[slide 1]
Cascade Privacy Compliance Training Program
Cascade Retail Holdings Inc. — US State Privacy Compliance Training
Q4 2025 — Mandatory Training for All Employees
Prepared by Calderwood & Harkness LLP, Privacy & Data Security Practice
Prepared by Sara Hendricks, Associate, under direction of Alan Burke, Senior Associate
Confidential — For Internal Use Only
[slide 2]
Agenda & Training Objectives
Module 1: Why Privacy Matters — Regulatory Landscape & Business Context
Module 2: Cascade's Internal Privacy Policy — Key Principles
Module 3: Data Classification & Personal Information Categories
Module 4: Data Subject Request (DSR) Handling
Module 5: Incident Reporting & Breach Response
Module 6: Vendor & Third-Party Management
Module 7: Role-Specific Obligations (Retail, E-Commerce/IT, Marketing, HR)
Module 8: Training Acknowledgment & Certification
[slide 3]
Module 1: Why Privacy Matters — The Regulatory Landscape
19 US state privacy statutes now apply to Cascade's operations
Key laws: California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), and 13 additional state statutes
Cascade operates 186 retail locations in 31 states and ships to all 50 states plus D.C.
~41.2 million Cascade Rewards loyalty members across all 50 states
~94 million annual online transactions processed
Non-compliance risks: regulatory enforcement, fines, litigation, and reputational harm
[slide 4]
Module 1 (cont.): Cascade's Regulatory History — Lessons Learned
2023: FTC Civil Investigative Demand regarding mobile-app unsubscribe flow (dark-pattern allegations) — matter closed April 2024 with no action after voluntary remediation
2024: California Attorney General inquiry regarding sale/sharing disclosures — no enforcement action, but deficiencies were identified
These experiences highlight the importance of proactive compliance
Our current privacy program is designed to close all identified gaps before regulators act
[slide 5]
Module 1 (cont.): Cascade's Privacy Program — Governance Structure
Board-level oversight: Audit & Risk Committee chaired by Director Ellen Marchetti
Privacy Governance Charter to be adopted at the November 13, 2025 board meeting
General Counsel Meredith Tanaka — primary legal oversight
Interim CPO: Associate General Counsel Diana Polk (full-time CPO hire targeted Q4 2025)
CISO Gregory Farris — InfoSec coordination
VP Data & Analytics Priya Nandakumar — data-mapping and analytics oversight
VP Marketing & Customer Engagement Jason Leclaire — AdTech and loyalty program oversight
Executive Sponsor: CEO Thomas R. Cavanaugh
[slide 6]
Module 2: Cascade's Internal Privacy Policy — Core Principles
Applies to Cascade Retail Holdings Inc. and all subsidiaries: Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp.
Data Minimization: Collect and retain only what is necessary for stated purposes
Purpose Limitation: Use personal information only for the purpose for which it was collected
Data Accuracy: Keep personal information accurate and up to date
Security: Apply appropriate technical and organizational safeguards
Privacy by Design: Embed privacy considerations into new products, features, and processes
Accountability: Every employee is responsible for compliance
[slide 7]
Module 3: Data Classification — What Is Personal Information?
Identifiers: name, email, phone, address, account number, loyalty member ID
Commercial Information: purchase history, products viewed, returns, Cascade Rewards transactions
Internet / Network Activity: browsing history, search queries, interaction with cascade.com
Geolocation Data: precise geolocation from Cascade mobile app (classified as Sensitive PI)
Inferences: consumer profiles created from browsing and purchase behavior (Peakview Analytics)
Sensitive Personal Information: precise geolocation, payment-card data, account login credentials
Employee and Job-Applicant Data: SSN, background check results, payroll, benefits information
[slide 8]
Module 3 (cont.): Data Classification & Role-Based Access
Data must be segregated by business function and access granted only on a need-to-know basis
Critical issue: third-party seller data on Cascade Digital Marketplace must be separated from first-party customer data — commingling is prohibited
Peakview Analytics data used for ad targeting is restricted to authorized personnel
Cascade Rewards loyalty data is managed by Cascade Rewards Corp. and subject to financial-incentive disclosure rules
All data access must comply with the documented data-retention and disposal schedule
No documented data-retention schedule existed prior to this program — one is now in place
[slide 9]
Module 4: Data Subject Requests (DSRs) — Overview
Consumer rights include: Right to Know/Access, Right to Delete, Right to Correct, Right to Opt-Out of Sale/Sharing, Right to Limit Use of Sensitive PI
Additional state-specific rights: Right to Appeal (required by Virginia, Colorado, Connecticut, and other states)
FY2024 volume: ~38,400 total DSRs received (Access: ~12,800; Deletion: ~19,100; Opt-Out: ~6,500)
Prior average response time: 27 calendar days — new target: 15 business days or less
Universal opt-out mechanism (Global Privacy Control) must now be honored — this was a prior gap
[slide 10]
Module 4 (cont.): DSR Handling — Your Responsibilities
Step 1: If a consumer makes a privacy request (in-store, by phone, by email), do NOT attempt to process it yourself
Step 2: Direct the consumer to Cascade's DSR portal at cascade.com/privacy or the toll-free number
Step 3: Log the interaction in Cascade's DSR intake system immediately
Step 4: Identity verification will be conducted by the privacy team — do not collect identity documents yourself
Step 5: The DSR automation tool (implemented by Fieldhaven Consulting Group LLC) manages workflow and deadlines
Step 6: If a consumer requests an appeal, direct them to the appeal process in the DSR SOPs
Never ignore a consumer privacy request — escalate to Diana Polk or the Legal team if unsure
[slide 11]
Module 5: Incident Reporting & Breach Response
A privacy incident includes: unauthorized access, disclosure, loss, or destruction of personal information
Examples: laptop left unsecured with customer data, misdirected email containing PI, suspicious system access, lost inventory containing customer records
Report immediately to CISO Gregory Farris and the Legal team (Diana Polk)
Do NOT attempt to investigate or remediate on your own
Cascade's cyber/privacy-liability insurance ($25M per occurrence / $50M annual aggregate) requires timely notification
Many state laws impose breach-notification deadlines (e.g., 72 hours to regulators under some statutes)
All incidents are logged and investigated under the internal privacy policy procedures
[slide 12]
Module 6: Vendor & Third-Party Management
Cascade shares consumer data with 47 third-party advertising and analytics partners
23 of these 47 partners previously lacked executed Data Processing Agreements (DPAs) — a critical gap now being remediated
Under CCPA/CPRA, each vendor must be classified as a Service Provider, Contractor, or Third Party
All vendors must have an executed DPA before receiving any personal information
Key vendors: OnPoint Data Solutions (CMP, $480K/yr); Thornbridge Media Corp. (programmatic ads, $18.4M annual spend — agreement restructured)
If you work with external vendors who handle PI, notify Legal before sharing any data
[slide 13]
Module 6 (cont.): Consent Management & Cookies
Cascade uses 12 categories of cookies and tracking technologies on cascade.com and the mobile app
OnPoint Data Solutions' consent-management platform (CMP) controls cookie consent collection
CMP deployment target: December 15, 2025 on cascade.com and mobile app
Global Privacy Control (GPC) signals must be honored as valid opt-out requests
Marketing and e-commerce employees: do not deploy new cookies or tracking pixels without completing a privacy review
Cookie categories and their purposes are documented in the Cookie & Tracking-Technology Notice
[slide 14]
Module 7: Role-Specific Obligations — Retail Associates
Cascade operates 186 retail locations across 31 US states
In-store collection of PI: loyalty sign-ups, payment transactions, returns, customer service interactions
If a customer asks about privacy rights or makes a verbal DSR: direct to cascade.com/privacy or the toll-free number and log the request
Do not collect more personal information than necessary for the transaction
Properly secure any paper forms, receipts, or devices containing customer data
Report lost or stolen point-of-sale devices immediately
[slide 15]
Module 7 (cont.): Role-Specific Obligations — E-Commerce & IT
E-commerce processes ~94 million annual transactions and hosts ~3,800 third-party marketplace sellers
Peakview Analytics processes ~2.1 billion consumer-event data records per month — handle with care
Marketplace seller data must be segregated from first-party consumer data — no commingling
All new features, integrations, or data-processing changes require a Privacy Impact Assessment (PIA)
CMP and DSR automation tools must be maintained and monitored for proper functioning
Coordinate with Fieldhaven Consulting Group LLC's implementation team (lead: Marcus Ellerby) during rollout
[slide 16]
Module 7 (cont.): Role-Specific Obligations — Marketing & Customer Engagement
Marketing team overseen by VP Jason Leclaire
Cascade Rewards loyalty program (~41.2M members) is subject to CCPA financial-incentive disclosure requirements (§ 1798.125)
Sharing consumer behavioral data with ad partners (incl. Thornbridge Media Corp.) constitutes 'sharing' under CCPA — opt-out rights apply
Do not create audience segments or targeting criteria using sensitive PI without Legal approval
All email, SMS, and push-notification campaigns must respect consumer opt-out preferences
Sensitive PI (precise geolocation from mobile app) requires separate opt-in consent — do not use without verification
[slide 17]
Module 7 (cont.): Role-Specific Obligations — Human Resources
Cascade employs ~22,500 individuals across all operations
Employee and job-applicant data is subject to California CCPA/CPRA and other state-law requirements
A dedicated Employee & Job-Applicant Privacy Notice has been prepared — share with all new hires and applicants
Limit collection of employee PI to what is necessary for employment purposes
Handle sensitive employee data (SSN, background checks, benefits, medical info) with heightened security
Respond to employee DSRs through the same DSR process — consult Legal
[slide 18]
Module 8: Privacy Impact Assessments (PIAs)
A PIA is required before launching any new product, feature, vendor relationship, or data-processing activity involving PI
Required under CCPA/CPRA risk-assessment mandates and similar requirements in Colorado CPA, Connecticut CTDPA, Virginia VCDPA, and other statutes
PIA template includes: data-flow description, necessity/proportionality analysis, risk identification, mitigation measures, and approval workflow
Trigger events: new marketing campaigns using PI, new vendor onboarding, new data collection on cascade.com or mobile app, changes to Peakview Analytics processing
Submit PIA requests to Diana Polk or the Legal team
[slide 19]
Key Compliance Program Milestones & Timelines
June 2, 2025: Privacy compliance program engagement opened with Calderwood & Harkness LLP
August 15, 2025: Gap-analysis report delivered — 7 key compliance gaps identified
September 12, 2025: New comprehensive privacy-policy suite drafted
September 30, 2025: Vendor DPA templates finalized
October 31, 2025: Thornbridge data-sharing agreement restructured and executed
November 13, 2025: Board adoption of Privacy Governance Charter
December 1, 2025: DSR workflow go-live (new automated system)
December 15, 2025: Consent-management platform deployment on cascade.com and mobile app
December 31, 2025: Phase 1 completion and compliance-readiness certification
January 1, 2026: Phase 2 opens (ongoing monitoring, training updates, regulatory response)
June 30, 2026: First annual privacy-program assessment
[slide 20]
Resources & Contacts
Privacy Questions & DSR Escalation: Diana Polk, Associate General Counsel (Interim CPO)
Legal Department: General Counsel Meredith Tanaka
Information Security Incidents: CISO Gregory Farris
Data & Analytics Questions: VP Priya Nandakumar
Marketing & Loyalty Program Questions: VP Jason Leclaire
Consumer-Facing DSR Portal: cascade.com/privacy
Internal Resources: Cascade Intranet — Privacy Compliance Hub (Internal Privacy Policy, DSR SOPs, PIA Template, Retention Schedule, all privacy notices)
[slide 21]
Training Acknowledgment & Certification
By signing below, I acknowledge that I have completed Cascade's US State Privacy Compliance Training
I understand my obligations under Cascade's Internal Privacy Policy
I understand how to recognize and escalate data subject requests
I understand my obligation to report potential privacy incidents immediately
I understand that non-compliance may result in disciplinary action
Fields: Employee Name, Employee ID, Department, Location, Date, Signature