INTERNAL PRIVACY POLICY & PROCEDURES MANUAL
Personal Information Handling
Issued by:
Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Applicability: Cascade Retail Holdings Inc. and All Subsidiaries Cascade Digital Marketplace LLC Ridgeline Fulfillment Services Inc. Peakview Analytics Inc. Cascade Rewards Corp.
Effective Date: October 2025
Document Classification: Confidential — Internal Use Only
Version 1.0
Drafted by:
Alan Burke, Senior Associate Sara Hendricks, Associate Privacy & Data Security Practice Group
Calderwood & Harkness LLP 600 Lexington Avenue, 28th Floor New York, NY 10022
Matter Number: 1038-00010
Approved by:
Meredith Tanaka General Counsel, Cascade Retail Holdings Inc.
Interim Chief Privacy Officer:
Diana Polk Associate General Counsel, Cascade Retail Holdings Inc.
TABLE OF CONTENTS
Right-click to update Table of Contents
SECTION 1: PURPOSE AND SCOPE
1.1 Purpose
This Internal Privacy Policy & Procedures Manual (this "Manual") is adopted by Cascade Retail Holdings Inc. ("Cascade," "CRH," or the "Company") to establish a unified, company-wide framework governing the collection, use, storage, disclosure, retention, and disposal of personal information ("PI") by the Company and all of its subsidiaries, including Cascade Digital Marketplace LLC ("CDM"), Ridgeline Fulfillment Services Inc. ("Ridgeline"), Peakview Analytics Inc. ("Peakview"), and Cascade Rewards Corp. ("Cascade Rewards"). This Manual is intended to serve as the authoritative internal reference document for all personnel responsible for handling PI in the course of Cascade's business operations.
The primary objectives of this Manual are as follows:
1. Unified Governance Framework. To create a single, comprehensive set of privacy policies, procedures, and operational standards that apply consistently across all Cascade entities and business functions, replacing the patchwork of informal practices and ad hoc guidance that previously governed data handling within the organization.
2. Statutory Compliance. To ensure that Cascade and each of its subsidiaries comply with all nineteen (19) applicable United States state privacy statutes, including without limitation:
(a) the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100 et seq.;
(b) the Virginia Consumer Data Protection Act ("VCDPA"), Va. Code Ann. §§ 59.1-575 et seq.;
(c) the Colorado Privacy Act ("CPA"), Colo. Rev. Stat. §§ 6-1-1301 et seq.;
(d) the Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 et seq.;
(e) the Utah Consumer Privacy Act ("UCPA"), Utah Code Ann. §§ 13-61-101 et seq.;
(f) the Iowa Consumer Data Protection Act ("ICDPA"), Iowa Code §§ 715D.1 et seq.;
(g) the Indiana Consumer Data Protection Act ("INCDPA"), Ind. Code §§ 24-15-1-1 et seq.;
(h) the Tennessee Information Protection Act ("TIPA"), Tenn. Code Ann. §§ 47-18-3201 et seq.;
(i) the Montana Consumer Data Privacy Act ("MCDPA"), Mont. Code Ann. §§ 30-14-2801 et seq.;
(j) the Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code §§ 541.001 et seq.;
(k) the Oregon Consumer Privacy Act ("OCPA"), Or. Rev. Stat. §§ 646A.570 et seq.;
(l) the Delaware Personal Data Privacy Act ("DPDPA"), Del. Code Ann. tit. 6, §§ 12D-101 et seq.;
(m) the New Jersey Data Privacy Act ("NJDPA"), N.J. Rev. Stat. §§ 56:8-166 et seq.;
(n) the New Hampshire Data Privacy Act ("NHDPA"), N.H. Rev. Stat. Ann. §§ 507-H:1 et seq.;
(o) the Nebraska Data Privacy Act ("NDPA"), Neb. Rev. Stat. §§ 87-1101 et seq.;
(p) the Minnesota Consumer Data Privacy Act;
(q) the Maryland Online Data Privacy Act ("MODPA");
(r) the Kentucky Data Privacy Act ("KYDPA"); and
(s) additional state privacy statutes effective or enacted through the 2025–2026 legislative cycle, as identified in ongoing regulatory monitoring by Calderwood & Harkness LLP.
3. Remediation of Identified Deficiencies. To address and remediate the specific compliance deficiencies identified in the Comprehensive Gap-Analysis Report dated August 15, 2025 (the "Gap-Analysis Report"), prepared by Calderwood & Harkness LLP as part of its engagement under the Engagement Letter dated June 2, 2025. The Gap-Analysis Report identified multiple areas requiring immediate and near-term remediation, including, among others, the absence of a documented data-retention schedule, deficiencies in data subject request ("DSR") processing and identity verification, failure to honor universal opt-out signals such as the Global Privacy Control ("GPC"), and insufficient contractual coverage for advertising and analytics partners.
4. Board Governance Support. To support and implement the Privacy Governance Charter adopted by the Board of Directors of Cascade Retail Holdings Inc. on November 13, 2025 (the "Privacy Governance Charter"), which establishes the board-level oversight framework for the Company's privacy program and designates the Audit & Risk Committee of the Board as the primary oversight body for privacy and data-security matters.
1.2 Scope
This Manual applies to all employees, contractors, temporary workers, consultants, and agents of Cascade and each of its subsidiaries. As of the effective date of this Manual, Cascade employs approximately 22,500 individuals across 186 retail locations in 31 United States states and operates multiple e-commerce fulfillment centers. All such personnel, regardless of their position, function, or geographic location within the United States, are bound by the requirements of this Manual when handling PI in the course of their duties for or on behalf of Cascade.
The scope of this Manual encompasses the following business operations and data-processing activities:
(a) Direct-to-Consumer Retail (In-Store and E-Commerce). All PI collected in connection with Cascade's direct-to-consumer retail operations, including transactions conducted at the Company's 186 physical retail locations and through the Company's e-commerce platform at cascade.com and the Cascade mobile application.
(b) Third-Party Marketplace. All PI processed in connection with the third-party marketplace operated by Cascade Digital Marketplace LLC, which hosts approximately 3,800 third-party sellers as of the effective date. This includes both consumer data generated through marketplace transactions and PI of marketplace sellers themselves.
(c) Loyalty Program. All PI collected, used, and disclosed in connection with the Cascade Rewards loyalty program operated by Cascade Rewards Corp., which has approximately 41.2 million registered members as of the effective date.
(d) Advertising Technology and Analytics. All PI processed by Peakview Analytics Inc. in connection with advertising technology, consumer analytics, ad targeting, personalization, and related activities. Peakview processes approximately 2.1 billion consumer-event data records per month across Cascade's digital properties and advertising ecosystem.
(e) Fulfillment and Logistics. All PI processed by Ridgeline Fulfillment Services Inc. in connection with order fulfillment, shipping, delivery, returns, and related logistics operations.
This Manual applies to PI collected from all categories of data subjects with whom Cascade interacts, including consumers (both in-store and online), employees, job applicants, marketplace sellers, and business contacts. It covers all channels through which PI is collected, including cascade.com, the Cascade mobile application, in-store point-of-sale ("POS") systems, customer service interactions (telephone, email, and chat), and third-party data sources from which Cascade obtains consumer data.
The scope of this Manual further extends to data shared with or processed by Cascade's third-party advertising and analytics partners. As of the date of the Fieldhaven Consulting Group LLC data-mapping report (May 19, 2025), Cascade shares consumer data with forty-seven (47) such partners, including Thornbridge Media Corp. ("Thornbridge"), Cascade's primary programmatic-advertising partner. All such data-sharing activities are governed by the requirements set forth in this Manual and in the corresponding data processing agreements and data-sharing agreements described herein.
1.3 Relationship to Other Policies and Documents
This Manual operates in conjunction with, and should be read together with, the following policies, notices, and documents that collectively comprise Cascade's privacy program:
(a) Omnibus Privacy Policy (consumer-facing; dated September 12, 2025) — the Company's comprehensive consumer-facing privacy notice posted on cascade.com and the Cascade mobile application.
(b) California-Specific Privacy Disclosures Addendum — supplemental disclosures addressing requirements specific to the CCPA/CPRA, including categories of PI collected, purposes of processing, and California-specific consumer rights.
(c) State-Specific Consumer Rights Supplement — supplemental disclosures addressing the specific rights available to consumers under each of the nineteen applicable state privacy statutes.
(d) Cookie & Tracking-Technology Notice — the notice disclosing the Company's use of twelve (12) categories of cookies and tracking technologies on cascade.com and the Cascade mobile application (dated September 12, 2025).
(e) Employee & Job-Applicant Privacy Notice (dated September 12, 2025) — the notice provided to Cascade employees and job applicants regarding the Company's collection and use of their PI.
(f) Cascade Rewards Loyalty-Program Privacy Notice (dated September 12, 2025) — the notice provided to Cascade Rewards members regarding the collection, use, and disclosure of their PI in connection with the loyalty program.
(g) Third-Party Marketplace Seller Privacy Notice (dated September 12, 2025) — the notice provided to CDM marketplace sellers regarding the handling of their PI and the PI of consumers with whom they transact through the marketplace.
(h) Data Retention & Disposal Schedule (dated October 2025) — the detailed schedule specifying retention periods and disposal procedures for each category of PI processed by Cascade.
(i) DSR Standard Operating Procedures (effective December 1, 2025) — the detailed step-by-step procedures governing the intake, verification, processing, and completion of data subject requests.
(j) Privacy Impact Assessment Framework & Template (dated October 2025) — the framework and standardized template for conducting privacy impact assessments of new and existing data-processing activities.
(k) Employee Privacy Training Program Materials (Q4 2025) — the training curriculum and materials for the mandatory privacy training program for all Cascade employees.
This Manual is also coordinated with the following enterprise-wide policies and programs:
(l) Cascade Information Security Policy — managed by Chief Information Security Officer ("CISO") Gregory Farris, which establishes the technical and administrative security controls that protect PI and other confidential information across the enterprise.
(m) Cascade Data Governance Standards — managed by Vice President, Data & Analytics Priya Nandakumar, which establishes the standards and procedures for data quality, data architecture, data cataloging, and data stewardship across the enterprise.
In the event of a conflict between this Manual and any other internal policy, procedure, or guideline, the provisions of this Manual shall control with respect to the handling of PI, except where the Cascade Information Security Policy imposes more stringent technical security requirements, in which case the more protective standard shall apply.
SECTION 2: DEFINITIONS
The following definitions apply throughout this Manual. Capitalized terms used but not defined in a particular section shall have the meanings ascribed to them in this Section 2 or, where applicable, in the Glossary of Defined Terms set forth in Appendix A.
"Consumer" means a natural person who is a resident of the State of California (as defined under the CCPA/CPRA) or a resident of any other state with an applicable privacy statute, and who is acting in an individual (i.e., non-commercial) capacity. For purposes of this Manual, "Consumer" includes customers, website visitors, mobile-app users, Cascade Rewards loyalty-program members, and, to the extent required by applicable law, employees, job applicants, and independent contractors.
"Contractor" means a third party to whom Cascade makes available PI for a business purpose pursuant to a written contract that includes the additional restrictions required under CCPA/CPRA Cal. Civ. Code § 1798.140(j), including requirements related to certification, compliance, and the right of the business to audit the contractor's processing of PI. A contractor is distinguished from a service provider by the nature and scope of the contractual restrictions imposed.
"Data Processing Agreement" or "DPA" means a written contract governing a vendor's or partner's processing of PI on Cascade's behalf, or governing the terms under which PI is disclosed to or shared with a third party. DPAs must comply with the contractual requirements specified in the CCPA/CPRA and all other applicable state privacy statutes, and must include, at a minimum, the provisions described in Section 9.2 of this Manual.
"Data Subject Request" or "DSR" means a verifiable request submitted by a Consumer (or the Consumer's authorized agent) to exercise any privacy right available under applicable state law, including without limitation the right to know or access PI, the right to delete PI, the right to correct inaccurate PI, the right to opt out of the sale or sharing of PI, the right to limit the use and disclosure of sensitive personal information, the right to data portability, and the right to appeal the denial of a DSR.
"Global Privacy Control" or "GPC" means a browser-based, device-based, or platform-based technical signal that indicates a Consumer's preference to opt out of the sale or sharing of their PI, as specified by the GPC technical standard. Cascade treats GPC signals as valid opt-out-of-sale/sharing requests in accordance with the CCPA/CPRA and the regulations promulgated thereunder, as well as applicable requirements under the CPA, CTDPA, MODPA, and other state statutes recognizing universal opt-out mechanisms.
"Personal Information" or "PI" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household, as defined under CCPA/CPRA Cal. Civ. Code § 1798.140(v) and the analogous definitions set forth in each of the nineteen applicable state privacy statutes. PI includes, without limitation, the following categories: identifiers (e.g., name, email address, postal address, telephone number, Cascade Rewards member ID, IP address, device identifiers); commercial information (e.g., purchase history, product preferences, transaction records, returns); internet and electronic network activity information (e.g., browsing history, search history, interaction with cascade.com and the Cascade mobile application, clickstream data); geolocation data, including precise geolocation data collected from the Cascade mobile application; inferences drawn from any of the foregoing to create a profile reflecting a Consumer's preferences, characteristics, behavior, or attitudes; audio, electronic, or visual information (e.g., customer-service call recordings, in-store security camera footage); professional or employment-related information; and sensitive personal information as defined below.
"Privacy Impact Assessment" or "PIA" means a systematic assessment of a proposed or existing data-processing activity, conducted in accordance with the PIA Framework & Template (dated October 2025), to identify and evaluate the privacy risks associated with the processing activity, assess the adequacy of existing controls and safeguards, and recommend mitigations to reduce identified risks to an acceptable level. PIAs are required under the CCPA/CPRA, the CPA, the CTDPA, the VCDPA, and other state statutes for certain categories of high-risk processing activities, as described in Section 11 of this Manual.
"Processing" means any operation or set of operations performed on PI, whether or not by automated means, including without limitation the collection, recording, organization, structuring, storage, adaptation, alteration, retrieval, consultation, use, disclosure by transmission, dissemination, or otherwise making available, alignment or combination, restriction, erasure, or destruction of PI.
"Sale" and "Sharing" have the meanings ascribed to those terms under CCPA/CPRA Cal. Civ. Code §§ 1798.140(ad) and 1798.140(ah), respectively. "Sale" means the disclosure of PI to a third party for monetary or other valuable consideration. "Sharing" means the disclosure of PI to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration. Certain state privacy statutes define "sale" more broadly or do not distinguish between "sale" and "sharing"; in such cases, the applicable statutory definition shall control. For purposes of this Manual, references to "sale/sharing" or "sale or sharing" encompass both concepts.
"Sensitive Personal Information" or "SPI" means the subset of PI that is subject to heightened protections under applicable law, as defined under CCPA/CPRA Cal. Civ. Code § 1798.140(ae) and analogous definitions in other state privacy statutes. SPI includes, without limitation: Social Security numbers; driver's license numbers, state identification card numbers, and passport numbers; account log-in credentials (username and password combinations, or security questions and answers); financial account information, including debit or credit card numbers in combination with any required security or access code; precise geolocation data (defined as the location of a Consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, as collected via the Cascade mobile application's GPS functionality); racial or ethnic origin; religious or philosophical beliefs; union membership; contents of mail, email, or text messages (where Cascade is not the intended recipient); genetic data; biometric data processed for the purpose of uniquely identifying a Consumer; PI collected and analyzed concerning a Consumer's health, sex life, or sexual orientation; and any other categories designated as "sensitive" under applicable state statutes.
"Service Provider" means a legal entity that processes PI on behalf of Cascade pursuant to a written contract that meets the requirements of CCPA/CPRA Cal. Civ. Code § 1798.140(ag) and analogous requirements under other applicable state statutes. A service provider processes PI solely at the direction of and on behalf of Cascade for the business purposes specified in the written contract and is contractually prohibited from retaining, using, or disclosing PI for any purpose other than performing the services specified in the contract.
"Third Party" means any entity that is not Cascade (or a Cascade subsidiary) and is not classified as a service provider or contractor of Cascade. Third parties include entities that receive PI from Cascade through data-sharing arrangements (e.g., advertising and analytics partners participating in data-sharing arrangements for cross-context behavioral advertising, such as Thornbridge Media Corp.).
SECTION 3: GOVERNANCE STRUCTURE AND ROLES & RESPONSIBILITIES
3.1 Board-Level Oversight
The Board of Directors of Cascade Retail Holdings Inc. exercises oversight of the Company's privacy program through its Audit & Risk Committee. The Audit & Risk Committee is chaired by Director Ellen Marchetti and is composed of independent directors with relevant expertise in risk management, regulatory compliance, and technology governance.
The Privacy Governance Charter, adopted by the Board of Directors on November 13, 2025, formally establishes the Audit & Risk Committee's oversight authority over the Company's privacy program. Under the Privacy Governance Charter, the Audit & Risk Committee:
(a) receives quarterly reports from the Chief Privacy Officer (or Interim CPO) on the status of the privacy program, including key metrics, DSR volumes and response times, privacy-incident reports, vendor compliance status, and regulatory developments;
(b) has the authority to request special reports or briefings on specific privacy matters at any time, including in connection with material privacy incidents, regulatory inquiries or enforcement actions, and significant changes in applicable law;
(c) reviews and approves material changes to the privacy program, including changes to this Manual, consumer-facing privacy notices, and the Company's overall approach to data-sharing and advertising-technology practices; and
(d) oversees privacy-related regulatory matters, including the Company's responses to regulatory inquiries, enforcement actions, and litigation, in coordination with the General Counsel and outside counsel.
The Audit & Risk Committee reports to the full Board of Directors on privacy-program matters at least twice annually, and more frequently as circumstances warrant.
3.2 Chief Privacy Officer (CPO)
The position of Chief Privacy Officer ("CPO") is a full-time senior management role with enterprise-wide accountability for the design, implementation, operation, monitoring, and continuous improvement of Cascade's privacy program. The Company is in the process of recruiting a permanent CPO, with the target of filling the position by the end of Q4 2025. Until such time as a permanent CPO is appointed, all CPO responsibilities described in this Manual are held on an interim basis by Diana Polk, Associate General Counsel.
The CPO reports directly to the General Counsel, Meredith Tanaka, and maintains a dotted-line reporting relationship to the Chief Executive Officer, Thomas R. Cavanaugh. This dual reporting structure is designed to ensure that the CPO has both the legal support and the organizational visibility necessary to carry out the role effectively.
The CPO's responsibilities include, without limitation:
(a) overall accountability for the design, implementation, and ongoing operation of Cascade's privacy program, including all policies, procedures, notices, and controls described in this Manual;
(b) monitoring compliance with all applicable state privacy statutes and ensuring that the Company's practices remain current with evolving regulatory requirements;
(c) serving as the primary regulatory liaison for privacy-related matters, including coordinating with state attorneys general, the California Privacy Protection Agency ("CPPA"), and other regulatory bodies;
(d) exercising escalation authority for privacy incidents, including the authority to convene the Incident Response Team and to authorize consumer and regulatory notifications;
(e) reviewing and approving Privacy Impact Assessments for high-risk processing activities;
(f) overseeing the DSR-processing function, including ensuring that response timelines are met and that verification procedures comply with applicable law;
(g) coordinating with outside counsel, including Calderwood & Harkness LLP (Privacy & Data Security Practice Group) and Whitfield Greaves LLP (securities and corporate governance counsel), on privacy-program matters;
(h) chairing the Cross-Functional Privacy Working Group; and
(i) reporting to the Audit & Risk Committee on a quarterly basis and, as needed, on an ad hoc basis.
3.3 General Counsel
Meredith Tanaka, General Counsel of Cascade Retail Holdings Inc., holds primary legal authority over the privacy program. Ms. Tanaka serves as the primary client contact for the Calderwood & Harkness LLP engagement (Matter No. 1038-00010) and exercises final legal judgment on all privacy-related matters affecting the Company.
The General Counsel's specific responsibilities with respect to the privacy program include:
(a) legal review and approval of all consumer-facing privacy notices, disclosures, and supplements, as well as all internal privacy policies and procedures;
(b) legal review and approval of Data Processing Agreements, data-sharing agreements, and other contracts governing the disclosure or processing of PI by third parties;
(c) oversight of the Company's responses to regulatory inquiries, enforcement actions, and litigation related to privacy matters;
(d) issuance and lifting of legal holds affecting PI and other data subject to retention or litigation-hold obligations;
(e) coordination with Carolyn J. Marsden at Whitfield Greaves LLP on SEC disclosure obligations and corporate governance implications arising from the privacy program, including potential disclosure requirements under Item 1.05 of Form 8-K in connection with material cybersecurity and privacy incidents; and
(f) approval authority for high-risk Privacy Impact Assessments, in consultation with the CPO and, as appropriate, outside counsel.
3.4 Chief Information Security Officer (CISO)
Gregory Farris, Chief Information Security Officer, is responsible for the technical and administrative security controls that protect PI and other confidential information across Cascade's enterprise. The CISO reports to the Chief Information Officer and coordinates closely with the CPO on all matters at the intersection of information security and data privacy.
The CISO's responsibilities relevant to the privacy program include:
(a) implementing and maintaining data encryption standards for PI at rest and in transit, in accordance with the data-classification tiers described in Section 4 of this Manual;
(b) administering identity and access management systems, multi-factor authentication, and privileged-access management controls to enforce the role-based access controls described in Section 6 of this Manual;
(c) managing network security, endpoint protection, and vulnerability management programs to prevent unauthorized access to systems containing PI;
(d) operating the security-incident detection and response program, including coordination with the CPO on the assessment of whether a security incident constitutes a data breach triggering statutory notification obligations;
(e) liaising with Northcastle Indemnity Company, the Company's cyber/privacy-liability insurer (policy limits: $25 million per occurrence / $50 million annual aggregate; annual premium: $1,340,000; policy period: July 1, 2025 – June 30, 2026), and with Ridgepoint Insurance Brokers Inc. (broker; account executive Nathan Gilroy) on cyber-incident claims and coverage matters; and
(f) participating in the Cross-Functional Privacy Working Group and the Incident Response Team, as described in Sections 3.7 and 12.3 of this Manual, respectively.
3.5 VP, Data & Analytics
Priya Nandakumar, Vice President, Data & Analytics, serves as the subject-matter expert on data architecture, data flows, and analytics capabilities across the Cascade enterprise. Ms. Nandakumar's responsibilities relevant to the privacy program include:
(a) serving as the owner and steward of the enterprise data map, which was initially compiled by Fieldhaven Consulting Group LLC and documented in the data-mapping report dated May 19, 2025, and which was subsequently reviewed from a legal perspective pursuant to the Data-Mapping Review Memorandum dated July 14, 2025;
(b) ensuring that the enterprise data map is maintained, kept accurate, and updated at least annually and upon any material change in processing activities, data flows, or systems of record;
(c) implementing and overseeing data-segregation controls to ensure that Cascade Digital Marketplace seller data is logically and, where feasible, physically segregated from first-party Cascade customer data within the enterprise data lake, in accordance with the requirements described in Section 6.3 of this Manual;
(d) overseeing Peakview Analytics Inc.'s data-processing activities, including the processing of approximately 2.1 billion consumer-event data records per month, and ensuring that such processing is conducted in compliance with applicable privacy laws and the requirements of this Manual; and
(e) coordinating with the CISO on the design and implementation of role-based access controls for data-analytics systems and the enterprise data lake, as described in Section 6 of this Manual.
3.6 VP, Marketing & Customer Engagement
Jason Leclaire, Vice President, Marketing & Customer Engagement, is responsible for ensuring that the Company's marketing, advertising, and customer-engagement practices comply with applicable privacy laws and the requirements of this Manual. Mr. Leclaire's responsibilities include:
(a) ensuring that the Company's advertising-technology stack, including the relationship with Thornbridge Media Corp. and other advertising and analytics partners, complies with the data-sharing, opt-out, and consent requirements described in Sections 9, 10, and 13 of this Manual;
(b) overseeing the use of PI in connection with the Cascade Rewards loyalty program, including ensuring compliance with financial-incentive disclosure requirements under CCPA/CPRA Cal. Civ. Code § 1798.125 and analogous provisions of other state statutes;
(c) managing cookie and tracking-technology compliance across cascade.com and the Cascade mobile application, including ensuring proper categorization of all twelve (12) categories of cookies and tracking technologies and appropriate consent/opt-out mechanisms;
(d) coordinating with the CPO on the implementation and operation of opt-out mechanisms, including the "Do Not Sell or Share My Personal Information" link and GPC signal honoring; and
(e) managing the relationship with OnPoint Data Solutions Inc., the Company's consent-management platform ("CMP") vendor, including oversight of the annual license (annual fee: $480,000; three-year term; total contract value: $1,440,000) and coordination on CMP deployment and configuration.
3.7 Cross-Functional Privacy Working Group
The Cross-Functional Privacy Working Group (the "Privacy Working Group") is a standing internal committee that serves as the principal operational body for coordinating privacy-program activities across all Cascade entities and business functions.
Composition. The Privacy Working Group is composed of the following members:
• CPO or Interim CPO (Chair)
• CISO
• VP, Data & Analytics
• VP, Marketing & Customer Engagement
• Representative from Human Resources
• Representative from Retail Operations
• Representative from Cascade Digital Marketplace LLC
• Representative from Ridgeline Fulfillment Services Inc.
• Representative from Cascade Rewards Corp.
• Representative from Information Technology
Meeting Cadence. The Privacy Working Group meets bi-weekly, or more frequently as needed to address urgent matters such as privacy incidents, regulatory inquiries, or time-sensitive implementation deadlines.
Responsibilities. The Privacy Working Group is responsible for:
(a) reviewing and discussing privacy-program metrics, including DSR volumes and response times, opt-out rates, privacy-incident trends, vendor DPA coverage, and PIA completion status;
(b) evaluating proposed new processing activities for privacy implications and, where appropriate, directing the initiation of a Privacy Impact Assessment;
(c) coordinating DSR responses that require cross-functional input or that involve complex factual or legal questions;
(d) triaging privacy incidents, determining severity and escalation, and overseeing remediation activities;
(e) reviewing and approving PIA recommendations for standard-risk processing activities (high-risk PIAs are escalated to the General Counsel for approval); and
(f) advising the CPO on policy updates, procedural improvements, and emerging privacy risks.
3.8 All Employees
Every employee of Cascade Retail Holdings Inc. and its subsidiaries, regardless of title, function, or seniority, is responsible for handling PI in accordance with the requirements of this Manual and all related policies, procedures, and notices. Each employee must:
(a) complete the mandatory Employee Privacy Training Program upon hire and annually thereafter, as described in Section 16 of this Manual;
(b) handle PI only in accordance with the data-classification tiers, role-based access controls, and purpose-limitation principles described in this Manual;
(c) promptly report any suspected privacy incident, data breach, or non-compliance with this Manual to the CPO (or Interim CPO Diana Polk) through the established reporting channels described in Section 12.2 of this Manual; and
(d) cooperate with the CPO, CISO, General Counsel, and Privacy Working Group in connection with privacy audits, investigations, DSR responses, and incident-response activities.
3.9 Outside Counsel and Consultants
Cascade has engaged the following outside counsel and consultants in connection with the design, implementation, and operation of its privacy program:
Calderwood & Harkness LLP — Privacy & Data Security Practice Group. Calderwood & Harkness serves as Cascade's outside privacy and data security counsel under the engagement governed by Matter Number 1038-00010. The engagement team includes responsible partner Kevin Ostrowski, billing partner Rachel Bernstein, lead associate Alan Burke, and working associate Sara Hendricks. Calderwood & Harkness is responsible for legal analysis of applicable privacy statutes, drafting and review of privacy policies and notices, DPA template development, gap-analysis and remediation guidance, regulatory-response support, and ongoing regulatory monitoring.
Whitfield Greaves LLP — Securities and Corporate Counsel. Lead partner Carolyn J. Marsden advises Cascade on SEC disclosure obligations and corporate governance implications arising from the privacy program, including potential Form 8-K disclosure requirements for material cybersecurity and privacy incidents and proxy-statement disclosures related to board oversight of privacy and cybersecurity matters.
Fieldhaven Consulting Group LLC — Technical Implementation Partner. Engagement lead Marcus Ellerby manages Fieldhaven's engagement to implement the technical components of Cascade's privacy program, including the deployment and configuration of the OnPoint Data Solutions consent-management platform, the data-mapping tool, and the DSR-workflow automation system. Fieldhaven's engagement is governed by a fixed-fee Statement of Work with a total engagement value of $3,150,000, structured across three milestones: Milestone 1 ($945,000), Milestone 2 ($1,102,500), and Milestone 3 ($1,102,500).
Lakemont Audit Partners LLP — Independent Auditor. Engagement partner Sheila Brogan consults on the overlap between Cascade's privacy controls and its SOC 2 reporting framework, and advises on the internal-control implications of the privacy program for financial-reporting purposes.
SECTION 4: DATA CLASSIFICATION
4.1 Classification Tiers
All data processed by Cascade and its subsidiaries must be classified into one of the following four tiers. The classification tier determines the applicable handling requirements, access controls, retention limitations, and protective measures that must be applied to the data throughout its lifecycle.
Tier 1 — Sensitive Personal Information (SPI)
Tier 1 data consists of Sensitive Personal Information as defined in Section 2 of this Manual. Tier 1 data includes, without limitation, the following categories:
(a) Precise geolocation data collected via the Cascade mobile application's GPS functionality, defined as the location of a Consumer within a geographic area equal to or less than the area of a circle with a radius of 1,850 feet;
(b) Payment-card data, including credit card numbers, debit card numbers, card verification values (CVV), expiration dates, and other financial account credentials;
(c) Account login credentials, including username and password combinations, security questions and answers, and other authentication data;
(d) Social Security numbers, driver's license numbers, state identification card numbers, and passport numbers (applicable primarily to employee and applicant data);
(e) Any other categories of data falling within the definition of "sensitive personal information" under CCPA/CPRA Cal. Civ. Code § 1798.140(ae) or analogous definitions under other applicable state privacy statutes.
Tier 1 data is subject to the most stringent handling requirements described in Section 4.2 below.
Tier 2 — Personal Information (Standard PI)
Tier 2 data consists of PI that does not qualify as SPI under Tier 1 but that identifies, relates to, or is reasonably capable of being associated with or linked to a particular Consumer or household. Tier 2 data includes, without limitation:
(a) Identifiers, such as name, email address, telephone number, mailing address, Cascade Rewards member ID, and customer account number;
(b) Commercial information, including purchase history, product preferences, shopping-cart contents, return and exchange records, and transaction amounts;
(c) Internet and electronic network activity information, including browsing history on cascade.com, search queries, interaction data, clickstream data, session duration, page views, and interactions with the Cascade mobile application;
(d) Inferences drawn from PI for Consumer profiling, including purchasing propensity scores, product-affinity models, segmentation attributes, and behavioral predictions;
(e) Device identifiers, IP addresses, cookie data, advertising identifiers, and other online identifiers that are reasonably linkable to a Consumer or household.
Tier 3 — De-Identified / Aggregated Data
Tier 3 data consists of data that has been de-identified in accordance with the standards set forth in the CCPA/CPRA and other applicable state statutes, such that it cannot be reasonably linked, directly or indirectly, to any particular Consumer or household. Tier 3 also includes aggregated statistical data derived from PI that has been compiled in a manner that prevents identification of individual Consumers. Tier 3 data is subject to the de-identification safeguards described in Section 4.2 below and must be accompanied by contractual prohibitions on re-identification in any downstream agreements.
Tier 4 — Public / Non-PI
Tier 4 data consists of publicly available information (as defined under applicable law) and business-contact information pertaining to legal entities rather than natural persons. Tier 4 data is not subject to the handling requirements of this Manual, except to the extent that publicly available information loses its publicly available status under the CCPA/CPRA or another applicable statute (e.g., if a Consumer opts out of the sale/sharing of information that was previously publicly available, such information may no longer qualify as "publicly available" for purposes of the applicable statute).
4.2 Handling Requirements by Tier
The following handling requirements apply to each classification tier:
Tier 1 — Sensitive Personal Information (SPI):
(a) Encryption: All Tier 1 data must be encrypted at rest and in transit using industry-standard encryption protocols approved by the CISO.
(b) Consent: Separate, affirmative opt-in consent is required before processing precise geolocation data, in accordance with CCPA/CPRA Cal. Civ. Code § 1798.121 and analogous requirements under the VCDPA, CPA, CTDPA, and other applicable state statutes. Consumers must be presented with a clear, conspicuous consent mechanism before collection begins.