CALIFORNIA-SPECIFIC PRIVACY DISCLOSURES ADDENDUM
Supplemental CCPA/CPRA Disclosures for California Consumers
Cascade Retail Holdings Inc. A Delaware corporation (Nasdaq: CSRD) 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Effective Date: September 12, 2025
Relationship to Omnibus Privacy Policy. This California-Specific Privacy Disclosures Addendum (this "Addendum") supplements the Cascade Retail Holdings Inc. Omnibus Privacy Policy (also dated September 12, 2025) (the "Omnibus Privacy Policy") and provides additional disclosures required under the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100–1798.199.100, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA"). This Addendum is intended to provide California consumers with clear, comprehensive, and specific information about Cascade's data practices as they relate to rights and obligations arising under the CCPA. In the event of a conflict between this Addendum and the Omnibus Privacy Policy, this Addendum controls with respect to California consumers. This Addendum should be read in conjunction with the Omnibus Privacy Policy, which contains additional information about Cascade's privacy practices that are not specific to California law.
Applicable Entities. This Addendum applies to the personal information practices of Cascade Retail Holdings Inc. and its wholly owned subsidiaries: Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. (collectively, "Cascade," "we," "us," or "our"). Each of these entities may independently collect, use, disclose, or otherwise process personal information of California consumers in connection with the products, services, and operations described herein. For purposes of the CCPA, each entity acts as a "business" to the extent it independently determines the purposes and means of processing personal information, or as a "service provider" or "contractor" when processing personal information on behalf of another Cascade entity.
Replaces. This Addendum replaces and supersedes in its entirety the prior online privacy policy of Cascade Retail Holdings Inc. last updated in March 2022 as it pertains to California-specific disclosures.
Prepared by: Sara Hendricks, Associate, Privacy & Data Security, Calderwood & Harkness LLP. Reviewed by: Alan Burke, Senior Associate, and Kevin Ostrowski, Partner, Privacy & Data Security, Calderwood & Harkness LLP.
Right-click to update Table of Contents
Section 1: Scope and Applicability
This Addendum applies to individuals who are "consumers" as defined under the CCPA — that is, natural persons who are residents of the State of California, however identified, including by any unique identifier. Cal. Civ. Code § 1798.140(i). This Addendum does not apply to individuals who are not California residents, and the rights and disclosures described herein are available only to the extent required by the CCPA.
Covered Data Collection Channels. This Addendum covers personal information ("PI") that Cascade collects, uses, discloses, sells, or shares through the following channels:
• cascade.com, including the cascade.com/marketplace online marketplace operated by Cascade Digital Marketplace LLC;
• The Cascade mobile application, available for download on iOS and Android platforms;
• Cascade's 186 retail store locations across the United States, including all retail locations situated in the State of California;
• The Cascade Rewards loyalty program, administered by Cascade Rewards Corp., which has approximately 41.2 million registered members nationwide, including members residing in California;
• Customer-service interactions, including telephone calls, email correspondence, live chat, and social-media communications; and
• Third-party sources, including data brokers, advertising and analytics partners, publicly available databases, and third-party sellers operating on the Cascade Digital Marketplace.
CCPA Applicability Thresholds. Cascade confirms that it meets the thresholds for CCPA applicability set forth in Cal. Civ. Code § 1798.140(d). Specifically, Cascade's annual gross revenue for the fiscal year ended January 31, 2024 ("FY2024") was approximately $3.87 billion, which exceeds the $25 million threshold (as adjusted). Additionally, Cascade processes approximately 94 million annual online transactions, and through its retail, e-commerce, and loyalty operations, annually buys, sells, or shares the personal information of well in excess of 100,000 California consumers. Cascade operates across all 50 states and the District of Columbia.
Employee and Job-Applicant Data. Cascade employs approximately 22,500 individuals across its operations. Personal information of employees, job applicants, contractors, and other individuals collected in an employment or pre-employment context is addressed in a separate Employee & Job-Applicant Privacy Notice, which is available at cascade.com/employee-privacy and is provided to employees and applicants at the time of data collection. This Addendum does not apply to such personal information except to the extent expressly stated herein.
Key Definitions. As used throughout this Addendum, the following terms have the meanings ascribed to them under the CCPA, as summarized below:
• "Personal information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Cal. Civ. Code § 1798.140(v).
• "Sensitive personal information" means personal information that reveals a consumer's Social Security number, driver's license or state identification number, account log-in credentials, financial account information, precise geolocation, racial or ethnic origin, religious beliefs, union membership, mail/email/text content (where the business is not the intended recipient), genetic data, biometric information, health information, or sex-life/sexual-orientation information. Cal. Civ. Code § 1798.140(ae).
• "Sale" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for monetary or other valuable consideration. Cal. Civ. Code § 1798.140(ad).
• "Sharing" means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer's personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions in which no money is exchanged. Cal. Civ. Code § 1798.140(ah).
• "Service provider" means a person that processes personal information on behalf of a business and that receives from or on behalf of the business a consumer's personal information for a business purpose pursuant to a written contract. Cal. Civ. Code § 1798.140(ag).
• "Contractor" means a person to whom the business makes available a consumer's personal information for a business purpose, pursuant to a written contract with the business. Cal. Civ. Code § 1798.140(j).
• "Third party" means a person who is not the business with which the consumer intentionally interacts, a service provider, or a contractor. Cal. Civ. Code § 1798.140(ai).
• "Business purpose" means the use of personal information for the business's operational purposes, or other notified purposes, provided that the use of personal information is reasonably necessary and proportionate to achieve the purpose for which the personal information was collected or processed. Cal. Civ. Code § 1798.140(e).
• "Commercial purpose" means to advance a person's commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction. Cal. Civ. Code § 1798.140(f).
These definitions are provided for the convenience of the reader. In all cases, the statutory definitions under the CCPA govern.
Section 2: Categories of Personal Information Collected
The following table describes the categories of personal information, as enumerated in Cal. Civ. Code § 1798.140(v), that Cascade has collected from or about California consumers during the preceding twelve (12) months, together with examples specific to Cascade's operations. Not all examples listed in each category will have been collected about every consumer; the specific personal information collected depends on the consumer's interactions with Cascade's products, services, and platforms.
Cascade does not collect the following categories of sensitive personal information: Social Security numbers, driver's license or state identification card numbers, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of a consumer's mail, email, or text messages (where Cascade is not the intended recipient), genetic data, biometric information for the purpose of uniquely identifying a consumer, or information concerning a consumer's health, sex life, or sexual orientation.
Section 3: Sources of Personal Information
Cascade collects personal information from the following categories of sources:
3.1 Directly from California Consumers. Cascade collects personal information directly from California consumers when they:
• Create or update a Cascade online account or Cascade Rewards membership;
• Make a purchase through cascade.com, the Cascade mobile application, or at a Cascade retail location;
• Enroll in or interact with the Cascade Rewards loyalty program;
• Contact Cascade through customer-service channels, including telephone, email, live chat, or social media;
• Submit product reviews, ratings, or feedback;
• Enter a sweepstakes, contest, or promotion sponsored by Cascade;
• Subscribe to Cascade marketing communications, newsletters, or promotional alerts;
• Use the Cascade mobile application, including features that request access to device permissions such as location services, camera, or contacts;
• Interact with Cascade's social-media pages or accounts; or
• Respond to surveys or participate in consumer-research programs.
3.2 Automatically via Cookies, Pixels, and Tracking Technologies. Cascade automatically collects personal information when consumers visit cascade.com or use the Cascade mobile application through the use of twelve (12) categories of cookies and tracking technologies, including but not limited to cookies, web beacons (pixels), software development kits (SDKs), local storage objects, and similar technologies. These technologies collect information such as IP addresses, device identifiers, browser type and version, operating system, referring URLs, pages visited, links clicked, interaction with advertisements, and session duration. Additional details regarding Cascade's use of cookies and tracking technologies are set forth in the Cookie Notice available at cascade.com/cookies.
3.3 From Cascade Digital Marketplace Third-Party Sellers. Cascade Digital Marketplace LLC operates an online marketplace on which approximately 3,800 third-party sellers offer products to consumers. In connection with marketplace transactions, Cascade receives personal information about consumers from third-party sellers, including order details, shipping information, and customer-service communications related to marketplace purchases.
3.4 From Third-Party Advertising and Analytics Partners. Cascade receives personal information from approximately 47 third-party advertising and analytics partners. These partners include programmatic-advertising platforms, demand-side platforms, advertising networks, social-media advertising platforms, data-management platforms, and website-analytics providers. The personal information received from these partners includes cookie identifiers, device identifiers, interest segments, audience attributes, and ad-engagement data. The identity and data-sharing practices of these 47 partners were documented in a comprehensive data-mapping audit conducted by Fieldhaven Consulting Group LLC and completed on May 19, 2025.
3.5 From Data Brokers and Publicly Available Sources. Cascade may obtain personal information from licensed data brokers and from publicly available sources, including public records, public social-media profiles, and other publicly accessible information. Such information may be used to supplement and enhance existing consumer records for purposes of identity verification, fraud prevention, and marketing.
Section 4: Business and Commercial Purposes for Collection, Use, and Disclosure
Cascade collects, uses, and discloses the personal information described in Section 2 above for the following business and commercial purposes:
4.1 Business Purposes
As that term is defined in Cal. Civ. Code § 1798.140(e), Cascade uses personal information for the following business purposes:
Performing Services. Cascade uses personal information to perform services on behalf of or at the direction of the consumer, including:
• Processing and fulfilling consumer orders, including order confirmation, payment authorization, and shipping and delivery logistics. Ridgeline Fulfillment Services Inc. provides fulfillment and logistics services for orders placed through cascade.com and the Cascade mobile application, processing personal information including consumer names, shipping addresses, telephone numbers, and order details.
• Processing payments and refunds, including credit card and debit card transactions, through Cascade's payment-processing infrastructure and third-party payment processors.
• Providing customer service, including responding to inquiries, processing returns and exchanges, resolving complaints, and managing warranty claims.
• Managing consumer accounts, including maintaining account profiles, updating account information, and administering account preferences and settings.
• Administering the Cascade Rewards loyalty program, including enrollment, points accrual, points redemption, tier-status management, and delivery of member benefits. Cascade Rewards Corp. manages the Cascade Rewards program and processes personal information in connection with program administration.
Auditing and Security. Cascade uses personal information for auditing, security, and fraud-prevention purposes, including:
• Detecting, preventing, and responding to security incidents, including unauthorized access, data breaches, and other threats to Cascade's information systems and consumer data.
• Conducting fraud prevention and detection activities in connection with consumer transactions, account creation, and payment processing.
• Verifying consumer identity in connection with account access, data-subject requests, and high-risk transactions.
• Maintaining and auditing consumer interaction and transaction logs for compliance, dispute-resolution, and regulatory purposes.
• Cascade's information-security operations are overseen by Chief Information Security Officer Gregory Farris, who reports to the Interim Chief Privacy Officer and the Chief Technology Officer.
Short-Term, Transient Use. Cascade uses personal information for short-term, transient uses, including contextual advertising customization that does not involve the building of a consumer profile or the alteration of a consumer's experience outside of the current interaction.
Internal Research and Development. Cascade uses personal information for internal research, technological development, and product improvement, including:
• Analyzing consumer behavior, preferences, and trends to improve products, services, and the consumer experience across Cascade's platforms.
• Conducting A/B testing and experimentation to optimize website and mobile-application functionality, user-interface design, and content presentation.
• Developing and improving analytics models and algorithms, including those operated by Peakview Analytics Inc., to enhance product recommendations, search relevance, and personalization capabilities.
Quality and Safety Maintenance. Cascade uses personal information to maintain the quality and safety of its services, products, and platforms, including debugging, identifying and repairing errors and defects in existing intended functionality, and conducting internal testing and quality assurance.
Administering Loyalty and Rewards Program. Cascade Rewards Corp. processes personal information in connection with the operation of the Cascade Rewards loyalty program, including managing member accounts, calculating and applying points, delivering personalized offers and rewards, and communicating with members regarding program benefits and updates.
4.2 Commercial Purposes
As that term is defined in Cal. Civ. Code § 1798.140(f), Cascade uses personal information for the following commercial purposes:
Advertising and Marketing. Cascade uses personal information for advertising and marketing activities, including:
• Programmatic advertising, including real-time bidding and audience targeting through demand-side platforms and advertising exchanges.
• Audience targeting and segmentation, including the creation of custom and lookalike audiences for use in digital-advertising campaigns.
• Cross-context behavioral advertising, which involves the targeting of advertising to a consumer based on the consumer's personal information obtained from the consumer's activity across businesses, distinctly branded websites, applications, or services other than the business, distinctly branded website, application, or service with which the consumer intentionally interacts.
• Advertising measurement and attribution, including the tracking of ad impressions, clicks, conversions, and return on ad spend.
• Cascade's primary programmatic-advertising partner is Thornbridge Media Corp. Cascade's advertising spend with Thornbridge Media Corp. during FY2024 was approximately $18.4 million. Data shared with Thornbridge Media Corp. for cross-context behavioral advertising purposes is described in Section 5 below.
Personalization of Consumer Experience. Cascade uses personal information to personalize the consumer experience across omnichannel touchpoints, including cascade.com, the Cascade mobile application, email communications, in-store experiences, and interactions with customer service. Personalization activities include product recommendations, content curation, tailored search results, and individualized offers and promotions.
Section 5: Categories of Personal Information Sold or Shared in the Preceding 12 Months
Disclosure Regarding Sales and Sharing. Cascade "sells" and "shares" personal information as those terms are defined under the CCPA. Specifically, Cascade shares personal information with advertising and analytics partners for the purpose of cross-context behavioral advertising. In some instances, these transfers may also constitute a "sale" within the meaning of the CCPA because they involve the disclosure of personal information to a third party for monetary or other valuable consideration.
Cascade's primary cross-context behavioral advertising partner is Thornbridge Media Corp., which serves as Cascade's primary programmatic-advertising partner and receives consumer behavioral data for purposes of ad targeting, audience segmentation, and campaign measurement.
The following table describes the categories of personal information that Cascade has sold or shared with third parties in the preceding twelve (12) months, the categories of third-party recipients, and the purposes for such sales or sharing:
Minors. Cascade does not sell or share the personal information of consumers it knows to be under sixteen (16) years of age without affirmative authorization as required by Cal. Civ. Code § 1798.120(c). For additional information regarding Cascade's practices with respect to children's personal information, see Section 15 below.
Sensitive Personal Information. The sharing practices applicable to precise geolocation data, which constitutes sensitive personal information, are addressed in Section 8 of this Addendum. To the extent approximate geolocation data derived from IP addresses is shared as described above, such data does not constitute sensitive personal information under the CCPA.
Ongoing Restructuring of Data-Sharing Arrangements. Cascade is actively restructuring its data-sharing arrangements to enhance CCPA compliance. The following initiatives are currently underway:
• Thornbridge Media Corp. Data-Sharing Agreement: Cascade is in the process of negotiating and executing a restructured data-sharing agreement with Thornbridge Media Corp. that includes express provisions addressing the classification of data transfers as sales and/or sharing under the CCPA, opt-out pass-through requirements, data-minimization obligations, purpose-limitation restrictions, and audit rights. The target execution date for the restructured agreement is October 31, 2025.
• Data Processing Agreements with Advertising and Analytics Partners: As of the date of this Addendum, 23 of Cascade's 47 advertising and analytics partners do not have executed CCPA-compliant data processing agreements in place. Cascade is actively deploying DPAs to these partners, with a target completion date of December 31, 2025. Additional detail is provided in Section 14 below.
Section 6: Categories of Personal Information Disclosed for a Business Purpose in the Preceding 12 Months
The following table describes the categories of personal information that Cascade has disclosed to service providers or contractors for a business purpose in the preceding twelve (12) months, together with the categories of service providers and contractors that received such personal information:
Contractual Safeguards. All service providers and contractors processing personal information on Cascade's behalf are contractually bound under CCPA-compliant data processing agreements that include restrictions on the use, retention, and further disclosure of personal information, as well as obligations to assist Cascade in responding to consumer requests and to notify Cascade of any data breaches or unauthorized access. Additional information regarding Cascade's contractual safeguards is provided in Section 14 below.
Section 7: Retention Periods by Category of Personal Information
Cascade retains personal information for the periods described in the table below, or for such longer period as may be necessary to comply with applicable law, resolve disputes, enforce agreements, or fulfill legitimate business purposes. The retention periods set forth below represent the maximum period for which each category of personal information is retained following the triggering event described.
Data Retention & Disposal Schedule. Cascade has implemented a formal Data Retention & Disposal Schedule, effective October 2025. This schedule was developed in consultation with Fieldhaven Consulting Group LLC and Calderwood & Harkness LLP to address a prior gap in Cascade's privacy-compliance program, under which no documented, enterprise-wide data retention schedule existed. The Data Retention & Disposal Schedule governs the retention and secure disposal of all categories of personal information collected by Cascade and its subsidiaries and is reviewed and updated on at least an annual basis.
Section 8: Sensitive Personal Information — Use and Disclosure
8.1 Categories of Sensitive Personal Information Collected
As described in Section 2 above, Cascade collects the following categories of sensitive personal information from California consumers:
(a) Precise geolocation data. Cascade collects precise geolocation data (latitude and longitude coordinates) through the Cascade mobile application when a consumer grants location-services permission on the consumer's mobile device. Precise geolocation data is defined under the CCPA as any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet. Cal. Civ. Code § 1798.140(w).
(b) Account log-in credentials. Cascade collects and maintains account log-in credentials consisting of a username in combination with a password or security question and answer that would permit access to the consumer's Cascade online account.
(c) Payment-card data. Cascade collects debit card and credit card numbers in combination with any required security or access code, password, or credentials allowing access to the consumer's financial account, in connection with processing consumer transactions.
8.2 Purposes for Which Sensitive Personal Information Is Used
Cascade uses sensitive personal information only for the following purposes:
(a) Precise geolocation data is used to: (i) power the store-locator feature within the Cascade mobile application, enabling consumers to locate nearby Cascade retail stores; (ii) display local inventory availability, allowing consumers to determine whether products are in stock at nearby stores; and (iii) deliver location-based notifications within the mobile application, including alerts regarding nearby store promotions and events, when the consumer has opted in to receive such notifications.
(b) Account log-in credentials are used to: authenticate consumer identity during the log-in process, maintain account security, detect and prevent unauthorized account access, and support password-recovery and account-recovery functionality.
(c) Payment-card data is used to: process consumer payments, authorize transactions, process refunds and chargebacks, and support fraud-prevention and fraud-detection activities in connection with consumer transactions.
8.3 Limitation on Use and Disclosure
Cascade does not use or disclose sensitive personal information for purposes beyond those authorized under Cal. Civ. Code § 1798.121, which limits the use and disclosure of sensitive personal information to purposes that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, and as otherwise authorized by applicable CCPA regulations. Cascade does not use sensitive personal information for advertising, marketing, profiling, or any purpose that is not necessary to provide the goods or services requested by the consumer.
8.4 Remedial Measure — Precise Geolocation Consent
Cascade acknowledges that, prior to the implementation of the current privacy-compliance program, precise geolocation data collected through the Cascade mobile application was processed without obtaining separate, affirmative opt-in consent from consumers as required under the CCPA/CPRA for the collection and use of sensitive personal information. As a remedial measure, Cascade has implemented a separate, granular consent flow within the Cascade mobile application that clearly discloses the collection and use of precise geolocation data and requires the consumer's affirmative opt-in before such data is collected. This consent flow was deployed in the mobile-application update released on August 15, 2025 (version 7.4.0 for iOS and version 7.4.1 for Android).
8.5 Right to Limit Use and Disclosure of Sensitive Personal Information
California consumers have the right to direct Cascade to limit the use and disclosure of their sensitive personal information to uses that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, and as authorized by applicable CCPA regulations. Consumers may exercise this right by:
• Clicking the "Limit the Use of My Sensitive Personal Information" link available on cascade.com and in the Cascade mobile application;
• Submitting a request through the DSR portal at cascade.com/privacy;
• Calling Cascade toll-free at 1-888-527-2233; or
• Emailing privacy@cascade.com.
Upon receipt of a valid request, Cascade will limit the use and disclosure of the consumer's sensitive personal information and will direct its service providers and contractors to do the same in accordance with applicable CCPA requirements.
Section 9: California Consumer Rights
Under the CCPA, California consumers have the following rights with respect to their personal information. This section describes each right and how it may be exercised. For information on how to submit requests, see Section 11 below.
9.1 Right to Know / Right to Access (Cal. Civ. Code §§ 1798.100, 1798.110, 1798.115)
California consumers have the right to request that Cascade disclose the following information about Cascade's collection, use, disclosure, sale, and sharing of the consumer's personal information:
(a) The categories of personal information Cascade has collected about the consumer;
(b) The categories of sources from which the personal information was collected;
(c) The business or commercial purposes for collecting, selling, or sharing the personal information;
(d) The categories of third parties to whom Cascade has disclosed, sold, or shared the personal information;
(e) The specific pieces of personal information Cascade has collected about the consumer; and
(f) The categories of personal information that Cascade has sold or shared about the consumer and the categories of third parties to whom each category was sold or shared, as well as the categories of personal information that Cascade has disclosed for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
These disclosures generally cover the twelve (12) month period preceding Cascade's receipt of the consumer's verifiable request. For verifiable requests made on or after January 1, 2023, Cascade will provide information beyond the twelve-month period where feasible, taking into account factors such as the availability of the information, the burden and cost of providing the information, and the length of the period for which the information is requested, in accordance with Cal. Civ. Code § 1798.145(s).
Cascade will deliver the requested information to the consumer free of charge within the timeframes described in Section 11, in a readily usable and portable format that allows the consumer to transmit the information from one entity to another entity without hindrance.
9.2 Right to Delete (Cal. Civ. Code § 1798.105)
California consumers have the right to request that Cascade delete personal information that Cascade has collected from the consumer, subject to certain exceptions. Upon receipt of a verifiable consumer request for deletion, Cascade will delete the consumer's personal information from its records and will direct its service providers and contractors to delete the consumer's personal information from their records, unless an exception applies.
Cascade may deny a deletion request if retention of the personal information is necessary for Cascade or its service providers or contractors to:
(a) Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall, provide a good or service requested by the consumer, or reasonably anticipated within the context of Cascade's ongoing business relationship with the consumer, or otherwise perform a contract between Cascade and the consumer;
(b) Help to ensure security and integrity of its systems, to the extent the use of the consumer's personal information is reasonably necessary and proportionate for those purposes;
(c) Debug to identify and repair errors that impair existing intended functionality;
(d) Exercise free speech, ensure the right of another consumer to exercise that consumer's right of free speech, or exercise another right provided for by law;
(e) Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
(f) Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws;
(g) Enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer's relationship with Cascade;
(h) Comply with a legal obligation, including federal, state, or local tax-reporting and record-retention requirements; or
(i) Otherwise use the consumer's personal information internally in a lawful manner that is compatible with the context in which the consumer provided the information.
If Cascade denies a deletion request in whole or in part, Cascade will inform the consumer of the basis for the denial and provide information about how to appeal the decision, as described in Section 11 below.
9.3 Right to Correct Inaccurate Personal Information (Cal. Civ. Code § 1798.106)
California consumers have the right to request that Cascade correct inaccurate personal information that Cascade maintains about the consumer. Upon receipt of a verifiable consumer request for correction, Cascade will use commercially reasonable efforts to correct the inaccurate personal information, taking into account the nature of the personal information and the purposes of processing the consumer's personal information. Cascade will also instruct its service providers and contractors that maintain the consumer's personal information to make the corresponding corrections in their records.
In determining the accuracy of the personal information that is the subject of the correction request, Cascade will consider the totality of the circumstances relating to the contested personal information, including but not limited to the nature and source of the information and the means and documentation available to verify the information. The consumer may be asked to provide documentation supporting the requested correction.
9.4 Right to Opt-Out of Sale and Sharing (Cal. Civ. Code § 1798.120)
California consumers have the right to direct Cascade to stop selling and/or sharing their personal information to third parties. This right applies to both the "sale" and "sharing" of personal information as those terms are defined under the CCPA (see Section 1 above for definitions).
Mechanisms to Opt Out. Consumers may exercise the right to opt out of the sale and sharing of their personal information through the following mechanisms:
(a) "Do Not Sell or Share My Personal Information" Link. A link titled "Do Not Sell or Share My Personal Information" is prominently displayed on the footer of every page of cascade.com and within the settings menu of the Cascade mobile application. Clicking this link directs the consumer to a preference page where the consumer can submit an opt-out request.
(b) Global Privacy Control (GPC). Cascade recognizes the Global Privacy Control (GPC) browser signal as a valid opt-out-of-sale/sharing request under the CCPA. When Cascade detects a GPC signal from a consumer's browser, Cascade will treat the signal as an opt-out request and will cease the sale and sharing of the consumer's personal information associated with that browser. Additional information regarding Cascade's recognition of GPC signals is provided in Section 13 below. Cascade acknowledges that, prior to the current compliance program, it did not honor any universal opt-out mechanism, including GPC. Recognition of GPC has been implemented as a remedial measure.
(c) DSR Portal. Consumers may also submit an opt-out request through the DSR portal at cascade.com/privacy.
(d) Toll-Free Telephone Number. Consumers may call Cascade toll-free at 1-888-527-2233 to submit an opt-out request.
(e) Email. Consumers may email privacy@cascade.com to submit an opt-out request.
Processing of Opt-Out Requests. Upon receipt of a valid opt-out request, Cascade will cease selling and sharing the consumer's personal information within fifteen (15) business days and will notify all third parties to whom the consumer's personal information was sold or shared within the preceding ninety (90) days that the consumer has exercised the right to opt out and that the third party must comply with the consumer's request. Cascade will pass opt-out signals through to its advertising partners, including Thornbridge Media Corp., to ensure that the consumer's opt-out preference is honored downstream.
Cascade will not request that a consumer who has opted out authorize the sale or sharing of the consumer's personal information for at least twelve (12) months after the consumer's initial opt-out request.
9.5 Right to Limit Use and Disclosure of Sensitive Personal Information (Cal. Civ. Code § 1798.121)
California consumers have the right to direct Cascade to limit the use and disclosure of their sensitive personal information. This right and the associated mechanisms are described in Section 8.5 above. Consumers may exercise this right by clicking the "Limit the Use of My Sensitive Personal Information" link available on cascade.com and in the Cascade mobile application, or through the DSR portal, toll-free telephone number, or email as described in Section 11 below.
9.6 Right to Non-Discrimination (Cal. Civ. Code § 1798.125)
Cascade will not discriminate against a consumer for exercising any of the consumer's CCPA rights. Specifically, Cascade will not:
(a) Deny goods or services to the consumer;
(b) Charge different prices or rates for goods or services, including through the use of discounts or other benefits or the imposition of penalties;
(c) Provide a different level or quality of goods or services to the consumer; or
(d) Suggest that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services,
because the consumer has exercised any of the rights described in this Addendum.
However, nothing in this section prohibits Cascade from charging a consumer a different price or rate, or from providing a different level or quality of goods or services to the consumer, if that difference is reasonably related to the value provided to Cascade by the consumer's data. The financial-incentive exception applicable to the Cascade Rewards program is addressed in Section 10 below.
Section 10: Financial Incentive / Loyalty Program Notice (Cal. Civ. Code § 1798.125(b))
In accordance with Cal. Civ. Code § 1798.125(b), Cascade provides the following notice regarding the financial incentive offered through the Cascade Rewards loyalty program.
Program. Cascade Rewards is a loyalty and rewards program administered by Cascade Rewards Corp. (EIN 86-3381729), a wholly owned subsidiary of Cascade Retail Holdings Inc. The Cascade Rewards program is available to consumers who voluntarily enroll through cascade.com, the Cascade mobile application, or at participating Cascade retail locations.
Membership. As of the date of this Addendum, the Cascade Rewards program has approximately 41.2 million registered members nationwide, including members residing in California.
Material Terms. Members of the Cascade Rewards program earn points on qualifying purchases made through cascade.com, the Cascade mobile application, and at participating Cascade retail locations. Accumulated points may be redeemed for discounts on future purchases, exclusive promotional offers, and early access to sales events and new-product releases. Certain tiers of membership may provide additional benefits, including free or expedited shipping, enhanced return policies, and access to members-only events. Complete terms and conditions of the Cascade Rewards program are available at cascade.com/rewards/terms.
Categories of PI Collected in Connection with the Program. Cascade collects the following categories of personal information in connection with the Cascade Rewards program:
• Identifiers: Name, email address, telephone number, postal address, and Cascade Rewards account number. Optionally, date of birth and age.
• Commercial information: Purchase history, products purchased, transaction amounts, points balance, points accrual and redemption history, tier status, and shopping preferences.
• Internet or other electronic network activity: Engagement with promotional emails, push notifications, and app notifications related to the Cascade Rewards program, including open rates, click-through rates, and in-app interactions.
• Inferences: Shopping preferences, product-category affinities, purchasing propensities, and personalized recommendations generated from the information described above.
Value of Consumer's Data. Under the CCPA, a business offering a financial incentive must provide a good-faith estimate of the value of the consumer's data that forms the basis for offering the financial incentive. Cascade estimates the value of the data provided by an average Cascade Rewards member using a methodology based on the expense of the financial incentive offered divided by the revenue attributable to enrolled consumers' purchases. This methodology considers the following factors:
(a) The per-member average annual discount value provided through the Cascade Rewards program, which was approximately $23.50 per member during FY2024; and
(b) The incremental revenue attributable to program-membership data utilization for personalized marketing, including higher conversion rates, increased average order value, and greater purchase frequency among Rewards members compared to non-members.
Based on this methodology, Cascade estimates that the value of the data provided by an average Rewards member is reasonably related to the value of the financial incentive (i.e., the discounts, offers, and benefits) provided to the member. Cascade's good-faith estimate of the value of the average member's data is approximately $23.50 per year, corresponding to the per-member average annual discount value.
Right to Withdraw. Consumers may opt out of the Cascade Rewards financial incentive at any time by:
• Canceling their Cascade Rewards membership through the account-settings page on cascade.com or in the Cascade mobile application;
• Contacting Cascade customer service by calling 1-888-527-2233 or through live chat; or
• Submitting a withdrawal request through the DSR portal at cascade.com/privacy.
Withdrawal from the Cascade Rewards program will not result in retaliation or discrimination by Cascade. However, consumers who withdraw from the program will no longer receive program-related benefits, including points accrual, discounts, exclusive offers, or early access to sales events. Any unredeemed points balance at the time of withdrawal will expire in accordance with the program terms and conditions.
Why the Program Is Not Discriminatory. The Cascade Rewards program offers enhanced pricing, discounts, and benefits to all consumers who voluntarily choose to enroll and participate. Participation is entirely optional. The value of the benefits provided to program members is reasonably related to the value of the consumer's data to Cascade's business, as described above. Non-participants are not denied access to Cascade's goods or services, are not charged higher prices for equivalent goods or services, and do not receive a lower quality of service.
Section 11: How to Submit Requests
California consumers may submit requests to exercise any of the rights described in this Addendum using the following methods:
Online (DSR Portal). Consumers may submit requests through the DSR portal at [cascade.com/privacy](https://cascade.com/privacy). The DSR portal allows consumers to submit requests to know/access, requests to delete, requests to correct, requests to opt out of sale/sharing, and requests to limit the use of sensitive personal information.
Toll-Free Telephone Number. Consumers may call Cascade toll-free at 1-888-527-2233 to submit any request described in this Addendum. Cascade's privacy-support team is available Monday through Friday, 8:00 a.m. to 8:00 p.m. Eastern Time, and Saturday, 9:00 a.m. to 5:00 p.m. Eastern Time.
Email. Consumers may submit requests by email to privacy@cascade.com.
Verification Process. Cascade will verify the identity of the consumer making a request before fulfilling the request. The verification process consists of two steps:
Step 1: Data-Point Matching. Cascade will require the consumer to provide at least two (2) data points that can be matched to personal information already maintained by Cascade. Examples of data points that may be used for verification include the consumer's name, email address, postal address, telephone number, Cascade Rewards account number, and recent transaction information. The specific data points required may vary depending on the type of request and the sensitivity of the personal information involved.
Step 2: Declaration Under Penalty of Perjury (for certain requests). For requests for specific pieces of personal information and for deletion requests, Cascade requires the consumer to submit a signed declaration under penalty of perjury confirming that the consumer is the individual whose personal information is the subject of the request, or that the consumer is the authorized agent of such individual. This declaration will be provided to the consumer through the DSR portal or by email following the submission of the request.
This verification process has been updated to meet CCPA standards as part of Cascade's comprehensive privacy-compliance program. Prior to the current program, the DSR portal did not verify consumer identity to the standards required by the CCPA and its implementing regulations, creating a compliance gap that has been remediated.
Authorized Agents. California consumers may designate an authorized agent to submit requests on their behalf. To designate an authorized agent, the consumer must provide Cascade with one of the following:
(a) A signed written authorization from the consumer granting the agent permission to submit the request on the consumer's behalf; or
(b) A valid power of attorney executed in accordance with Cal. Prob. Code §§ 4000–4545.