providing coordinated legal advice to Cascade and is intended to preserve the confidentiality of all communications exchanged under its terms.
C. Key Coordination Points
The following matters require active coordination between C&H and Whitfield Greaves during Phase 1:
Privacy Governance Charter. C&H will prepare the initial draft of the Privacy Governance Charter, establishing the privacy governance framework for Cascade's Board of Directors and the Audit & Risk Committee. The charter will address the creation of a permanent Chief Privacy Officer position, the CPO's reporting structure (reporting to General Counsel Meredith Tanaka with a dotted-line reporting relationship to CEO Thomas R. Cavanaugh), the designation of the Audit & Risk Committee as the board-level privacy oversight body, and the establishment of quarterly privacy reporting cadences. C&H will draft the charter in collaboration with Carolyn Marsden to ensure alignment with corporate governance best practices, Delaware corporate law requirements, and the SEC disclosure framework.
Board Meeting (November 13, 2025). C&H will prepare the board presentation memorandum for the Audit & Risk Committee meeting scheduled for November 13, 2025, at which the Privacy Governance Charter will be presented for adoption. Carolyn Marsden will advise on the form of the governance resolution, the appropriate board-meeting procedures, and any SEC-reporting considerations arising from the adoption of the charter or the broader privacy compliance program.
CPO Hiring. C&H is advising Cascade on the scope and qualifications of the permanent Chief Privacy Officer role, including the recommended reporting structure and the appropriate placement of the CPO within Cascade's organizational hierarchy. Whitfield Greaves will advise on any directors' and officers' insurance or governance-disclosure aspects of the CPO appointment, including any proxy statement disclosures that may be required if the CPO role is classified as a named executive officer position.
VIII. RISK FACTORS & CONTINGENCIES
A. Schedule Risks
The following schedule risks have been identified and should be monitored throughout Phase 1:
Thornbridge Negotiation Complexity. The restructured data-sharing agreement with Thornbridge Media Corp. represents the single largest contractual-restructuring effort within Phase 1. Thornbridge is Cascade's largest advertising and media partner, with an annual spend of $18.4 million. Thornbridge is represented by outside counsel Victor Sandoval of Kellner Park & Associates LLP, located at 555 Mission Street, 32nd Floor, San Francisco, California 94105. Based on preliminary discussions, we anticipate that Thornbridge may resist certain contractual restrictions — particularly limitations on the use of consumer personal information for Thornbridge's own independent purposes, audit-rights provisions, and data-deletion obligations. The October 31, 2025 target execution date allows approximately two months for negotiation following DPA template finalization, but the negotiation may require additional time. A portion of the $364,000 contingency buffer has been allocated to this workstream to account for potential extended negotiation cycles.
Fieldhaven Delivery Delays. C&H's CMP-deployment oversight (December 15, 2025) and DSR-workflow go-live oversight (December 1, 2025) are dependent on Fieldhaven's completion of its Milestone 2 (CMP deployed) and Milestone 3 (DSR automation live) deliverables. If Fieldhaven's milestone dates slip due to technical difficulties, resource constraints, or Cascade IT team availability issues, the corresponding C&H oversight milestones will need to be adjusted. Alan Burke will monitor Fieldhaven's progress through the weekly project calls and will escalate any delivery concerns to Kevin Ostrowski promptly.
Client Review Cycles. Timely review by Diana Polk and Meredith Tanaka of draft deliverables is critical to meeting the milestone dates set forth in the master timeline. The Phase 1 schedule assumes a maximum five-business-day turnaround for client comments on draft deliverables. Delays in client review will compress downstream timelines and may require resequencing of deliverables. Alan Burke will communicate turnaround expectations to Diana Polk at the Phase 1 kickoff meeting and will flag any review delays in the biweekly status calls.
B. Scope Risks
New State Privacy Statutes. The current Phase 1 scope encompasses 19 state privacy statutes. However, the US state-privacy landscape continues to evolve rapidly. Additional state laws may be enacted or become effective during the Phase 1 engagement period, expanding the universe of applicable statutes and requiring updates to the multi-state applicability matrix, the gap-analysis report, the omnibus privacy policy, the DPA templates, and other deliverables. As of the date of this memorandum, privacy bills are pending in several additional state legislatures and may be enacted during the 2025 legislative session. C&H will monitor legislative developments and advise Cascade promptly if new statutes become applicable.
FTC Rulemaking. Federal privacy rulemaking developments, including any action by the Federal Trade Commission on proposed commercial surveillance and data security rules, could alter the compliance requirements applicable to Cascade. While the current Phase 1 scope is limited to state privacy statutes, material federal regulatory developments during the Phase 1 period may necessitate scope adjustments.
Regulatory Inquiries. If the California Attorney General, the California Privacy Protection Agency, or other state regulators initiate new inquiries or enforcement actions against Cascade during Phase 1, the scope and priorities of the engagement may shift to address the regulatory proceeding. Any work performed in response to new regulatory inquiries or enforcement actions would be billed against the contingency buffer to the extent available. If the regulatory response work is material in scope or cost, it would be treated as out-of-scope work under the engagement letter and would be subject to separate billing arrangements to be agreed with Meredith Tanaka.
C. Budget Contingency
As noted above, approximately $364,000 is reserved within the $2,600,000 Phase 1 fee cap to address the contingency scenarios described in this Section VIII. This contingency buffer represents approximately 14% of the total fee cap.