PRIVILEGED AND CONFIDENTIAL — ATTORNEY-CLIENT COMMUNICATION
RESOLUTION OF THE BOARD OF DIRECTORS OF CASCADE RETAIL HOLDINGS INC.
ADOPTION OF THE PRIVACY GOVERNANCE CHARTER
November 13, 2025
Prepared by: Calderwood & Harkness LLP Kevin Ostrowski, Partner, and Alan Burke, Senior Associate Privacy & Data Security Practice Group 600 Lexington Avenue, 28th Floor New York, NY 10022 Matter Number: 1038-00010
In Coordination with: Whitfield Greaves LLP Carolyn J. Marsden, Partner, Corporate & Securities 1999 K Street NW, Suite 700 Washington, D.C. 20006
For: Board of Directors Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
This document constitutes a privileged and confidential attorney-client communication prepared by Calderwood & Harkness LLP at the direction of the Board of Directors of Cascade Retail Holdings Inc. in connection with the provision of legal advice. This document is protected by the attorney-client privilege, the work-product doctrine, and all other applicable protections. Distribution of this document outside the Board of Directors, the Company's General Counsel, and the Company's designated outside counsel is prohibited without the prior written consent of Calderwood & Harkness LLP.
Right-click to update Table of Contents
I. RECITALS
WHEREAS, Cascade Retail Holdings Inc. ("Cascade" or the "Company"), a corporation duly organized and existing under the laws of the State of Delaware and publicly traded on the Nasdaq Global Select Market under the ticker symbol "CSRD," is an omnichannel retailer and e-commerce platform that reported approximately $3.87 billion in revenue for the fiscal year ended January 31, 2025 ("FY2024"), employs approximately 22,500 full-time and part-time employees across its operations, operates 186 retail locations in 31 states across the United States, maintains approximately 41.2 million registered members of the Cascade Rewards loyalty program, and processes approximately 94 million online transactions annually through its e-commerce platform (cascade.com) and mobile application;
WHEREAS, the Company operates through the following key operating subsidiaries, each of which processes significant volumes of personal information in connection with its respective business activities: (i) Cascade Digital Marketplace LLC, a Delaware limited liability company ("CDM"), which operates a third-party seller marketplace hosting approximately 3,800 active sellers; (ii) Ridgeline Fulfillment Services Inc., a Washington corporation ("Ridgeline"), which provides warehousing, order fulfillment, and logistics services in support of the Company's e-commerce and retail operations; (iii) Peakview Analytics Inc., a Delaware corporation ("Peakview Analytics"), which operates the Company's advertising technology stack and customer analytics infrastructure, processing approximately 2.1 billion consumer-event data records per month; and (iv) Cascade Rewards Corp., a Delaware corporation ("Cascade Rewards"), which administers the Company's loyalty program, stored-value card programs, and related customer-engagement services;
WHEREAS, the Company is subject to an extensive and rapidly expanding patchwork of privacy and data-protection statutes enacted by states across the United States, including the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA/CPRA"), and at least eighteen (18) additional state privacy statutes that are currently applicable or imminently effective across the jurisdictions in which the Company operates, resulting in a total of nineteen (19) applicable state privacy statutes as of the date of this resolution, as more particularly described in Exhibit C attached hereto;
WHEREAS, in recognition of the significance and complexity of the Company's privacy compliance obligations, the Board of Directors authorized the engagement of Calderwood & Harkness LLP on June 2, 2025 (Matter No. 1038-00010), to design, build, and implement a comprehensive US state-privacy compliance program (the "Privacy Program"), with work to proceed in two phases as described in the engagement letter and fee arrangement approved by the General Counsel;
WHEREAS, Calderwood & Harkness LLP delivered to the Company a comprehensive Gap-Analysis Report dated August 15, 2025 (the "Gap-Analysis Report"), which identified seven (7) material compliance deficiencies in the Company's then-existing privacy practices and infrastructure, specifically:
(i) the Company's then-current online privacy policy, last substantively updated in March 2022, did not address, reference, or provide the disclosures required by fourteen (14) of the nineteen (19) applicable state privacy statutes;
(ii) the Company had not implemented a universal opt-out mechanism, including recognition of the Global Privacy Control ("GPC") browser signal, as required by the CCPA/CPRA and an increasing number of other state privacy statutes;
(iii) personal information of third-party marketplace sellers on the CDM platform was commingled with first-party customer personal information in shared data-storage environments, without adequate logical or physical segregation controls;
(iv) twenty-three (23) of the forty-seven (47) third-party advertising and analytics partners identified in the Company's data ecosystem lacked executed data-processing agreements or other contractual provisions meeting the requirements of Applicable Privacy Laws;
(v) the Company was processing sensitive personal information — specifically, precise geolocation data collected through the Cascade mobile application — without obtaining the separate opt-in consent required under CCPA/CPRA Section 1798.121 and similar provisions of other applicable state statutes;
(vi) the Company had no documented, enterprise-wide data-retention and disposal schedule governing the retention periods for categories of personal information collected across its operations; and
(vii) the Company's consumer-rights intake portal lacked CCPA-standard identity-verification procedures and did not provide an appeal-process mechanism for denied or partially denied data-subject requests, as required under multiple applicable state privacy statutes;
WHEREAS, the Company has a prior regulatory history that underscores the importance of implementing a robust and defensible privacy governance framework, including: (a) a Civil Investigative Demand issued by the Federal Trade Commission on September 14, 2023 (FTC File No. 232-0147), which was closed with no enforcement action on April 3, 2024, following the Company's submission of responsive materials and cooperation with the investigation; and (b) an informal inquiry letter from the California Attorney General's Office dated February 6, 2024, to which the Company responded on March 8, 2024, with no enforcement action taken to date;
WHEREAS, in order to implement the technical and operational controls required by the Privacy Program, the Company has retained Fieldhaven Consulting Group LLC ("Fieldhaven") to deploy a consent-management platform, data-subject-request automation workflow, and data-mapping and inventory tooling under a fixed-fee statement of work valued at Three Million One Hundred Fifty Thousand Dollars ($3,150,000), with payment structured across three milestones, and has separately contracted with OnPoint Data Solutions Inc. ("OnPoint") for the licensing of a consent-management platform under a three-year term with a total contract value of One Million Four Hundred Forty Thousand Dollars ($1,440,000), with Calderwood & Harkness LLP providing oversight of the legal sufficiency of all work product delivered by such vendors;
WHEREAS, the Company maintains a cyber and privacy-liability insurance policy through Ridgepoint Insurance Brokers Inc., with coverage underwritten by Northcastle Indemnity Company, for the policy period of July 1, 2025 through June 30, 2026, providing limits of Twenty-Five Million Dollars ($25,000,000) per occurrence and Fifty Million Dollars ($50,000,000) in annual aggregate, at an annual premium of One Million Three Hundred Forty Thousand Dollars ($1,340,000);
WHEREAS, the Board of Directors recognizes that effective privacy governance requires clear lines of responsibility, accountability, and oversight at the board level, consistent with the Board's fiduciary duties of care and loyalty, and consistent with the Company's obligations as a publicly traded company to maintain adequate disclosure controls and internal controls over financial reporting, including with respect to privacy-related risks and liabilities that may be material to the Company's financial condition or results of operations; and
NOW, THEREFORE, BE IT RESOLVED, that the Board of Directors of Cascade Retail Holdings Inc. hereby adopts this Privacy Governance Charter (the "Charter") on the terms and conditions set forth herein, effective as of the date set forth in Section X below.
II. DEFINITIONS
For purposes of this Charter, the following terms shall have the meanings ascribed to them below. Capitalized terms used but not defined in this Section II shall have the meanings ascribed to them elsewhere in this Charter.
"Applicable Privacy Laws" means all United States state privacy and data-protection statutes that are applicable to the Company's business operations, including the collection, use, processing, storage, disclosure, sale, or sharing of personal information by the Company or any of its subsidiaries. As of the date of this Charter, Applicable Privacy Laws include the nineteen (19) state privacy statutes identified in Exhibit C hereto, as such statutes may be amended, supplemented, replaced, or interpreted by binding regulations, guidance, or judicial decisions from time to time, and any additional state privacy statutes that become applicable to the Company's operations after the date of this Charter.
"Audit & Risk Committee" means the Audit & Risk Committee of the Board of Directors of the Company, as constituted from time to time in accordance with the Company's bylaws and the Audit & Risk Committee Charter.
"Board" means the Board of Directors of Cascade Retail Holdings Inc.
"Chief Information Security Officer" or "CISO" means the officer of the Company responsible for the Company's information security program, currently Gregory Farris.
"Chief Privacy Officer" or "CPO" means the officer designated pursuant to Section III of this Charter as the senior officer with enterprise-wide responsibility for the Privacy Program.
"Company" means Cascade Retail Holdings Inc., a Delaware corporation, together with its wholly owned and majority-owned subsidiaries, including Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp.
"General Counsel" means the General Counsel of the Company, currently Meredith Tanaka.
"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined under the Applicable Privacy Laws. Where the Applicable Privacy Laws contain varying definitions of "personal information" (or the equivalent term used in a given statute), the CPO shall apply the broadest applicable definition for purposes of the Privacy Program, unless a narrower definition is appropriate in the context of compliance with a specific statute.
"Privacy Program" means the Company's comprehensive United States state-privacy compliance program, as designed and implemented with the assistance of Calderwood & Harkness LLP, Fieldhaven Consulting Group LLC, and OnPoint Data Solutions Inc., and as maintained and improved on an ongoing basis under the direction of the CPO.
"Privacy Steering Committee" means the cross-functional committee established pursuant to Section VII of this Charter.
"Sensitive Personal Information" means categories of personal information that receive heightened protection under Applicable Privacy Laws, including but not limited to precise geolocation data, financial account or payment-card information, account login credentials, racial or ethnic origin, health information, biometric information, and other categories designated as "sensitive" under the CCPA/CPRA and other applicable state privacy statutes.
III. ESTABLISHMENT AND APPOINTMENT OF THE CHIEF PRIVACY OFFICER
A. Creation of the CPO Role
The Board of Directors hereby formally establishes the position of Chief Privacy Officer as a senior leadership role within the Company. The CPO shall serve as the designated officer with enterprise-wide responsibility for the design, implementation, maintenance, and continuous improvement of the Privacy Program. The creation of this role reflects the Board's determination that the scope, complexity, and regulatory significance of the Company's privacy compliance obligations require dedicated senior leadership with the authority and resources to manage these obligations effectively across all business units and subsidiary entities.
The CPO position shall be a full-time role dedicated principally to privacy and data-protection compliance matters. The CPO shall not be assigned operational business responsibilities that would create conflicts of interest with the CPO's compliance oversight functions, nor shall the CPO's compensation or continued employment be contingent upon achieving business objectives that would compromise the independence of the CPO's compliance judgments.
B. Reporting Structure
The CPO shall report directly to the General Counsel of the Company, currently Meredith Tanaka. The General Counsel shall provide day-to-day management oversight of the CPO and shall ensure that the CPO has access to the legal resources, institutional knowledge, and cross-functional support necessary to fulfill the CPO's duties under this Charter.
In addition to the direct reporting relationship to the General Counsel, the CPO shall maintain a dotted-line reporting relationship to the Chief Executive Officer, currently Thomas R. Cavanaugh, to ensure that privacy and data-protection matters receive executive-level visibility, support, and prioritization within the Company's strategic and operational planning processes. The CEO shall be available to the CPO for consultation on matters of significant business impact and shall support the CPO's authority to implement privacy compliance measures across all business units.
The CPO shall have direct and unrestricted access to the Audit & Risk Committee of the Board of Directors for the escalation of material privacy-related matters, as further described in Section V.D of this Charter. The CPO's access to the Audit & Risk Committee shall not be conditioned upon the prior approval of the General Counsel, the CEO, or any other member of Company management, provided that the CPO shall, as a matter of professional courtesy, inform the General Counsel in advance of any direct communication with the Audit & Risk Committee except in circumstances where doing so would be impracticable or inappropriate. The reporting lines established under this Section III.B are illustrated in the organizational chart attached hereto as Exhibit B.
C. Interim Appointment
The Board acknowledges that the Company has not yet completed the hiring process for a permanent, full-time Chief Privacy Officer. Pending the completion of that process, which the Company expects to conclude by the fourth quarter of calendar year 2025, interim CPO responsibilities shall continue to be held by Diana Polk, Associate General Counsel, who has been serving in this capacity since June 2025 in connection with the launch of the Privacy Program. Ms. Polk shall exercise all of the duties, responsibilities, and authority assigned to the CPO under this Charter during the interim period.
Upon the appointment of a permanent CPO, the Board of Directors or the General Counsel, as appropriate, shall update the records of this Charter to reflect the identity of the permanent appointee. The transition of responsibilities from the interim CPO to the permanent CPO shall be managed by the General Counsel in consultation with Calderwood & Harkness LLP to ensure continuity of the Privacy Program.
D. Qualifications. The permanent Chief Privacy Officer shall possess the following qualifications and attributes: (i) demonstrated expertise in United States privacy and data-protection law, including substantive knowledge of the CCPA/CPRA and other state privacy statutes; (ii) significant experience in the design, implementation, and management of operational compliance programs, preferably in a retail, e-commerce, or consumer-facing technology environment; (iii) familiarity with the technical aspects of data governance, including data mapping, consent management, data-subject request automation, and privacy-enhancing technologies; (iv) strong cross-functional leadership and communication skills, with the ability to influence and coordinate across legal, information technology, marketing, operations, and other business functions; and (v) relevant professional certifications (such as CIPP/US, CIPM, or equivalent) are preferred but not required.
Calderwood & Harkness LLP has been advising the Company on the scope, reporting structure, and qualifications for the permanent CPO role, and the General Counsel shall continue to consult with Calderwood & Harkness LLP during the hiring process to ensure that the selected candidate is well-positioned to lead the Privacy Program.
IV. CPO DUTIES AND RESPONSIBILITIES
The Chief Privacy Officer shall have the duties and responsibilities set forth in this Section IV. These duties are intended to be comprehensive but not exhaustive; the CPO shall also undertake such additional privacy-related duties as may be reasonably assigned by the General Counsel, the CEO, or the Audit & Risk Committee from time to time.
A. Privacy Program Oversight
The CPO shall have overall responsibility for overseeing the Company's compliance with all nineteen (19) currently applicable state privacy statutes, as well as any additional statutes that become applicable to the Company's operations in the future. This oversight responsibility shall extend across all of the Company's business operations, including without limitation:
(i) the Company's direct-to-consumer retail operations conducted through its 186 retail store locations;
(ii) the Company's e-commerce operations conducted through cascade.com and the Cascade mobile application;
(iii) the third-party seller marketplace operated by Cascade Digital Marketplace LLC, including the privacy practices of the approximately 3,800 active sellers on the CDM platform;
(iv) the Cascade Rewards loyalty program and stored-value card programs operated by Cascade Rewards Corp., encompassing the personal information of approximately 41.2 million registered members;
(v) the advertising technology stack and customer analytics operations of Peakview Analytics Inc., including the processing of approximately 2.1 billion consumer-event data records per month;
(vi) the warehousing, fulfillment, and logistics operations of Ridgeline Fulfillment Services Inc.; and
(vii) the Company's vendor, service-provider, and business-partner data-sharing practices.
The CPO shall maintain and update the Company's suite of consumer-facing privacy notices to ensure compliance with all Applicable Privacy Laws. As of the date of this Charter, the privacy-notice suite includes the following documents, each of which is subject to ongoing review and revision by the CPO in consultation with Calderwood & Harkness LLP:
(a) the omnibus privacy policy for cascade.com and the Cascade mobile application;
(b) California-specific disclosures required under the CCPA/CPRA, including the notice at collection and the notice of right to opt out of sale and sharing;
(c) state-specific rights supplements for each jurisdiction with applicable privacy legislation;
(d) the cookie and tracking-technology notice;
(e) the employee and job-applicant privacy notice;
(f) the loyalty-program privacy notice for Cascade Rewards members; and
(g) the marketplace-seller privacy notice for CDM sellers.
The CPO shall ensure that all privacy notices are reviewed and updated no less frequently than annually, and on an ad hoc basis as required by changes in the Company's data practices, changes in Applicable Privacy Laws, or other material developments.
B. Data-Subject Rights Management
The CPO shall oversee the Company's consumer-rights intake and response process for data-subject requests ("DSRs") submitted by consumers exercising their rights under Applicable Privacy Laws. The categories of DSRs that the Company is required to process include, but are not limited to, requests for access to personal information, requests for deletion of personal information, requests for correction of inaccurate personal information, requests to opt out of the sale or sharing of personal information, and requests to limit the use and disclosure of sensitive personal information.
The CPO shall ensure that the Company's DSR response time meets or exceeds a target of fifteen (15) business days from the date of receipt of a verified request, representing a significant improvement over the Company's FY2024 average response time of approximately twenty-seven (27) calendar days. The CPO shall implement process improvements, automation tools, and staffing measures as necessary to achieve and sustain this target.
The CPO shall monitor and report on DSR metrics on a quarterly basis, including volume, category breakdown, average response time, completion rate, denial rate, and appeal outcomes. For reference, the Company's FY2024 DSR baseline was approximately 38,400 total requests, consisting of approximately 12,800 access requests, approximately 19,100 deletion requests, and approximately 6,500 opt-out requests. The CPO shall track year-over-year trends in DSR volume and shall ensure that the Company's DSR infrastructure is scalable to accommodate anticipated increases in request volume as consumer awareness of privacy rights continues to grow.
C. Vendor and Third-Party Oversight
The CPO shall oversee the execution and ongoing maintenance of data-processing agreements ("DPAs") with all third-party partners, vendors, and service providers that receive, access, or process personal information on behalf of the Company or its subsidiaries. As noted in the Gap-Analysis Report, as of August 15, 2025, twenty-three (23) of the forty-seven (47) advertising and analytics partners identified in the Company's data ecosystem lacked executed DPAs meeting the requirements of Applicable Privacy Laws. The CPO shall ensure that DPAs are executed with all such partners on a timeline consistent with the Phase 1 milestones set forth in Exhibit A.
The CPO shall oversee the restructured data-sharing arrangement between the Company and Thornbridge Media Corp. ("Thornbridge"), the Company's largest advertising and media-buying partner, with which the Company incurred approximately $18.4 million in annual spend during FY2024. The restructured arrangement, which was negotiated by Calderwood & Harkness LLP and executed on October 31, 2025, includes revised data-processing terms, limitations on secondary use of consumer data, audit rights, and indemnification provisions designed to align the relationship with the requirements of all Applicable Privacy Laws. The CPO shall monitor Thornbridge's ongoing compliance with the restructured agreement on a quarterly basis.
The CPO shall also monitor the ongoing compliance and deliverables of Fieldhaven Consulting Group LLC and OnPoint Data Solutions Inc. under their respective engagements, in coordination with the Company's information technology department and Calderwood & Harkness LLP.
D. Sensitive Personal Information
The CPO shall ensure that the Company's processing of sensitive personal information complies with CCPA/CPRA Section 1798.121 and all other applicable provisions of the Applicable Privacy Laws governing the collection, use, and disclosure of sensitive personal information. Categories of sensitive personal information processed by the Company include, but are not limited to:
(i) precise geolocation data collected through the Cascade mobile application;
(ii) payment-card data, including credit and debit card numbers, expiration dates, and security codes, processed in connection with e-commerce and in-store transactions;
(iii) account login credentials, including usernames, email addresses, and passwords or security questions, associated with customer accounts on cascade.com and the Cascade mobile application; and
(iv) any other categories of information classified as sensitive personal information under any of the Applicable Privacy Laws.
The CPO shall ensure that separate opt-in consent is obtained from consumers prior to the processing of sensitive personal information where required by Applicable Privacy Laws, and shall implement the technical and operational mechanisms necessary to honor consumer choices to limit the use and disclosure of sensitive personal information.
E. Data Governance
The CPO shall maintain and enforce the Company's data-retention and disposal schedule, which shall set forth the retention periods applicable to each category of personal information collected by the Company and its subsidiaries, the business and legal justifications for such retention periods, and the procedures for secure disposal of personal information at the end of the applicable retention period. The data-retention and disposal schedule shall be reviewed and updated no less frequently than annually.
The CPO shall oversee the implementation and maintenance of role-based access controls and data-segregation measures across the Company's data infrastructure. In particular, the CPO shall ensure the separation of third-party marketplace-seller data from first-party customer data, addressing the commingling deficiency identified in the Gap-Analysis Report. The CPO shall work with the CISO and the Company's information technology team to implement logical and, where appropriate, physical segregation controls that are sufficient to prevent unauthorized cross-access between data environments.
The CPO shall ensure that privacy-by-design principles are embedded in the development and deployment of new products, features, services, and vendor relationships through a formal Privacy Impact Assessment ("PIA") framework. The PIA framework shall require that all new initiatives involving the collection, use, or processing of personal information undergo a privacy review prior to launch, with the CPO (or the CPO's designee) responsible for approving, conditioning, or rejecting proposed initiatives based on the findings of the PIA.
F. Regulatory Affairs
The CPO shall serve as the Company's primary point of contact for privacy-related regulatory inquiries, investigations, and enforcement actions by state attorneys general, the Federal Trade Commission, and other regulatory bodies. The CPO shall coordinate with the General Counsel and with the Company's outside counsel, currently Calderwood & Harkness LLP (Privacy & Data Security) and Whitfield Greaves LLP (Corporate & Securities), on all matters involving regulatory response, including the preparation of responses to Civil Investigative Demands, subpoenas, informal inquiry letters, and other regulatory communications.
The CPO shall monitor legislative and regulatory developments across all jurisdictions in which the Company operates or to which the Company's data-processing activities are subject. Given that the Company operates retail locations in thirty-one (31) states and ships products to consumers in all fifty (50) states and the District of Columbia, the CPO shall maintain a comprehensive legislative-tracking function and shall promptly assess the impact of newly enacted or proposed privacy legislation on the Company's operations and compliance posture.
G. Training and Awareness
The CPO shall oversee the design, delivery, and administration of the Company's employee privacy training program. The training program shall be mandatory for all approximately 22,500 Company employees and shall include role-specific training modules tailored to the distinct privacy-related responsibilities of the following employee populations:
(i) retail store associates, with emphasis on in-store data collection practices, Cascade Rewards enrollment procedures, and consumer opt-out rights;
(ii) e-commerce, information technology, and engineering personnel, with emphasis on data handling, system access controls, privacy-by-design requirements, and incident reporting;
(iii) marketing and customer engagement personnel, with emphasis on advertising-technology compliance, consent-management requirements, and restrictions on the sale and sharing of personal information; and
(iv) human resources personnel, with emphasis on employee and job-applicant privacy obligations, data minimization, and retention requirements.
The CPO shall ensure that all employees complete the required privacy training annually and shall maintain records of training completion and employee acknowledgments. The CPO shall also develop supplemental training and awareness communications as needed to address emerging privacy risks, regulatory developments, and lessons learned from privacy incidents.
H. Incident Response
The CPO shall work closely with the Chief Information Security Officer (currently Gregory Farris) to ensure a coordinated and effective privacy-incident and data-breach response capability. The CPO and the CISO shall jointly maintain the Company's incident-response plan, which shall address the identification, containment, investigation, and remediation of privacy incidents and data breaches, as well as the notification obligations arising under Applicable Privacy Laws.
The CPO shall ensure timely notifications to regulators, affected individuals, and other required parties as mandated by Applicable Privacy Laws, including compliance with the varying notification timelines and content requirements imposed by different state statutes. The CPO shall also ensure timely notification to the Company's cyber and privacy-liability insurer, Northcastle Indemnity Company, as required by the terms of the Company's insurance policy, in order to preserve the Company's rights to coverage and to facilitate coordination with the insurer's panel counsel and forensic investigation resources.
V. AUDIT & RISK COMMITTEE OVERSIGHT RESPONSIBILITIES
A. Committee Role
The Audit & Risk Committee of the Board of Directors, currently chaired by Director Ellen Marchetti, shall serve as the Board-level body with primary oversight responsibility for the Company's Privacy Program. The Audit & Risk Committee's oversight of the Privacy Program is an extension of the Committee's existing mandate to oversee the Company's enterprise risk management framework, internal controls, and compliance programs. The Committee shall exercise this oversight responsibility in a manner consistent with its Charter and with the Board's expectations for informed and engaged oversight of material risk areas.
The designation of the Audit & Risk Committee as the primary Board-level oversight body does not diminish the full Board's ultimate responsibility for privacy and data-protection governance, as further described in Section VI of this Charter. The Audit & Risk Committee shall serve as the Board's principal channel for receiving information, evaluating risks, and providing direction with respect to the Privacy Program.
B. Quarterly Reporting
The CPO shall deliver written quarterly reports to the Audit & Risk Committee providing a comprehensive update on the status and performance of the Privacy Program. Each quarterly report shall address, at a minimum, the following topics:
(i) the status of the Company's compliance with each of the Applicable Privacy Laws, including identification of any jurisdictions in which compliance gaps remain unresolved;
(ii) data-subject request volume, category breakdown, average response time, completion rate, and trends relative to prior reporting periods;
(iii) vendor data-processing agreement coverage and compliance status, including the number of DPAs executed, pending, and outstanding;
(iv) a summary of regulatory developments, including newly enacted or proposed state privacy legislation, rulemaking activity, enforcement trends, and published regulatory guidance relevant to the Company's operations;
(v) a summary of any regulatory inquiries, investigations, or enforcement actions directed at the Company, together with the status of the Company's response to each such matter;
(vi) a summary of privacy incidents and data breaches during the reporting period, including the nature, scope, root cause, remediation status, and notification actions taken for each incident;
(vii) the status of remediation items arising from the Calderwood & Harkness LLP Gap-Analysis Report dated August 15, 2025, including a progress tracker identifying each of the seven material deficiencies and the actions taken to address them;
(viii) a budget and expenditure update for the Privacy Program, including a breakdown of outside-counsel fees, consulting and technology vendor expenditures, internal staffing costs, and any material variances from the approved budget;
(ix) an update on any open or anticipated regulatory matters, litigation, or claims involving privacy or data-protection issues; and
(x) a summary of material changes to the Company's data-processing activities, including new data collection practices, new vendor relationships, new product or feature launches involving personal information, and changes to the Company's data-sharing arrangements.
The quarterly reports shall be delivered to the Audit & Risk Committee no later than thirty (30) days following the end of each fiscal quarter. The CPO shall present the quarterly report in person (or by videoconference) at a regularly scheduled meeting of the Audit & Risk Committee and shall be available to respond to questions from Committee members.
C. Annual Privacy-Program Assessment
The CPO shall commission and deliver to the Audit & Risk Committee an annual comprehensive assessment of the Privacy Program (the "Annual Assessment"). The Annual Assessment shall evaluate the overall effectiveness of the Privacy Program, identify emerging privacy risks and regulatory trends, assess the adequacy of the Company's resources and capabilities for managing those risks, and recommend enhancements to the Privacy Program.
The first Annual Assessment shall be completed and delivered to the Audit & Risk Committee no later than June 30, 2026. Subsequent Annual Assessments shall be completed and delivered on an annual basis thereafter. The CPO may, in consultation with the General Counsel, engage Calderwood & Harkness LLP or another qualified outside firm to assist in the preparation of the Annual Assessment.
D. Escalation. The CPO shall promptly escalate to the Audit & Risk Committee, and, if appropriate under the circumstances, to the full Board of Directors, any matter involving one or more of the following:
(i) material regulatory enforcement risk, including the receipt of a Civil Investigative Demand, formal investigation notice, or other enforcement action from a state attorney general, the Federal Trade Commission, or any other regulatory body;
(ii) a significant data breach or privacy incident, including any incident that is reasonably likely to result in harm to a substantial number of consumers, require notification to one or more regulatory bodies, attract media attention, or trigger obligations under the Company's cyber and privacy-liability insurance policy;
(iii) the discovery of material non-compliance with any Applicable Privacy Law, including systemic failures of the Company's compliance controls, processes, or technology systems;
(iv) any event or development that is reasonably likely to have a material impact on the Company's financial condition, results of operations, reputation, or stock price, including but not limited to significant privacy-related litigation, class-action filings, or proposed regulatory settlements; or
(v) any other matter that, in the professional judgment of the CPO, warrants the attention of the Audit & Risk Committee or the Board.
Escalation under this Section V.D shall be made as promptly as practicable under the circumstances, and in no event later than forty-eight (48) hours after the CPO becomes aware of the triggering event. The CPO shall provide the Audit & Risk Committee with a written briefing on the matter within seventy-two (72) hours, together with a recommended course of action.
VI. BOARD-LEVEL OVERSIGHT AND GOVERNANCE PRINCIPLES
A. Board Oversight
The Board of Directors retains ultimate oversight responsibility for the Company's privacy and data-protection program as a component of the Company's enterprise risk management framework. The Board recognizes that privacy-related risks, including regulatory enforcement, litigation, reputational harm, and operational disruption, are among the material risks facing the Company and warrant informed, engaged, and ongoing Board-level attention.
The Audit & Risk Committee shall report to the full Board at least annually, and more frequently as warranted by the circumstances, on the status of the Privacy Program and any material privacy-related risks facing the Company. The full Board shall receive a copy of the Annual Assessment described in Section V.C, together with such additional reports and briefings as the Audit & Risk Committee or the CPO determines to be appropriate.
B. Coordination with Corporate Governance Counsel
The CPO and the General Counsel shall coordinate with Whitfield Greaves LLP (Carolyn J. Marsden, Partner, Corporate & Securities) on the securities-law and corporate-governance implications of the Privacy Program. This coordination shall include, without limitation:
(i) review and assessment of the Company's disclosure obligations with respect to privacy-related risks, liabilities, and regulatory matters in the Company's Annual Report on Form 10-K, Quarterly Reports on Form 10-Q, proxy statement, and other filings with the Securities and Exchange Commission;
(ii) evaluation of the adequacy of the Company's risk-factor disclosures related to privacy and data protection;
(iii) assessment of the Privacy Program's implications for the Company's internal control over financial reporting and disclosure controls and procedures; and
(iv) guidance on corporate-governance best practices for board-level privacy oversight.
Communications between Calderwood & Harkness LLP and Whitfield Greaves LLP regarding the Privacy Program shall be governed by the Common-Interest Agreement dated June 10, 2025, executed by both firms and the Company, which establishes the terms for the sharing of privileged and confidential information in furtherance of the parties' common legal interest in the design and implementation of the Privacy Program.
C. Coordination with External Auditor
The CPO shall coordinate with Lakemont Audit Partners LLP, the Company's independent registered public accounting firm (Sheila Brogan, Engagement Partner), on matters of mutual relevance, including the overlap between the Company's privacy controls and its SOC 2 controls environment, and the internal-control implications of the Privacy Program. The CPO shall ensure that the external auditor is informed of material changes to the Company's data-processing environment, significant privacy incidents, and other developments that may be relevant to the external auditor's assessment of the Company's internal controls and financial reporting risks.
D. Insurance Coordination
The CPO shall ensure that the Company's cyber and privacy-liability insurance coverage adequately reflects the Company's risk profile and the scope of the Company's data-processing activities. The Company currently maintains a cyber and privacy-liability insurance policy through Ridgepoint Insurance Brokers Inc., with coverage underwritten by Northcastle Indemnity Company, providing limits of Twenty-Five Million Dollars ($25,000,000) per occurrence and Fifty Million Dollars ($50,000,000) in annual aggregate, for the policy period of July 1, 2025 through June 30, 2026, at an annual premium of One Million Three Hundred Forty Thousand Dollars ($1,340,000).
The CPO shall review the Company's insurance coverage at least annually, in coordination with the General Counsel and the Company's insurance broker, and shall report any material gaps in coverage to the Audit & Risk Committee. The CPO shall also ensure that the Company's incident-response procedures include timely notification to the insurer as required by the policy terms.
VII. CROSS-FUNCTIONAL COORDINATION
The CPO shall establish and chair a cross-functional Privacy Steering Committee (the "Steering Committee") to facilitate coordination and communication across the Company's business units and functional areas on privacy and data-protection matters. The Steering Committee shall be composed of representatives from the following departments and entities:
(i) Legal (General Counsel's office);
(ii) Information Security (Chief Information Security Officer Gregory Farris or designee);
(iii) Data & Analytics (Vice President Priya Nandakumar or designee);
(iv) Marketing & Customer Engagement (Vice President Jason Leclaire or designee);
(v) Information Technology / E-Commerce;
(vi) Human Resources;
(vii) Retail Operations;
(viii) Cascade Digital Marketplace LLC;
(ix) Cascade Rewards Corp.; and
(x) Ridgeline Fulfillment Services Inc.
The Steering Committee shall meet no less frequently than monthly. The CPO shall prepare and distribute an agenda for each meeting and shall maintain minutes of each meeting. The Steering Committee shall serve as a forum for coordinating privacy compliance initiatives across business units, identifying and resolving cross-functional privacy issues, reviewing Privacy Impact Assessments for new products and initiatives, sharing regulatory developments and enforcement trends, and ensuring consistent application of the Company's privacy policies and standards.
The CPO may invite additional participants to Steering Committee meetings on an ad hoc basis, including representatives of Calderwood & Harkness LLP, Fieldhaven Consulting Group LLC, and other outside advisors, as warranted by the topics under discussion. The CPO may also establish subcommittees or working groups of the Steering Committee to address specific topics, such as vendor management, data-subject rights operations, or marketing-technology compliance.
VIII. RESOURCES, BUDGET, AND OUTSIDE ADVISORS
A. Staffing and Budget
The CPO shall be provided with adequate internal staffing and budget resources to fulfill the obligations set forth in this Charter. The Board of Directors acknowledges the importance of providing sufficient resources to the Privacy Program and recognizes that the scope of the Company's privacy compliance obligations, the complexity of the regulatory landscape, and the scale of the Company's data-processing activities require a sustained and meaningful investment of financial and human resources.
The Board acknowledges the following current program expenditures:
The CPO and the General Counsel shall prepare and submit an annual Privacy Program budget for approval by the Audit & Risk Committee. The annual budget shall include projected expenditures for internal staffing, outside counsel, consulting and technology vendors, training, insurance, and other program-related costs.
B. Authority to Engage Outside Advisors
The CPO, in coordination with the General Counsel, shall have authority to engage or direct the engagement of outside privacy counsel, technical consultants, forensic investigators, and other advisors as needed to support the Privacy Program, subject to the Company's procurement policies and budget-approval processes. In circumstances involving an actual or suspected data breach or regulatory enforcement action, the CPO shall have authority to engage outside advisors on an expedited basis, with after-the-fact ratification by the General Counsel as necessary.
The CPO shall maintain a current roster of pre-approved outside advisors and shall ensure that engagement terms, including fee arrangements and scope-of-work descriptions, are documented in writing and approved by the General Counsel prior to the commencement of work.
IX. CHARTER REVIEW AND AMENDMENT
This Charter shall be reviewed at least annually by the Audit & Risk Committee, with the first such review to be conducted no later than November 2026. The annual review shall assess the continued adequacy and appropriateness of the Charter in light of changes in the Company's business operations, the regulatory landscape, industry best practices, and the maturity of the Privacy Program.
Amendments to this Charter shall require the approval of the Audit & Risk Committee. The Audit & Risk Committee may also refer proposed amendments to the full Board of Directors for approval at the Committee's discretion or when the proposed amendments involve changes to the Board's own oversight responsibilities or the CPO's escalation and reporting obligations.
The CPO and the General Counsel shall be responsible for proposing amendments to the Charter as warranted by developments in the Company's privacy compliance posture, changes in Applicable Privacy Laws, or recommendations arising from the Annual Assessment or from regulatory guidance.
X. EFFECTIVE DATE
This Charter shall become effective immediately upon adoption by the Board of Directors on November 13, 2025. All obligations, duties, and responsibilities established under this Charter shall be in effect as of such date, including the reporting and escalation obligations set forth in Sections IV, V, and VI.
XI. CERTIFICATION AND SIGNATURES
The undersigned hereby certify the adoption of this Resolution and the Privacy Governance Charter attached hereto by the Board of Directors of Cascade Retail Holdings Inc. at a duly noticed and convened meeting of the Board held on November 13, 2025, at which a quorum was present and acting throughout.
APPROVED AND ADOPTED:
BOARD OF DIRECTORS OF CASCADE RETAIL HOLDINGS INC.
By: ________
Name: Robert J. Alderman
Title: Chair of the Board of Directors
Date: November 13, 2025
CERTIFIED:
By: ________
Name: Lauren C. Fujimoto
Title: Secretary of the Board of Directors
Date: November 13, 2025
This Resolution and Privacy Governance Charter were drafted by Kevin Ostrowski, Partner, and Alan Burke, Senior Associate, of Calderwood & Harkness LLP, Privacy & Data Security Practice Group (Matter No. 1038-00010), in coordination with Carolyn J. Marsden, Partner, Corporate & Securities, of Whitfield Greaves LLP.
EXHIBIT A
Privacy Program Phase 1 Milestone Summary (Informational Reference)
The following table sets forth the Phase 1 milestones and target dates for the Company's Privacy Program, as established in the Calderwood & Harkness LLP engagement and as updated through the date of this Charter. This Exhibit A is provided for informational reference only and does not create any independent obligations beyond those set forth in the body of this Charter.
Note: Phase 2 (January 1, 2026 – June 30, 2026) is expected to encompass ongoing monitoring, additional state-law compliance buildouts, training program deployment, privacy-program maturity enhancements, and preparation for the first Annual Assessment. Phase 2 fees are estimated at $1,400,000 – $1,800,000 on an hourly basis with no fee cap.
EXHIBIT B
Organizational Chart — CPO Reporting Lines
The following describes the reporting relationships and coordination lines established under Section III and Section VII of this Charter for the Chief Privacy Officer role.
Primary Reporting Line
Chief Privacy Officer (currently interim: Diana Polk, Associate General Counsel)
→ Reports directly to: General Counsel (Meredith Tanaka)