PRIVILEGED AND CONFIDENTIAL ATTORNEY-CLIENT COMMUNICATION / ATTORNEY WORK PRODUCT
DATA SUBJECT REQUEST (DSR) STANDARD OPERATING PROCEDURES
Prepared for Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Prepared by Calderwood & Harkness LLP 1401 Second Avenue, Suite 3800 Seattle, WA 98101
October 2025
This document has been prepared by Calderwood & Harkness LLP at the direction of and for the exclusive use of Cascade Retail Holdings Inc. and its subsidiaries. This document constitutes a privileged and confidential attorney-client communication and attorney work product. It is not intended for distribution to, or reliance by, any third party without the prior written consent of Calderwood & Harkness LLP and Cascade Retail Holdings Inc. Disclosure of this document to any third party may result in a waiver of applicable privileges.
Right-click to update Table of Contents
Section 1: Purpose and Scope
1.1 Purpose
These Data Subject Request Standard Operating Procedures (the "SOPs" or "Procedures") establish standardized, enterprise-wide procedures for receiving, verifying, processing, responding to, and tracking consumer data-subject requests ("DSRs") across all Cascade Retail Holdings Inc. ("Cascade" or the "Company") business units and subsidiaries. The SOPs are designed to provide a unified operational framework that ensures consistent, timely, and legally compliant handling of all consumer privacy requests, regardless of the intake channel, the requesting consumer's state of residence, or the Cascade entity that holds the responsive personal information.
These Procedures are designed to ensure that Cascade achieves and maintains compliance with all nineteen (19) applicable United States state privacy statutes, including, without limitation, the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("Colorado CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Utah Consumer Privacy Act ("UCPA"), the Iowa Consumer Data Protection Act ("ICDPA"), the Indiana Consumer Data Protection Act ("INCDPA"), the Tennessee Information Protection Act ("TIPA"), the Montana Consumer Data Privacy Act ("Montana MCDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), the Delaware Personal Data Privacy Act ("DPDPA"), the New Jersey Data Privacy Act ("NJDPA"), the New Hampshire Data Privacy Act ("NHDPA"), the Nebraska Data Privacy Act ("NDPA"), the Minnesota Consumer Data Privacy Act ("Minnesota MCDPA"), the Maryland Online Data Privacy Act ("MODPA"), the Kentucky Data Privacy Act ("KYDPA"), and additional state privacy statutes enacted or effective through the 2025–2026 legislative cycle. As new state privacy statutes take effect, these SOPs will be updated in accordance with the review cycle described in Section 15.2 below.
These SOPs are further designed to address the specific compliance gaps identified in the Calderwood & Harkness LLP Gap-Analysis Report dated August 15, 2025 (the "Gap-Analysis Report"), which was delivered to Diana Polk and Meredith Tanaka. The Gap-Analysis Report identified, among other findings, that Cascade's prior consumer-facing DSR portal lacked identity-verification procedures meeting the standards set forth in the CCPA implementing regulations (Cal. Code Regs. tit. 11, §§ 7060–7064). In addition, the prior DSR process did not include the appeal-process functionality required by the VCDPA, Colorado CPA, CTDPA, and other state statutes that afford consumers the right to appeal a denial of a data-subject request. These SOPs remedy both deficiencies through the tiered identity-verification framework set forth in Section 5 and the appeal process established in Section 7.
Finally, these Procedures address the operational performance gap relating to DSR response times. Internal metrics for fiscal year 2024 ("FY2024") reflected an average DSR response time of twenty-seven (27) calendar days across all request types. While this average fell within the statutory maximum response windows under most applicable state laws, it left insufficient margin for error and provided a suboptimal consumer experience. These SOPs establish a maximum internal response-time target of fifteen (15) business days or less for all request types, measured from receipt of a verifiable consumer request (or from successful identity verification, where post-intake verification is required). This target is designed to provide a substantial compliance buffer before the forty-five (45) calendar-day statutory deadlines under the CCPA/CPRA and other applicable state laws, and to significantly improve Cascade's responsiveness to consumer privacy requests.
1.2 Scope — Covered Entities
These SOPs apply to the following entities, each of which is a subsidiary or affiliate of Cascade Retail Holdings Inc. and processes personal information of consumers in the ordinary course of its business operations:
1. Cascade Retail Holdings Inc. — The parent company and publicly traded entity (incorporated in the State of Delaware; Nasdaq ticker symbol: CSRD; corporate headquarters located at 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119). Cascade Retail Holdings Inc. operates direct-to-consumer retail and e-commerce operations, including the cascade.com website and the Cascade mobile application.
2. Cascade Digital Marketplace LLC ("CDM") — A wholly owned subsidiary operating the third-party seller marketplace accessible at cascade.com/marketplace. CDM facilitates transactions between approximately 3,800 third-party sellers and consumers. CDM processes personal information of both consumers who purchase through the marketplace and the third-party sellers themselves (to the extent such sellers are natural persons or sole proprietors whose data constitutes personal information under applicable state law).
3. Ridgeline Fulfillment Services Inc. ("Ridgeline") — A wholly owned subsidiary providing warehousing, order-fulfillment, and logistics services for Cascade's direct retail operations and, in certain cases, for CDM third-party sellers enrolled in the Fulfillment-by-Cascade program. Ridgeline processes personal information related to shipping addresses, delivery records, and fulfillment-related communications.
4. Peakview Analytics Inc. ("Peakview") — A wholly owned subsidiary providing advertising-technology services and customer-analytics capabilities to the Cascade enterprise. Peakview operates a centralized data lake that processes approximately 2.1 billion consumer-event data records per month, including browsing behavior, purchase history, geolocation data, and inferences derived from such data. Peakview's data-processing activities are particularly relevant to DSRs involving the right to access, the right to delete, the right to opt out of sale or sharing, and the right to limit use of sensitive personal information.
5. Cascade Rewards Corp. ("Cascade Rewards") — A wholly owned subsidiary administering the Cascade Rewards loyalty and stored-value card programs. Cascade Rewards maintains a registered-member base of approximately 41.2 million members as of the date of these SOPs. The Cascade Rewards program collects and processes personal information including member names, contact information, purchase history, stored-value card balances, and program-tier status.
All references to "Cascade" or the "Company" in these SOPs shall be understood to encompass each of the entities listed above unless the context clearly requires otherwise. Where a DSR involves personal information held by multiple Cascade entities, the DSR Response Team (as defined in Section 3.3) is responsible for coordinating a unified response that addresses all responsive data across all applicable entities.
1.3 Scope — Covered Request Types
These SOPs govern the processing of the following categories of consumer data-subject requests, each of which corresponds to one or more consumer rights established under applicable state privacy statutes:
• Right to Know / Access — The consumer's right to request that the business disclose the categories or specific pieces of personal information it has collected about the consumer, the categories of sources from which the personal information was collected, the business or commercial purposes for collecting, selling, or sharing the personal information, and the categories of third parties to whom the personal information was disclosed, sold, or shared.
• Right to Delete — The consumer's right to request that the business delete personal information about the consumer that the business has collected from the consumer, subject to statutory exceptions.
• Right to Correct — The consumer's right to request that the business correct inaccurate personal information that it maintains about the consumer.
• Right to Opt-Out of Sale or Sharing of Personal Information — The consumer's right to direct a business that sells or shares the consumer's personal information to stop selling or sharing the consumer's personal information. This includes opt-out requests submitted through the "Do Not Sell or Share My Personal Information" link, as well as opt-out signals communicated through the Global Privacy Control ("GPC") or other universal opt-out mechanisms recognized under applicable state law.
• Right to Limit Use and Disclosure of Sensitive Personal Information — The consumer's right to direct a business that uses or discloses the consumer's sensitive personal information for purposes beyond those necessary to perform the services or provide the goods reasonably expected by the consumer to limit its use of such information to those permitted purposes.
• Right to Appeal — The consumer's right to appeal a denial or partial denial of a data-subject request, as required by the VCDPA, Colorado CPA, CTDPA, and other state statutes. The appeal process is described in detail in Section 7.
• Right to Data Portability — Where applicable under state law, the consumer's right to obtain a copy of their personal information in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance.
• Authorized Agent Requests — Requests submitted on behalf of a consumer by an authorized agent, subject to the verification requirements described in Section 5.3.
1.4 Scope — Requestor Categories
These SOPs cover DSRs submitted by or on behalf of the following categories of requestors:
• Consumers and customers — Natural persons who interact with Cascade through its retail locations, the cascade.com e-commerce website, or the Cascade mobile application, whether or not they maintain a registered account.
• Cascade Rewards loyalty-program members — Registered members of the Cascade Rewards loyalty and stored-value card programs administered by Cascade Rewards Corp.
• Cascade Digital Marketplace third-party sellers — Natural persons who operate as third-party sellers on the CDM marketplace, to the extent such sellers submit DSRs relating to their own personal information (as distinguished from consumer transaction data).
• Website visitors and mobile-app users — Natural persons who browse cascade.com, the CDM marketplace, or the Cascade mobile application without completing a purchase or creating a registered account, but whose personal information (such as browsing history, device identifiers, IP addresses, and cookie data) is collected through Cascade's digital properties.
Note: Employee and job-applicant data-subject requests are not covered by these SOPs. Requests from employees and job applicants relating to their personal information are governed by the separate Employee & Job-Applicant Privacy Standard Operating Procedures, which are being developed concurrently and are cross-referenced to the Cascade Retail Holdings Inc. Employee & Job-Applicant Privacy Notice. Personnel who receive a DSR from an employee or job applicant should direct the requestor to the Human Resources Department and notify the DSR Response Team Lead so that the request can be routed appropriately.
1.5 Regulatory Context
These SOPs are developed against the backdrop of Cascade's substantial and growing DSR processing volume and a regulatory environment that requires heightened attention to procedural compliance.
DSR Volume. During fiscal year 2024, Cascade received a total of approximately 38,400 data-subject requests across all intake channels and request types. Of these, approximately 12,800 were right-to-know/access requests, approximately 19,100 were deletion requests, and approximately 6,500 were opt-out-of-sale/sharing requests. Given the increasing number of state privacy statutes taking effect in 2025 and 2026, and Cascade's continued growth in e-commerce and loyalty-program membership, DSR volumes are expected to increase materially in FY2025 and beyond.
California Attorney General Inquiry. On February 6, 2024, the California Attorney General's Office sent an informal inquiry letter to Cascade Retail Holdings Inc. regarding certain aspects of Cascade's compliance with the CCPA/CPRA. The inquiry highlighted potential deficiencies in (a) the functionality and prominence of Cascade's "Do Not Sell or Share My Personal Information" link on cascade.com, and (b) the adequacy of Cascade's service-provider agreements with respect to the contractual provisions required under the CCPA/CPRA. Cascade, with the assistance of Calderwood & Harkness LLP, responded to the inquiry on March 8, 2024, detailing remediation steps being undertaken. No enforcement action was taken by the California Attorney General's Office. The deficiencies identified in the inquiry have informed the design of the opt-out mechanisms and vendor-notification procedures set forth in these SOPs, as well as the ongoing Vendor DPA Rollout Plan.
FTC Civil Investigative Demand. On September 14, 2023, the Federal Trade Commission issued a Civil Investigative Demand ("CID") to Cascade Retail Holdings Inc. (FTC File No. 232-0147) relating to allegations of dark-pattern design elements in the unsubscribe and opt-out flow within the Cascade mobile application. Calderwood & Harkness LLP represented Cascade in responding to the CID. The investigation was closed on April 3, 2024, with no enforcement action taken. The lessons learned from the FTC investigation have directly informed the design of Cascade's consumer-facing DSR portal, opt-out webform, and GPC implementation to ensure that all consumer-facing privacy controls are clear, conspicuous, and free of manipulative design elements.
Section 2: Definitions
The following defined terms are used throughout these SOPs. Where a term is defined by reference to a specific statute, the definition is harmonized to the extent practicable across all nineteen (19) applicable state privacy statutes. In the event of a conflict between statutory definitions, the most protective or expansive definition applicable to the consumer's state of residence shall govern.
"Personal Information" or "PI" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined under CCPA/CPRA Section 1798.140(v) and harmonized with equivalent definitions under all applicable state privacy statutes. Personal Information includes, without limitation, identifiers (such as real names, aliases, postal addresses, email addresses, account names, Social Security numbers, driver's license numbers, passport numbers, and unique personal identifiers), commercial information (including records of personal property, products or services purchased, obtained, or considered, and purchasing or consuming histories or tendencies), internet or other electronic-network activity information (including browsing history, search history, and information regarding a consumer's interaction with cascade.com, the CDM marketplace, or the Cascade mobile application), precise geolocation data (derived from the Cascade mobile application, as described further in the definition of Sensitive Personal Information below), audio, electronic, visual, or similar information, professional or employment-related information, education information, and inferences drawn from any of the above to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
"Sensitive Personal Information" or "SPI" means personal information that reveals or contains a consumer's Social Security number, driver's license number, state identification card number, or passport number; account log-in credentials (including usernames and passwords or security questions and answers); financial account numbers, debit card numbers, or credit card numbers in combination with any required security or access code, password, or credentials allowing access to a financial account; precise geolocation (defined as the location of a consumer derived from the Cascade mobile application with specificity sufficient to identify street-level location or locations within a 1,850-foot radius); racial or ethnic origin; religious or philosophical beliefs; union membership; the contents of a consumer's mail, email, or text messages (unless the business is the intended recipient); genetic data; biometric information (not currently collected by Cascade); and information concerning a consumer's health, sex life, or sexual orientation. This definition is consistent with CCPA/CPRA Section 1798.140(ae) and analogous definitions under applicable state privacy statutes. As of the date of these SOPs, the categories of Sensitive Personal Information processed by Cascade in the ordinary course of business that are most relevant to DSR processing include payment-card data (processed across all Cascade retail and e-commerce channels), precise geolocation data (collected through the Cascade mobile application), and account login credentials (maintained for cascade.com accounts and Cascade Rewards member accounts).
"Consumer" or "Data Subject" means a natural person who is a resident of an applicable United States state and whose personal information is collected, processed, sold, or shared by Cascade or any of its subsidiaries. For purposes of these SOPs, the term "consumer" is used consistent with the CCPA/CPRA and is intended to encompass analogous terms used in other state statutes (e.g., "consumer" under the VCDPA, CTDPA, and TDPSA).
"Verifiable Consumer Request" means a request made by a consumer, or on behalf of a consumer by an authorized agent, that Cascade can reasonably verify pursuant to the identity-verification procedures set forth in Section 5 of these SOPs. The concept of a verifiable consumer request is derived from the CCPA/CPRA and its implementing regulations and is applied uniformly across all DSRs processed under these SOPs.
"Authorized Agent" means a natural person or a business entity that a consumer has authorized to act on the consumer's behalf with respect to a data-subject request. An authorized agent must be registered with the applicable Secretary of State (where required by state law, such as California) and must present written authorization signed by the consumer, or a valid power of attorney executed under applicable state law. The verification requirements for authorized-agent requests are set forth in Section 5.3.
"Service Provider" or "Processor" means any legal entity that processes personal information on behalf of Cascade pursuant to a written contract that restricts the entity's use of such personal information to the purposes specified in the contract, as defined under the CCPA/CPRA and applicable state privacy statutes. The contractual terms governing service providers and processors are set forth in Cascade's Master Data Processing Agreement Templates (Service Provider version and Contractor version), which were finalized on September 30, 2025. Cross-reference to Master DPA Templates for detailed provisions.
"DSR Automation Tool" means the cloud-based automated workflow management system designed, deployed, and maintained by Fieldhaven Consulting Group LLC ("Fieldhaven") as part of Milestone 3 of the Fieldhaven Statement of Work (the "Fieldhaven SOW"). Milestone 3 carries a fixed-fee value of $1,102,500 within the total Fieldhaven SOW value of $3,150,000. The DSR Automation Tool is integrated with Cascade's consumer-facing DSR portal at cascade.com/privacy/request and provides centralized intake, routing, tracking, and reporting capabilities for all DSRs processed under these SOPs. The target go-live date for the DSR Automation Tool is December 1, 2025.
"Consent-Management Platform" or "CMP" means the software-as-a-service platform provided by OnPoint Data Solutions Inc. ("OnPoint") that manages consumer consent preferences, cookie controls, and opt-out signals on cascade.com and the Cascade mobile application. The OnPoint CMP is deployed under a three-year SaaS agreement with an annual license fee of $480,000 (total contract value: $1,440,000). The target deployment date for the OnPoint CMP is December 15, 2025. The CMP is integrated with the DSR Automation Tool to enable bidirectional synchronization of consumer opt-out preferences and GPC signal processing.
"Global Privacy Control" or "GPC" means the browser-level privacy signal specified by the Global Privacy Control technical specification (https://globalprivacycontrol.org/) that communicates a consumer's request to opt out of the sale or sharing of their personal information. Under the CCPA/CPRA and applicable state privacy statutes (including, without limitation, the Colorado CPA, CTDPA, TDPSA, and OCPA), a GPC signal must be honored as a valid opt-out-of-sale/sharing request. cascade.com and the Cascade mobile application will be configured, through the OnPoint CMP, to detect and honor GPC signals automatically and without requiring additional identity verification from the consumer.
"Appeal" means a consumer's formal request for reconsideration of a decision by Cascade to deny or partially deny a data-subject request. The right to appeal is established by the VCDPA, Colorado CPA, CTDPA, and other state privacy statutes. The procedures governing appeals are set forth in Section 7 of these SOPs.
"Business Unit Data Steward" means the designated individual within each Cascade subsidiary (CDM, Ridgeline, Peakview, and Cascade Rewards) who is responsible for locating, retrieving, and acting upon personal information within that subsidiary's data systems in response to DSRs routed through the DSR Automation Tool. Business Unit Data Stewards are identified in the DSR Automation Tool and receive task assignments and deadline notifications through the platform.
Section 3: Roles and Responsibilities
Effective DSR processing requires clearly defined roles and responsibilities across multiple functions within Cascade and among its external advisors and technology partners. This Section identifies the individuals and teams responsible for the key elements of the DSR program and delineates their respective authorities and obligations.
3.1 Interim Chief Privacy Officer — Diana Polk
Diana Polk, Associate General Counsel, serves as the Interim Chief Privacy Officer ("Interim CPO") for Cascade Retail Holdings Inc. and all subsidiaries. In this capacity, Ms. Polk bears overall accountability for the compliance and effectiveness of the DSR program established by these SOPs. Her specific responsibilities include:
• Serving as the senior-most Cascade executive with direct accountability for day-to-day DSR program compliance, including adherence to the fifteen (15) business-day internal response-time target.
• Functioning as the primary escalation point for complex, high-risk, or novel DSRs, including requests involving potential regulatory implications, media exposure, or conflicts between state statutory requirements.
• Overseeing the DSR Response Team and Business Unit Data Stewards and ensuring that all personnel involved in DSR processing have received the required training described in Section 13.
• Approving any extension of the response period beyond the internal fifteen (15) business-day target and ensuring that the consumer is notified of such extension within the initial response period.
• Reviewing quarterly DSR metrics reports and presenting findings to the General Counsel and, through the quarterly privacy-program reporting process, to the Audit & Risk Committee of the Board of Directors.
• Coordinating with Calderwood & Harkness LLP on legal questions arising from DSR processing.
Ms. Polk serves in this role on an interim basis pending the hiring of a full-time Chief Privacy Officer, which is targeted for the fourth quarter of 2025. Upon the appointment of a permanent CPO, the responsibilities described in this Section 3.1 will transfer to the permanent CPO, and these SOPs will be updated accordingly. Ms. Polk reports to the General Counsel, Meredith Tanaka, with a dotted-line reporting relationship to the Chief Executive Officer, Thomas R. Cavanaugh, for privacy-program matters requiring C-suite attention.
3.2 General Counsel — Meredith Tanaka
Meredith Tanaka, General Counsel of Cascade Retail Holdings Inc., provides executive oversight of the DSR program and serves as the liaison between the Company and Calderwood & Harkness LLP on all privacy and data-security matters. Her specific responsibilities include:
• Exercising final decision-making authority on contested DSRs, appeals involving novel legal questions, and DSR-related matters with potential litigation or regulatory implications.
• Supervising Diana Polk in her capacity as Interim CPO and ensuring that the DSR program is adequately resourced, staffed, and supported.
• Receiving and reviewing escalated DSR matters from Ms. Polk and determining, in consultation with outside counsel, the appropriate course of action.
• Coordinating with Calderwood & Harkness LLP on regulatory inquiries, enforcement actions, or litigation arising from or relating to DSR processing.
• Presenting privacy-program updates, including DSR metrics and compliance posture, to the Board of Directors and the Audit & Risk Committee as required.
3.3 Legal Department — DSR Response Team
The DSR Response Team is a dedicated team within the Cascade Legal Department responsible for the day-to-day processing of data-subject requests. The DSR Response Team is supervised by Diana Polk (Interim CPO) and consists of legal staff and trained analysts who manage DSR intake, identity verification, request processing, response preparation, and appeal handling. The specific responsibilities of the DSR Response Team include:
• Monitoring all DSR intake channels (online portal, toll-free telephone line, email, in-store submissions, and GPC signals) and ensuring that all incoming requests are logged into the DSR Automation Tool within one (1) business day of receipt.
• Conducting identity verification in accordance with the tiered verification framework described in Section 5.
• Coordinating with Business Unit Data Stewards across all Cascade subsidiaries to locate, retrieve, and compile responsive personal information.
• Preparing and delivering consumer-facing responses using the standardized templates set forth in Appendix C.
• Processing appeals in accordance with Section 7 and ensuring separation of duties between the original request handler and the appeal reviewer.
• Documenting all processing actions, decisions, and communications in the DSR Automation Tool for audit-trail and record-keeping purposes.
• Generating monthly and quarterly DSR metrics reports for review by Diana Polk and submission to the Audit & Risk Committee.
3.4 Chief Information Security Officer — Gregory Farris
Gregory Farris, Chief Information Security Officer ("CISO"), is responsible for the information-security controls that support the DSR program. His specific responsibilities include:
• Overseeing the design, implementation, and maintenance of technical identity-verification controls integrated into the DSR Automation Tool and the consumer-facing DSR portal.
• Ensuring the security of DSR data in transit and at rest, including enforcement of encryption standards (TLS 1.2+ for data in transit; AES-256 for data at rest) and role-based access controls.
• Serving as the parallel escalation point for any DSR that reveals or is associated with a potential security incident, data breach, or unauthorized access to personal information.
• Coordinating with the DSR Response Team and Diana Polk in the event that a DSR raises concerns about identity-verification fraud, account compromise, or social-engineering attempts.
• Reviewing and approving the data-security architecture of the DSR Automation Tool and the OnPoint CMP to ensure compliance with Cascade's enterprise information-security policies and applicable regulatory requirements.
3.5 VP, Data & Analytics — Priya Nandakumar
Priya Nandakumar, Vice President of Data & Analytics, is responsible for the technical execution of data-retrieval, deletion, and correction operations across Cascade's data systems. Her specific responsibilities include:
• Directing the identification and retrieval of personal information responsive to right-to-know/access requests across all relevant data systems, including the Peakview Analytics data lake, e-commerce platform databases, and CDM marketplace data stores.
• Ensuring the accuracy and completeness of the enterprise data map, as documented in the Fieldhaven data-mapping report dated May 19, 2025, and maintaining an up-to-date inventory of all data systems that process consumer personal information.
• Overseeing the technical execution of deletion requests within analytics systems, including the permanent removal or de-identification of consumer records from the Peakview data lake and associated inference models.
• Overseeing the technical execution of correction requests, ensuring that corrected data is propagated across all relevant systems.
• Coordinating with Business Unit Data Stewards to ensure that data-retrieval tasks routed through the DSR Automation Tool are completed accurately and within the internal timeline.
3.6 VP, Marketing & Customer Engagement — Jason Leclaire
Jason Leclaire, Vice President of Marketing & Customer Engagement, is responsible for the marketing-function components of DSR processing, with particular emphasis on opt-out-of-sale/sharing requests and loyalty-program data requests. His specific responsibilities include:
• Coordinating the implementation of consumer opt-out-of-sale/sharing requests within Cascade's advertising-technology stack, including suppression of consumer data from programmatic-advertising platforms, behavioral-targeting systems, and cross-context behavioral-advertising data flows.
• Managing the distribution and maintenance of suppression lists across all forty-seven (47) third-party advertising and analytics partners with whom Cascade shares consumer personal information.
• Coordinating with the Peakview Analytics team to ensure that opt-out instructions are applied consistently across all advertising-related data-processing activities.
• Managing DSRs that involve Cascade Rewards loyalty-program data, including access requests, deletion requests, and requests relating to financial-incentive disclosures under CCPA/CPRA Section 1798.125.
• Serving as the primary point of contact for DSR-related communications with Thornbridge Media Corp. regarding the restructured Data-Sharing Agreement.
3.7 Fieldhaven Consulting Group LLC (Technical Implementer)
Fieldhaven Consulting Group LLC ("Fieldhaven") is the external technology-consulting firm retained by Cascade to design, deploy, and support the DSR Automation Tool and related privacy-technology infrastructure. The Fieldhaven engagement is governed by the Fieldhaven Statement of Work, with a total fixed-fee engagement value of $3,150,000. The engagement lead is Marcus Ellerby. Fieldhaven's responsibilities under these SOPs include:
• Deploying, configuring, and maintaining the DSR Automation Tool, including all intake-channel integrations, workflow engines, deadline-tracking modules, and reporting dashboards, in accordance with Milestone 3 of the Fieldhaven SOW (Milestone 3 value: $1,102,500).
• Integrating the DSR Automation Tool with the OnPoint CMP to enable automated processing of GPC signals and bidirectional synchronization of consumer opt-out preferences.
• Providing post-deployment technical support, bug fixes, and system enhancements in accordance with the maintenance and support terms of the Fieldhaven SOW.
• Supporting Cascade's IT and data-analytics teams in configuring cross-system data-retrieval queries to ensure comprehensive coverage of all data systems identified in the enterprise data map.
3.8 Outside Counsel — Calderwood & Harkness LLP
Calderwood & Harkness LLP serves as outside counsel to Cascade Retail Holdings Inc. on privacy and data-security matters, including the development and implementation of the DSR program. The Calderwood & Harkness team assigned to this matter includes:
• Kevin Ostrowski, Partner — Responsible Partner overseeing all privacy and data-security advisory work for Cascade. Mr. Ostrowski is the primary escalation contact for DSR matters involving significant regulatory risk, multi-state jurisdictional conflicts, or potential enforcement action.
• Alan Burke, Senior Associate — Lead Associate for day-to-day privacy advisory support, including review of DSR processing decisions, appeal outcomes, and vendor-agreement negotiations. Mr. Burke reviewed and approved Version 1.0 of these SOPs.
• Sara Hendricks, Associate — Primary drafter of these SOPs, the Employee Privacy Training Program, and other privacy-program documentation. Ms. Hendricks provides ongoing advisory support on DSR processing questions and multi-state compliance issues.
Calderwood & Harkness LLP provides advisory support on novel or complex DSR legal questions, appeals with potential regulatory implications, and multi-state jurisdictional issues. All communications with Calderwood & Harkness LLP regarding specific DSR matters are privileged attorney-client communications and should be treated accordingly.
3.9 Business Unit Data Stewards
Each Cascade subsidiary has designated one or more Business Unit Data Stewards who are responsible for locating, retrieving, and acting upon personal information within their respective data systems in response to DSR tasks routed through the DSR Automation Tool. Business Unit Data Stewards are the operational link between the centralized DSR Response Team and the decentralized data systems maintained by each subsidiary. Their responsibilities include:
• Receiving and responding to data-retrieval, deletion, correction, and suppression tasks assigned through the DSR Automation Tool within the timelines specified by the system's deadline-tracking module.
• Confirming the completion of assigned tasks within the DSR Automation Tool, including documenting any exceptions, anomalies, or issues encountered during processing.
• Maintaining familiarity with the data systems, data flows, and data-retention practices within their respective business units.
• Participating in required training (see Section 13) and cooperating with internal QA reviews and external audits.
Business Unit Data Stewards are designated for each of the following entities: Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. The identities and contact information of current Business Unit Data Stewards are maintained in the DSR Automation Tool and in the Escalation Contact List attached as Appendix G.
Section 4: DSR Intake Channels
Cascade offers multiple channels through which consumers may submit data-subject requests, in accordance with the CCPA/CPRA and other applicable state privacy statutes. These channels are designed to be accessible, easy to use, and free of charge. All intake channels feed into the centralized DSR Automation Tool, which serves as the system of record for all DSR processing activities.
4.1 Online DSR Portal
The primary intake channel for consumer DSRs is the online DSR portal, accessible at cascade.com/privacy/request. The portal is a consumer-facing webform integrated with the Fieldhaven-implemented DSR Automation Tool. The online portal is available twenty-four (24) hours per day, seven (7) days per week, and is accessible via direct navigation or through links provided in the Cascade omnibus privacy policy, the California-Specific Disclosures Addendum, the "Do Not Sell or Share My Personal Information" link, and the "Limit the Use of My Sensitive Personal Information" link, each of which is posted on cascade.com and the Cascade mobile application.
The webform captures the following information from the requestor:
• Requestor full name
• Email address
• Phone number (optional but recommended for verification purposes)
• Mailing address (optional)
• State of residence
• Cascade Rewards member ID (if applicable)
• Request type (selected via dropdown menu: Right to Know/Access — Categories; Right to Know/Access — Specific Pieces; Right to Delete; Right to Correct; Right to Opt Out of Sale/Sharing; Right to Limit Use of Sensitive Personal Information; Appeal of Prior Decision)
• Description / additional details (free-text field)
• Authorized-agent designation (yes/no toggle; if yes, fields for agent name, relationship to consumer, and upload of authorization documentation)
• Upload field for supporting documentation (e.g., signed declaration under penalty of perjury for specific-pieces requests, authorization letter for agent requests, documentation of alleged inaccuracy for correction requests)
• Declaration under penalty of perjury checkbox (displayed when request type is "Right to Know/Access — Specific Pieces" or when the requestor's identity cannot be verified through standard data-point matching)
The online DSR portal is the preferred intake channel and should be promoted as the primary method for consumers to submit DSRs. The portal is designed in compliance with accessibility standards (WCAG 2.1 Level AA) and is free of dark patterns or deceptive design elements, consistent with the lessons learned from the FTC CID (File No. 232-0147).
4.2 Toll-Free Telephone Number
Cascade maintains a dedicated toll-free privacy-request telephone line for consumers who prefer to submit DSRs by phone or who require assistance navigating the online portal. The toll-free line is staffed by trained intake agents during business hours: 8:00 AM to 6:00 PM Pacific Time, Monday through Friday, excluding Company-observed holidays. Calls received outside of business hours are routed to a recorded message directing the consumer to the online portal or advising them to call back during business hours.
Trained intake agents are responsible for collecting the same information captured by the online webform (requestor name, email, state of residence, request type, description, and authorized-agent designation if applicable) and entering the request into the DSR Automation Tool in real time during the call. The intake agent confirms the information with the requestor before ending the call and provides the requestor with a reference number for tracking purposes.
The toll-free telephone line satisfies the CCPA/CPRA requirement that businesses that operate primarily online provide at least two designated methods for consumers to submit requests, including a toll-free telephone number (for businesses that operate offline) or a webform. While Cascade's primary commercial operations include both online and offline retail, the toll-free line is offered as an additional channel to ensure maximum accessibility.
4.3 Email
Consumers may submit DSRs by sending an email to the dedicated privacy email address: privacy@cascade.com. This email address is published in the Cascade omnibus privacy policy, the California-Specific Disclosures Addendum, and other consumer-facing privacy disclosures. The privacy@cascade.com inbox is monitored by the DSR Response Team during business hours.
All DSR-related emails received at privacy@cascade.com are entered into the DSR Automation Tool within one (1) business day of receipt. If the email contains sufficient information to initiate processing (requestor identity, state of residence, and request type), the request is logged and the verification process begins. If the email lacks sufficient information, the DSR Response Team contacts the requestor within two (2) business days to request the additional information needed to process the request.
4.4 In-Store Requests
Consumers may submit DSRs at any of Cascade's one hundred eighty-six (186) retail locations across thirty-one (31) states. Retail store associates are trained to handle in-store DSR requests by directing consumers to the online portal (via an in-store tablet or the consumer's mobile device) or by providing the toll-free telephone number. In cases where the consumer prefers to submit the request on paper, the store associate may complete a standardized paper intake form (the "In-Store DSR Intake Form") on the consumer's behalf, capturing the same information as the online webform.
Completed In-Store DSR Intake Forms are transmitted by the store manager to the DSR Response Team via secure internal email within one (1) business day of receipt. The DSR Response Team enters the request into the DSR Automation Tool and begins the verification and processing workflow. Store associates are not authorized to verify consumer identities, fulfill DSRs, or make any representations regarding the outcome of a request. Their role is limited to facilitating intake and directing consumers to the appropriate channels.
In-store DSR training is included in the training requirements described in Section 13, which apply to all retail store associates who may encounter in-store DSRs.
4.5 Global Privacy Control (GPC) / Universal Opt-Out signals
Cascade will configure cascade.com and the Cascade mobile application, through the OnPoint CMP (target deployment: December 15, 2025), to detect and honor Global Privacy Control ("GPC") browser-level signals and other recognized universal opt-out mechanisms. GPC is a technical specification that enables consumers to communicate their privacy preferences through their web browser or mobile-device settings, signaling to websites and applications that the consumer opts out of the sale or sharing of their personal information.
Under the CCPA/CPRA implementing regulations, a GPC signal must be treated as a valid request by the consumer to opt out of the sale and sharing of personal information. Multiple other state privacy statutes, including the Colorado CPA, CTDPA, TDPSA, and OCPA, similarly require or will require businesses to honor recognized universal opt-out mechanisms.
When the OnPoint CMP detects a GPC signal, the system will automatically suppress the sale and sharing of personal information associated with the requesting consumer's browser or device, in real time, without requiring any further action by the consumer. No additional identity verification is required for GPC-based opt-outs, consistent with CCPA/CPRA regulations. Each GPC-triggered opt-out is logged automatically in the DSR Automation Tool for metrics, audit, and compliance-reporting purposes.
This functionality directly addresses a compliance gap identified in the Gap-Analysis Report: as of the date of that report, Cascade did not honor any universal opt-out mechanism, including GPC. The deployment of the OnPoint CMP with GPC detection capabilities is a critical remediation milestone.
4.6 Authorized Agent Submissions
Consumers may designate an authorized agent to submit DSRs on their behalf. Authorized agents may submit requests through the online DSR portal (using the authorized-agent designation fields on the webform) or by email to privacy@cascade.com. Authorized-agent requests submitted by phone are accepted, but the intake agent will direct the authorized agent to submit the required documentation via the online portal or email.
All authorized-agent submissions must be accompanied by the documentation required under Section 5.3 of these SOPs, including written signed authorization from the consumer (or a valid power of attorney). Upon receipt of an authorized-agent submission, the DSR Response Team verifies the agent's authorization and, unless a valid power of attorney is provided, also directly verifies the identity of the consumer on whose behalf the request is submitted.
Section 5: Identity Verification Procedures
5.1 Verification Standard
All verifiable consumer requests for access to personal information, deletion of personal information, and correction of personal information must be verified to the standards established by the CCPA/CPRA implementing regulations (Cal. Code Regs. tit. 11, §§ 7060–7064). While the CCPA/CPRA regulations apply directly only to California residents, Cascade applies these verification standards uniformly to all consumers, regardless of state of residence, as a matter of operational consistency and best practice. This uniform approach ensures that Cascade meets or exceeds the verification requirements of all applicable state privacy statutes.
The verification standard requires the business to match the information provided by the requestor against personal information already maintained by the business to determine whether the requestor is the consumer about whom the business has collected personal information. The degree of certainty required depends on the type of request and the sensitivity of the personal information involved, as described in the tiered verification framework below.
This verification standard directly addresses the compliance gap identified in the Gap-Analysis Report, which found that Cascade's prior DSR portal processed access and deletion requests without meaningful identity verification, creating a risk of unauthorized disclosure or deletion of consumer personal information.
5.2 Tiered Verification Framework
The following tiered verification framework applies to all DSRs that require identity verification. The framework is structured to balance consumer accessibility with the need to protect personal information from unauthorized disclosure or modification.
5.2.1 Standard Requests (Categories of PI — "Right to Know Categories")
For requests to know the categories of personal information collected, the categories of sources, the business purposes for collection, and the categories of third parties to whom personal information was disclosed, the following verification standard applies:
• Minimum data points: Two (2) data points matched against existing Cascade records (e.g., name plus email address; name plus phone number; name plus Cascade Rewards member ID).
• Degree of certainty: Reasonable degree of certainty that the requestor is the consumer about whom Cascade has collected personal information.
• Rationale: Because a categories-of-PI response discloses generalized information about Cascade's data practices rather than specific personal information unique to the consumer, a lower verification threshold is appropriate.
5.2.2 Specific-Pieces-of-PI Requests (Right to Know Specific Pieces)
For requests to know the specific pieces of personal information that Cascade has collected about the consumer, the following heightened verification standard applies:
• Minimum data points: Three (3) data points matched against existing Cascade records (e.g., name, email address, and Cascade Rewards member ID; name, phone number, and mailing address; name, email address, and last four digits of a payment card on file).
• Additional requirement: The consumer must submit a signed declaration under penalty of perjury that the consumer is the consumer whose personal information is the subject of the request. The declaration may be submitted electronically through the online DSR portal (via checkbox and electronic signature) or in writing.
• Degree of certainty: Reasonably high degree of certainty that the requestor is the consumer about whom Cascade has collected personal information.
• Rationale: Because a specific-pieces-of-PI response discloses actual data elements unique to the consumer, a higher verification threshold and a sworn declaration are required to prevent unauthorized access.
5.2.3 Deletion Requests
For standard deletion requests, the following verification standard applies:
• Minimum data points: Two (2) data points matched against existing Cascade records.
• Degree of certainty: Reasonable degree of certainty.
• Enhanced verification for sensitive deletions: For deletion requests that involve the deletion of a consumer's entire account or that specifically target the deletion of financial data (e.g., stored payment-card information), three (3) data points must be matched, and the consumer must submit a signed declaration under penalty of perjury. This enhanced standard applies because the irreversible nature of deletion, combined with the sensitivity of financial data, warrants a higher degree of certainty.
5.2.4 Correction Requests
For requests to correct inaccurate personal information, the following verification standard applies:
• Minimum data points: Two (2) data points matched against existing Cascade records.
• Degree of certainty: Reasonable degree of certainty.
• Supporting documentation: While not required for identity verification purposes, consumers are encouraged to submit documentation supporting the alleged inaccuracy (e.g., a copy of a corrected address from a utility bill, evidence of a legal name change) to assist Cascade in evaluating and processing the correction request.
5.2.5 Opt-Out of Sale/Sharing Requests
Consistent with the CCPA/CPRA implementing regulations, no identity verification is required for opt-out-of-sale/sharing requests beyond confirmation that the request can be linked to the consumer's account, device, or browser. The rationale for this lower threshold is that the risk of harm from processing an opt-out request on behalf of the wrong consumer is negligible (the worst-case outcome is that a consumer's data is not sold or shared, which causes no harm to the consumer), whereas imposing verification requirements on opt-out requests could deter consumers from exercising their rights.
GPC signals are processed automatically by the OnPoint CMP without any verification or consumer interaction. Non-GPC opt-out requests submitted through the webform, email, or phone are processed upon confirmation that the request can be associated with an identifiable account, device, or browser session.
5.2.6 Limit Use of Sensitive PI Requests
For requests to limit the use and disclosure of sensitive personal information, the following verification standard applies:
• Minimum data points: Two (2) data points matched against existing Cascade records.
• Additional confirmation: The DSR Response Team must confirm that the requesting consumer's identity is linked to the specific sensitive-PI data set that is the subject of the request. For example, if the consumer requests that Cascade cease collecting precise geolocation data, the team must confirm that the consumer's identity matches the mobile-app account from which geolocation data is collected.
• Degree of certainty: Reasonable degree of certainty.
5.3 Authorized Agent Verification
When a DSR is submitted by an authorized agent on behalf of a consumer, the following verification requirements apply:
• Agent authorization documentation: The authorized agent must provide written signed authorization from the consumer, or a valid power of attorney executed under the laws of the consumer's state of residence. If the agent claims to be registered with the California Secretary of State (as required for agents submitting CCPA/CPRA requests), the DSR Response Team may verify the agent's registration status.
• Direct consumer verification: Unless the authorized agent provides a valid power of attorney, Cascade retains the right to directly verify the identity of the consumer on whose behalf the request is submitted, using the applicable verification tier described in Section 5.2 above. This direct verification may be conducted by contacting the consumer at the email address or phone number on file in Cascade's records.
• State-specific requirements: Certain state statutes impose additional or different requirements for authorized-agent requests. For example, the VCDPA and Colorado CPA have their own provisions governing authorized agents. The DSR Response Team should consult the State-Specific Requirements Quick-Reference Guide (Appendix E) and, for novel questions, escalate to Calderwood & Harkness LLP.