[sheet: Cover & Administration]

[sheet: Cover & Administration]
Field | Value
Document Title | Data Retention & Disposal Schedule
Prepared For | Cascade Retail Holdings Inc. (Nasdaq: CSRD)
Client Address | 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119
EIN | 84-3192057
General Counsel / Primary Contact | Meredith Tanaka, General Counsel
Interim Chief Privacy Officer | Diana Polk, Associate General Counsel
CISO | Gregory Farris
Prepared By | Sara Hendricks, Associate, and Alan Burke, Senior Associate — Privacy & Data Security, Calderwood & Harkness LLP
Supervising Partner | Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP
Firm Address | 600 Lexington Avenue, 28th Floor, New York, NY 10022
Matter Number | 1038-00010
Date | October 2025
Version | 1.0 — Initial Schedule
Confidentiality | Privileged and Confidential — Attorney-Client Communication / Attorney Work Product
Applicable Entities | Cascade Retail Holdings Inc., Cascade Digital Marketplace LLC (EIN 85-4107638), Ridgeline Fulfillment Services Inc. (EIN 91-1647823), Peakview Analytics Inc. (EIN 87-2250194), Cascade Rewards Corp. (EIN 86-3381729)
Background | This schedule was developed to address the compliance gap identified in the Calderwood & Harkness Gap-Analysis Report dated August 15, 2025: no documented data-retention schedule existed for customer-transaction data or loyalty data. This schedule establishes retention periods for all categories of personal information processed by Cascade and its subsidiaries, covering all 19 applicable US state privacy statutes including CCPA/CPRA, VCDPA, Colorado CPA, CTDPA, UCPA, TDPSA, OCPA, and others.
Prior Privacy Policy Status | Cascade's online privacy policy was last updated March 2022 and lacked retention-period disclosures; this schedule supports the updated omnibus privacy policy dated September 12, 2025.
Next Review Date | June 30, 2026 (First Annual Privacy-Program Assessment)
[sheet: Retention Schedule]
Ref # | Data Category | Subcategory / Description | Applicable Cascade Entity | Responsible Business Unit / Owner | Responsible Executive | Types of Personal Information Included | Approximate Volume / Scale | Retention Period | Retention Start Trigger | Legal / Regulatory Basis for Retention Period | Applicable State Statutes | Disposal Method | Disposal Approval Required From | Legal-Hold Override (Yes/No) | Notes
RT-001 | Customer Transaction Data | Purchase history, order details, payment records, receipts, shipping/delivery records for e-commerce and in-store transactions | Cascade Retail Holdings Inc.; Ridgeline Fulfillment Services Inc. | Finance / E-Commerce Operations | Priya Nandakumar (VP, Data & Analytics) | Identifiers, commercial information, payment-card data (sensitive PI), shipping addresses | ~94 million annual online transactions plus in-store transactions across 186 retail locations in 31 states | 7 years from date of transaction | Date of completed transaction | IRS record-keeping requirements; state tax statutes; CCPA/CPRA retention-limitation principle (retain only as reasonably necessary) | All 19 applicable state statutes; CCPA/CPRA § 1798.100(d) | Secure deletion from production and backup systems; anonymization of aggregated analytics datasets | Finance Department Head; Interim CPO (Diana Polk) | Yes | Payment-card data (sensitive PI under CCPA/CPRA) should be tokenized/encrypted at rest; PCI-DSS retention requirements also apply
RT-002 | Loyalty Program Data | Cascade Rewards member profiles, points balances, redemption history, stored-value card balances, program enrollment data | Cascade Rewards Corp. (EIN 86-3381729) | Marketing & Customer Engagement / Loyalty Operations | Jason Leclaire (VP, Marketing & Customer Engagement) | Identifiers, commercial information, inferences, financial-incentive program data | ~41.2 million registered members across all 50 states | Duration of membership plus 3 years after account closure or inactivity | Date of account closure or last account activity | CCPA § 1798.125 financial-incentive/loyalty-program requirements; FTC guidance on loyalty programs; contractual obligations under Cascade Rewards terms | All 19 applicable state statutes; CCPA/CPRA § 1798.125 | Secure deletion; anonymization for aggregate program analytics | Loyalty Program Manager; Interim CPO (Diana Polk) | Yes | Supports CCPA financial-incentive notice disclosures in the Cascade Rewards Loyalty-Program Privacy Notice dated September 12, 2025
RT-003 | Website & Mobile App Analytics Data | Browsing behavior, clickstream data, session recordings, device identifiers, IP addresses, cookie data across 12 categories of cookies and tracking technologies on cascade.com and mobile app | Peakview Analytics Inc. (EIN 87-2250194) | Data & Analytics | Priya Nandakumar (VP, Data & Analytics) | Internet/network activity, device identifiers, inferences, geolocation (non-precise) | ~2.1 billion consumer-event data records per month | 18 months from date of collection | Date of data collection/event | CCPA/CPRA data minimization and retention-limitation principles; ePrivacy-aligned best practices for cookie/tracker data | All 19 applicable state statutes; CCPA/CPRA; Colorado CPA; CTDPA; OCPA; TDPSA | Secure deletion; anonymization/aggregation for historical trend analysis | Priya Nandakumar; Interim CPO (Diana Polk) | Yes | Cookie consent managed via OnPoint Data Solutions Inc. CMP (annual license $480,000; 3-year TCV $1,440,000); GPC signal honoring to be implemented per gap-analysis recommendations
RT-004 | Precise Geolocation Data | Precise geolocation collected through Cascade mobile app (latitude/longitude, in-store beacon data) | Peakview Analytics Inc. | Data & Analytics / Mobile App Team | Priya Nandakumar | Sensitive personal information — precise geolocation | Subset of mobile app users; volume TBD post-consent implementation | 90 days from date of collection | Date of geolocation event | CCPA/CPRA § 1798.121 (sensitive PI — requires opt-in consent); VCDPA; Colorado CPA; CTDPA sensitive-data provisions | CCPA/CPRA, VCDPA, Colorado CPA, CTDPA, TDPSA, OCPA, and other state statutes with sensitive-data provisions | Secure deletion; no anonymization (delete entirely) | CISO (Gregory Farris); Interim CPO (Diana Polk) | Yes | Gap-analysis finding: precise geolocation currently processed without required separate opt-in consent; consent flow to be implemented as part of CMP deployment (target December 15, 2025)
RT-005 | Advertising & Marketing Data | Behavioral profiles, audience segments, ad-targeting data, conversion data shared with or received from third-party advertising and analytics partners | Peakview Analytics Inc.; Cascade Retail Holdings Inc. | Marketing & Customer Engagement / Data & Analytics | Jason Leclaire; Priya Nandakumar | Identifiers, internet/network activity, inferences, commercial information | Data shared with 47 third-party ad/analytics partners (23 of 47 currently lack executed DPAs) | 12 months from date of collection or creation | Date of profile creation or data collection | CCPA/CPRA sale/sharing provisions; data minimization principles; contractual retention limits in DPA templates (service provider and contractor) | All 19 applicable state statutes | Secure deletion from Cascade systems; contractual obligation for partners to delete upon expiration of retention period or contract termination | Jason Leclaire; Interim CPO (Diana Polk) | Yes | Thornbridge Media Corp. (FY2024 spend $18.4 million) is highest-volume partner; retention terms governed by restructured data-sharing agreement (target execution October 31, 2025)
RT-006 | Employee & Job-Applicant Data | Employee personnel records, payroll data, benefits information, background checks, performance reviews, job applications, resumes, interview records | Cascade Retail Holdings Inc.; all subsidiaries | Human Resources | HR Department Head (reports to General Counsel Meredith Tanaka) | Identifiers, professional/employment information, education, financial information (payroll), sensitive PI (SSN, background-check data) | ~22,500 current employees plus applicant pool | Active employees: duration of employment plus 7 years; Applicants (not hired): 3 years from application date | Date of separation (employees); date of application (applicants) | IRS/tax record-keeping; EEOC guidance (Title VII — 1 year; ADEA — 3 years); state employment-records statutes; CCPA/CPRA employee-data provisions | CCPA/CPRA; state employment-privacy statutes in 31 states of operation | Secure deletion; physical records: secure shredding | HR Department Head; General Counsel (Meredith Tanaka) | Yes | Covered by Employee & Job-Applicant Privacy Notice dated September 12, 2025
RT-007 | Third-Party Marketplace Seller Data | Seller account registration, tax identification, transaction history, payment/disbursement records, seller communications | Cascade Digital Marketplace LLC (EIN 85-4107638) | Marketplace Operations | Marketplace Operations Lead (reports to Priya Nandakumar) | Identifiers, commercial information, tax information (EIN/SSN), financial account information | ~3,800 third-party sellers | Duration of seller relationship plus 7 years after account closure | Date of account closure or last seller transaction | IRS 1099 reporting and record-keeping; state tax requirements; CCPA/CPRA retention limitations | All 19 applicable state statutes | Secure deletion; tax records retained per IRS requirements before deletion | Marketplace Operations Lead; Finance Department; Interim CPO (Diana Polk) | Yes | Gap-analysis finding: seller data currently commingled with first-party customer data in a single data lake without role-based access controls; data segregation remediation required (see Marketplace Seller Data-Use Terms Addendum, October 2025)
RT-008 | Data Subject Request (DSR) Records | DSR intake logs, identity-verification records, response correspondence, appeal records, opt-out-of-sale/sharing signals | Cascade Retail Holdings Inc. | Legal / Privacy Office | Interim CPO (Diana Polk); CISO (Gregory Farris) | Identifiers, request metadata, verification documents, correspondence | FY2024: ~38,400 total DSRs (Access: ~12,800; Deletion: ~19,100; Opt-Out of Sale/Sharing: ~6,500); target response time ≤ 15 business days (FY2024 avg: 27 calendar days) | 3 years from date of request completion or final appeal disposition | Date of completed response or final appeal decision | CCPA/CPRA § 1798.185 (regulations require 24-month record retention of DSR metrics); extended to 3 years as best practice for enforcement-defense purposes | CCPA/CPRA; VCDPA; Colorado CPA; CTDPA; all statutes requiring appeal processes | Secure deletion | Interim CPO (Diana Polk) | Yes | DSR workflow go-live target: December 1, 2025; DSR automation implemented by Fieldhaven Consulting Group LLC
RT-009 | Consent & Preference Records | Consumer consent records (opt-in/opt-out), cookie-consent preferences, GPC signal logs, financial-incentive opt-in records | Cascade Retail Holdings Inc.; Cascade Rewards Corp. | Legal / Privacy Office; Marketing & Customer Engagement | Interim CPO (Diana Polk); Jason Leclaire | Identifiers, consent timestamps, preference selections | Applicable to all ~41.2 million loyalty members and all website/app visitors | Duration of consumer relationship plus 5 years after last interaction or consent withdrawal | Date of last consumer interaction or consent withdrawal | CCPA/CPRA; state statutes requiring demonstrable consent records; Colorado CPA universal opt-out requirements; evidentiary best practice | All 19 applicable state statutes | Secure deletion | Interim CPO (Diana Polk) | Yes | Consent records managed via OnPoint Data Solutions Inc. CMP; CMP deployment target: December 15, 2025
RT-010 | Warehousing & Logistics Data | Fulfillment records, shipping manifests, delivery confirmations, inventory-related customer data | Ridgeline Fulfillment Services Inc. (EIN 91-1647823) | Fulfillment Operations | Fulfillment Operations Lead | Identifiers, shipping addresses, order details | Supports ~94 million annual online transactions | 5 years from date of shipment/delivery | Date of delivery confirmation | UCC statute of limitations; tax/audit requirements; CCPA/CPRA retention-limitation principles | All 19 applicable state statutes | Secure deletion; physical shipping records: secure shredding | Fulfillment Operations Lead; Finance Department | Yes
RT-011 | Customer-Service & Communications Records | Customer-service chat logs, call recordings, email correspondence, complaint records | Cascade Retail Holdings Inc. | Customer Service | Customer Service Department Head | Identifiers, communication content, commercial information | All customer interactions across 186 retail locations and e-commerce | 3 years from date of last interaction | Date of interaction or case closure | State consumer-protection statutes; litigation-hold considerations; CCPA/CPRA | All 19 applicable state statutes | Secure deletion; call recordings: secure overwrite | Customer Service Head; Interim CPO (Diana Polk) | Yes
RT-012 | Account Credentials & Authentication Data | Usernames, hashed passwords, multi-factor authentication tokens, security questions | Cascade Retail Holdings Inc. | Information Security | CISO (Gregory Farris) | Sensitive personal information — account login credentials | All registered online accounts (~41.2 million loyalty members plus non-loyalty accounts) | Duration of account activity plus 1 year after account deletion or deactivation | Date of account deletion or deactivation | CCPA/CPRA § 1798.140(ae) (sensitive PI); NIST 800-63 guidelines; industry security standards | CCPA/CPRA; state statutes with sensitive-data definitions including credentials | Secure deletion (cryptographic erasure of hashed credentials) | CISO (Gregory Farris) | Yes | Passwords stored only in hashed form; raw credentials never retained
RT-013 | Privacy Impact Assessment Records | Completed PIA forms, supporting documentation, approval records | Cascade Retail Holdings Inc.; all subsidiaries | Legal / Privacy Office | Interim CPO (Diana Polk) | Internal records (may contain references to PI categories) | Ongoing; estimated 20–40 PIAs per year | Life of the product/feature/vendor relationship plus 5 years | Date product/feature is retired or vendor relationship ends | Colorado CPA, CTDPA, VCDPA data-protection assessment requirements; evidentiary best practice | Colorado CPA; CTDPA; VCDPA; TDPSA; OCPA; and other statutes requiring assessments | Secure deletion | Interim CPO (Diana Polk); General Counsel (Meredith Tanaka) | Yes | PIA Framework & Template prepared October 2025
RT-014 | Vendor & Partner Contracts (Data-Related) | Executed DPAs, data-sharing agreements, SOWs with data-handling provisions, amendment records | Cascade Retail Holdings Inc.; all subsidiaries | Legal / Procurement | General Counsel (Meredith Tanaka); Interim CPO (Diana Polk) | Contract records (may contain PI-related provisions) | 47 ad/analytics partners; OnPoint (TCV $1,440,000); Fieldhaven (SOW $3,150,000); Thornbridge ($18.4M annual spend); plus other vendors | Duration of contract plus 7 years after termination or expiration | Date of contract termination or expiration | Statute-of-limitations considerations (breach of contract); CCPA/CPRA service-provider/contractor agreement requirements | All 19 applicable state statutes | Secure archival followed by secure deletion at end of retention period | General Counsel (Meredith Tanaka) | Yes | Includes Thornbridge data-sharing agreement, OnPoint DPA rider, Fieldhaven data-protection terms, and all DPAs under the vendor DPA rollout plan
RT-015 | Regulatory Correspondence & Inquiry Records | FTC CID materials, California AG inquiry/response, other regulatory correspondence | Cascade Retail Holdings Inc. | Legal | General Counsel (Meredith Tanaka) | Legal correspondence, responsive documents, internal memos | FTC CID File No. 232-0147 (issued Sept. 14, 2023; closed Apr. 3, 2024); CA AG inquiry (Feb. 6, 2024; response Mar. 8, 2024); future inquiries | Indefinite (permanent retention unless General Counsel authorizes disposal) | N/A — permanent retention | Evidentiary preservation; regulatory-enforcement-defense; litigation-hold best practice | All applicable federal and state regulatory frameworks | N/A — permanent retention | General Counsel (Meredith Tanaka) | Yes | Prior FTC and CA AG matters are drivers for the current privacy-compliance program
RT-016 | Financial & Tax Records (Corporate) | Corporate tax filings, financial statements, audit reports, accounts payable/receivable records | Cascade Retail Holdings Inc.; all subsidiaries | Finance | Finance Department Head | Corporate financial data; may include PI incidentally (e.g., vendor contacts, employee compensation data) | All corporate financial records across 5 entities | 7 years from end of fiscal year | End of applicable fiscal year | IRS record-keeping requirements (26 USC § 6001); SEC record-keeping (for Nasdaq-listed entity); state tax statutes | Federal tax and securities law; state tax statutes in 31 states | Secure deletion; physical records: secure shredding | Finance Department Head; General Counsel (Meredith Tanaka) | Yes | Cascade is publicly traded (Nasdaq: CSRD); SEC and SOX requirements also apply
RT-017 | Children's Data (Under 16) | Any PI inadvertently collected from consumers under the age of 16 through website, mobile app, or in-store interactions | Cascade Retail Holdings Inc.; Peakview Analytics Inc. | Legal / Privacy Office; Data & Analytics | Interim CPO (Diana Polk); Priya Nandakumar | Identifiers, internet/network activity, any PI categories | Volume expected to be minimal; age-gate mechanism to be implemented | Delete immediately upon identification; no retention permitted absent verifiable parental consent | Date of identification of minor status | CCPA/CPRA § 1798.120(c) (opt-in required for sale/sharing of minors' data); COPPA (if under 13); state statutes with minor-data provisions | CCPA/CPRA; COPPA; state statutes with age-specific provisions | Immediate secure deletion | Interim CPO (Diana Polk); CISO (Gregory Farris) | Yes | Age-gate and minor-data handling procedures to be developed as part of Phase 2 (Q1 2026)
[sheet: Legal-Hold Protocols]
Ref # | Legal-Hold Trigger | Description | Responsible Party | Procedure | Release Authority | Notes
LH-001 | Litigation (Actual or Reasonably Anticipated) | Receipt of complaint, demand letter, or credible threat of litigation involving PI or data practices | General Counsel (Meredith Tanaka); outside counsel (Calderwood & Harkness LLP / Whitfield Greaves LLP) | Immediate suspension of all disposal for affected data categories; issuance of litigation-hold notice to custodians; preservation of backup media | General Counsel upon written confirmation from outside counsel that hold is no longer required | Applies across all entities and subsidiaries
LH-002 | Regulatory Investigation or Inquiry | Receipt of CID, subpoena, informal inquiry, or investigation notice from any federal or state regulator (e.g., FTC, state AG, SEC) | General Counsel (Meredith Tanaka); Interim CPO (Diana Polk) | Immediate suspension of disposal for all data categories potentially responsive; notification to Calderwood & Harkness LLP and Whitfield Greaves LLP | General Counsel upon written confirmation of investigation closure | Consistent with Cascade's experience: FTC CID (File No. 232-0147, Sept. 2023 – Apr. 2024) and CA AG inquiry (Feb. – Mar. 2024)
LH-003 | Data Breach or Security Incident | Discovery of unauthorized access, disclosure, or loss of PI triggering breach-notification obligations | CISO (Gregory Farris); General Counsel; Interim CPO | Preserve all data, logs, and forensic evidence related to the incident; suspend disposal of affected data categories; notify Northcastle Indemnity Company (cyber/privacy-liability carrier, policy: $25M per occurrence / $50M annual aggregate) via Ridgepoint Insurance Brokers Inc. (Nathan Gilroy) | CISO and General Counsel jointly, upon closure of incident investigation and completion of all notifications | Cyber/privacy-liability policy period: July 1, 2025 – June 30, 2026; annual premium $1,340,000
LH-004 | Pending or Active DSR (Access / Deletion / Correction) | Receipt of a consumer DSR that is pending processing or appeal | Interim CPO (Diana Polk); DSR Operations Team | Do not dispose of the requesting consumer's data until the request and any appeal are fully resolved; applies to all data categories associated with the consumer | DSR Operations Team upon documented completion of the request and expiration of any appeal period | DSR target response time ≤ 15 business days; appeal process required under VCDPA, Colorado CPA, CTDPA, and other state statutes
LH-005 | Audit or Internal Investigation | Initiation of internal audit, compliance investigation, or external audit by Lakemont Audit Partners LLP (engagement partner: Sheila Brogan) | General Counsel; relevant business-unit owner | Suspend disposal of data relevant to scope of audit/investigation | General Counsel upon completion of audit/investigation and final report issuance | Includes SOC 2 / privacy-controls overlap reviews coordinated with Lakemont
LH-006 | Board or Committee Directive | Directive from the Board of Directors or Audit & Risk Committee (Chair: Ellen Marchetti) to preserve specific data categories | General Counsel (Meredith Tanaka) | Implement hold as directed; document scope and duration | Board or Committee resolution releasing the hold | Privacy Governance Charter (to be adopted November 13, 2025) formalizes board oversight
LH-007 | Merger, Acquisition, or Divestiture | Announcement or initiation of any M&A transaction, corporate restructuring, or divestiture involving Cascade or any subsidiary | General Counsel (Meredith Tanaka); Finance Department Head | Suspend disposal of all data categories that may be material to the transaction or due diligence process; coordinate with transaction counsel | General Counsel upon closing or termination of the transaction | Applies to all entities; data-transfer implications under CCPA/CPRA and other state statutes to be assessed
LH-008 | Insurance Claim or Coverage Dispute | Filing of a claim under the Northcastle Indemnity cyber/privacy-liability policy or any related coverage dispute | General Counsel (Meredith Tanaka); CISO (Gregory Farris) | Preserve all data, communications, and records relevant to the claim; coordinate with Ridgepoint Insurance Brokers Inc. (Nathan Gilroy) and coverage counsel | General Counsel upon final resolution of the claim or dispute | Policy: $25M per occurrence / $50M annual aggregate; premium $1,340,000/year
[sheet: Disposal Methods Reference]
Method ID | Disposal Method | Description | Applicable Data Types | Minimum Standard / Protocol | Responsible Team | Verification Requirement
DM-001 | Secure Deletion (Electronic) | Cryptographic erasure or multi-pass overwrite of electronic records in production, staging, and backup systems | All electronic PI categories | NIST SP 800-88 Rev. 1 (Guidelines for Media Sanitization); verified by CISO team | Information Security (Gregory Farris, CISO) | Certificate of destruction retained for 3 years; spot-audited by Internal Audit
DM-002 | Anonymization / Aggregation | Irreversible de-identification rendering data not reasonably linkable to any individual consumer; satisfies CCPA/CPRA definition of 'deidentified' information | Analytics data, transaction data (for aggregate reporting), loyalty-program trend data | CCPA/CPRA § 1798.140(m) deidentification standard; reasonable technical safeguards; business processes to prevent reidentification; contractual prohibition on reidentification | Data & Analytics (Priya Nandakumar); Information Security (Gregory Farris) | Anonymization methodology documented and reviewed annually; retained anonymized data no longer considered PI
DM-003 | Secure Physical Shredding | Cross-cut shredding of paper records, physical media destruction | Physical personnel files, printed transaction records, physical shipping manifests | NIST SP 800-88 (physical media); cross-cut shredding (DIN 66399 P-4 or higher) | Facilities / HR | Certificate of destruction from approved shredding vendor; retained for 3 years
DM-004 | Contractual Deletion by Third Party | Instruction to third-party vendor or partner to delete PI pursuant to DPA or data-sharing agreement terms | PI held by 47 ad/analytics partners, OnPoint Data Solutions Inc., Fieldhaven Consulting Group LLC, Thornbridge Media Corp., marketplace sellers | Per executed DPA terms (service-provider or contractor template); written confirmation of deletion required | Legal / Privacy Office (Interim CPO Diana Polk); Procurement | Written certification of deletion from vendor; audit rights per DPA to verify
DM-005 | Cryptographic Key Destruction | Destruction of encryption keys rendering encrypted data permanently inaccessible without decrypting underlying storage media | Encrypted databases, tokenized payment-card data, hashed credential stores | NIST SP 800-57 (Key Management); key destruction logged and verified | Information Security (Gregory Farris, CISO) | Key destruction log maintained; independent verification by Internal Audit; certificate retained for 3 years
DM-006 | Secure Overwrite (Magnetic/Optical Media) | DoD 5220.22-M compliant overwrite of magnetic tapes, optical discs, and legacy storage media | Backup tapes, disaster-recovery media, archived optical storage | DoD 5220.22-M (3-pass minimum); NIST SP 800-88 Rev. 1 for media sanitization | Information Security (Gregory Farris, CISO); IT Operations | Media sanitization log; certificate of destruction retained for 3 years; physical media degaussed if overwrite not feasible
[sheet: Responsible Parties Matrix]
Retention Schedule Ref # | Data Category | Cascade Entity | Entity EIN | Business Unit | Executive Owner | Title | Backup Owner | Privacy Office Oversight
RT-001 | Customer Transaction Data | Cascade Retail Holdings Inc.; Ridgeline Fulfillment Services Inc. | 84-3192057; 91-1647823 | Finance / E-Commerce Operations | Priya Nandakumar | VP, Data & Analytics | Finance Department Head | Diana Polk (Interim CPO)
RT-002 | Loyalty Program Data | Cascade Rewards Corp. | 86-3381729 | Marketing & Customer Engagement / Loyalty Operations | Jason Leclaire | VP, Marketing & Customer Engagement | Loyalty Program Manager | Diana Polk (Interim CPO)
RT-003 | Website & Mobile App Analytics Data | Peakview Analytics Inc. | 87-2250194 | Data & Analytics | Priya Nandakumar | VP, Data & Analytics | Analytics Engineering Lead | Diana Polk (Interim CPO)
RT-004 | Precise Geolocation Data | Peakview Analytics Inc. | 87-2250194 | Data & Analytics / Mobile App | Priya Nandakumar | VP, Data & Analytics | Gregory Farris (CISO) | Diana Polk (Interim CPO)
RT-005 | Advertising & Marketing Data | Peakview Analytics Inc.; Cascade Retail Holdings Inc. | 87-2250194; 84-3192057 | Marketing & Customer Engagement / Data & Analytics | Jason Leclaire | VP, Marketing & Customer Engagement | Priya Nandakumar | Diana Polk (Interim CPO)
RT-006 | Employee & Job-Applicant Data | Cascade Retail Holdings Inc.; all subsidiaries | 84-3192057 (parent) | Human Resources | HR Department Head | — | General Counsel (Meredith Tanaka) | Diana Polk (Interim CPO)
RT-007 | Third-Party Marketplace Seller Data | Cascade Digital Marketplace LLC | 85-4107638 | Marketplace Operations | Marketplace Operations Lead | — | Priya Nandakumar | Diana Polk (Interim CPO)
RT-008 | DSR Records | Cascade Retail Holdings Inc. | 84-3192057 | Legal / Privacy Office | Diana Polk | Assoc. General Counsel (Interim CPO) | Gregory Farris (CISO) | Diana Polk (Interim CPO)
RT-009 | Consent & Preference Records | Cascade Retail Holdings Inc.; Cascade Rewards Corp. | 84-3192057; 86-3381729 | Legal / Privacy Office; Marketing | Diana Polk | Assoc. General Counsel (Interim CPO) | Jason Leclaire | Diana Polk (Interim CPO)
RT-010 | Warehousing & Logistics Data | Ridgeline Fulfillment Services Inc. | 91-1647823 | Fulfillment Operations | Fulfillment Operations Lead | — | Finance Department Head | Diana Polk (Interim CPO)
RT-011 | Customer-Service & Communications Records | Cascade Retail Holdings Inc. | 84-3192057 | Customer Service | Customer Service Department Head | — | Diana Polk (Interim CPO) | Diana Polk (Interim CPO)
RT-012 | Account Credentials & Authentication Data | Cascade Retail Holdings Inc. | 84-3192057 | Information Security | Gregory Farris | CISO | IT Operations Lead | Diana Polk (Interim CPO)
RT-013 | Privacy Impact Assessment Records | Cascade Retail Holdings Inc.; all subsidiaries | 84-3192057 (parent) | Legal / Privacy Office | Diana Polk | Assoc. General Counsel (Interim CPO) | General Counsel (Meredith Tanaka) | Diana Polk (Interim CPO)
RT-014 | Vendor & Partner Contracts (Data-Related) | Cascade Retail Holdings Inc.; all subsidiaries | 84-3192057 (parent) | Legal / Procurement | Meredith Tanaka | General Counsel | Diana Polk (Interim CPO) | Diana Polk (Interim CPO)
RT-015 | Regulatory Correspondence & Inquiry Records | Cascade Retail Holdings Inc. | 84-3192057 | Legal | Meredith Tanaka | General Counsel | Diana Polk | Diana Polk (Interim CPO)
RT-016 | Financial & Tax Records (Corporate) | Cascade Retail Holdings Inc.; all subsidiaries | 84-3192057 (parent) | Finance | Finance Department Head | — | General Counsel (Meredith Tanaka) | Diana Polk (Interim CPO)
RT-017 | Children's Data (Under 16) | Cascade Retail Holdings Inc.; Peakview Analytics Inc. | 84-3192057; 87-2250194 | Legal / Privacy Office; Data & Analytics | Diana Polk | Assoc. General Counsel (Interim CPO) | Priya Nandakumar | Diana Polk (Interim CPO)
[sheet: Statutory Cross-Reference]
State | Statute Short Name | Statute Citation | Effective Date | Data Retention / Minimization Provision | Sensitive-Data Retention Implications | Retention-Disclosure Requirement | Cascade Applicability Basis | Notes
California | CCPA/CPRA | Cal. Civ. Code §§ 1798.100–1798.199.100 | January 1, 2020 (CCPA); January 1, 2023 (CPRA amendments) | § 1798.100(d): business shall not retain PI for longer than is reasonably necessary for disclosed purpose; must disclose retention periods or criteria in privacy policy | § 1798.121: right to limit use/disclosure of sensitive PI (precise geolocation, account credentials); heightened retention scrutiny | Must disclose retention periods or criteria in privacy notice | 186 retail locations in 31 states; ~41.2 million loyalty members; ~94 million annual online transactions; revenue $3.87 billion (exceeds $25M threshold) | Primary statute driving this retention schedule; prior CA AG inquiry (Feb. 2024) highlighted disclosure deficiencies
Virginia | VCDPA | Va. Code Ann. §§ 59.1-575–59.1-585 | January 1, 2023 | Data minimization: limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes | Sensitive data requires opt-in consent; retention should reflect limited purpose | No express retention-period disclosure requirement but data minimization mandates reasonable limits | Cascade retail locations and e-commerce operations in Virginia; loyalty members in VA | Appeal-process requirement relevant to DSR record retention
Colorado | Colorado CPA | Colo. Rev. Stat. §§ 6-1-1301–6-1-1313 | July 1, 2023 | Purpose limitation and data minimization; collect only data reasonably necessary | Sensitive data (including precise geolocation) requires opt-in consent | No express retention-period disclosure mandate but purpose-limitation principle applies | Cascade retail locations and e-commerce operations in Colorado; loyalty members in CO | Universal opt-out mechanism (GPC) required
Connecticut | CTDPA | Conn. Gen. Stat. §§ 42-515–42-525 | July 1, 2023 | Purpose limitation; data minimization; limit processing to what is adequate, relevant, and reasonably necessary | Sensitive data requires opt-in consent; processing limited to disclosed purposes | No express retention-period disclosure requirement; purpose limitation implies reasonable retention | Cascade e-commerce operations and loyalty members in Connecticut | Data-protection assessment requirement applicable to high-risk processing
Utah | UCPA | Utah Code Ann. §§ 13-61-101–13-61-404 | December 31, 2023 | Purpose limitation; processing limited to what is reasonably necessary and compatible with disclosed purposes | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade retail locations and e-commerce operations in Utah; loyalty members in UT | Narrower scope than CCPA/CPRA; no private right of action
Texas | TDPSA | Tex. Bus. & Com. Code Ch. 541 | July 1, 2024 | Purpose limitation; data minimization; processing limited to reasonably necessary purposes | Sensitive data processing requires consent | No express retention-period disclosure requirement | Cascade retail locations and e-commerce in Texas; large TX consumer base
Oregon | OCPA | Or. Rev. Stat. §§ 646A.570–646A.604 | July 1, 2024 | Data minimization; purpose limitation; processing limited to what is reasonably necessary | Sensitive data (including precise geolocation) requires opt-in consent | No express retention-period disclosure requirement; purpose limitation applies | Cascade retail locations and e-commerce operations in Oregon; loyalty members in OR | Data-protection assessment requirement for targeted advertising and profiling
Montana | MCDPA | Mont. Code Ann. §§ 30-14-2801–30-14-2817 | October 1, 2024 | Purpose limitation; data minimization; limit processing to what is adequate, relevant, and reasonably necessary | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade e-commerce operations serving Montana consumers; loyalty members in MT
Iowa | Iowa CDA | Iowa Code Ch. 715D | January 1, 2025 | Purpose limitation; data minimization principles | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade e-commerce and loyalty members in Iowa | Narrower scope; limited consumer rights compared to CCPA/CPRA
Delaware | DPDPA | Del. Code Ann. tit. 6, Ch. 12D | January 1, 2025 | Purpose limitation; data minimization; processing limited to reasonably necessary purposes | Sensitive data requires opt-in consent | No express retention-period disclosure requirement; purpose limitation applies | Cascade e-commerce operations and loyalty members in Delaware | Includes universal opt-out mechanism recognition
New Hampshire | NH Privacy Act | N.H. Rev. Stat. Ann. Ch. 507-H | January 1, 2025 | Data minimization; purpose limitation; limit collection to what is adequate, relevant, and reasonably necessary | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade e-commerce operations and loyalty members in New Hampshire
New Jersey | NJ DPA | N.J. Stat. Ann. §§ 56:8-166–56:8-180 | January 15, 2025 | Purpose limitation; data minimization principles; processing limited to reasonably necessary | Sensitive data requires opt-in consent; heightened protections for minors' data | No express retention-period disclosure requirement | Cascade retail locations and e-commerce operations in New Jersey; loyalty members in NJ | Includes provisions on minors' data relevant to RT-017
Tennessee | TIPA | Tenn. Code Ann. §§ 47-18-3201–47-18-3213 | July 1, 2025 | Purpose limitation; data minimization; processing limited to what is reasonably necessary | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade retail locations and e-commerce operations in Tennessee; loyalty members in TN
Indiana | Indiana CDA | Ind. Code §§ 24-15-1–24-15-9 | January 1, 2026 | Purpose limitation; data minimization principles | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade retail locations and e-commerce operations in Indiana; loyalty members in IN | Effective January 1, 2026; proactive compliance recommended
Kentucky | KCDPA | Ky. Rev. Stat. Ann. §§ 367.400–367.499 | January 1, 2026 | Purpose limitation; data minimization; limit processing to reasonably necessary | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade e-commerce operations and loyalty members in Kentucky | Effective January 1, 2026; proactive compliance recommended
Nebraska | Nebraska DPA | Neb. Rev. Stat. §§ 87-1101–87-1116 | January 1, 2025 | Purpose limitation; data minimization principles | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade e-commerce operations and loyalty members in Nebraska
Minnesota | MCDPA (MN) | Minn. Stat. §§ 325O.01–325O.11 | July 31, 2025 | Purpose limitation; data minimization; limit collection and processing to what is reasonably necessary | Sensitive data requires opt-in consent; heightened protections | No express retention-period disclosure requirement; purpose limitation applies | Cascade retail locations and e-commerce operations in Minnesota; loyalty members in MN | Includes data-protection assessment requirements
Maryland | MODPA | Md. Code Ann., Com. Law §§ 14-4601–14-4616 | October 1, 2025 | Purpose limitation; data minimization; processing limited to what is reasonably necessary and proportionate | Sensitive data requires opt-in consent; stricter minimization for sensitive categories | No express retention-period disclosure requirement; strong purpose-limitation mandate | Cascade retail locations and e-commerce operations in Maryland; loyalty members in MD | Among the more restrictive state statutes; strict data-minimization standard
Rhode Island | RI DPA | R.I. Gen. Laws §§ 6-48.1-1–6-48.1-12 | January 1, 2026 | Purpose limitation; data minimization principles | Sensitive data requires opt-in consent | No express retention-period disclosure requirement | Cascade e-commerce operations and loyalty members in Rhode Island | Effective January 1, 2026; proactive compliance recommended