COOKIE AND TRACKING-TECHNOLOGY NOTICE
Cascade Retail Holdings Inc. Effective Date: September 12, 2025
Cascade Retail Holdings Inc.
Right-click to update Table of Contents
I. Introduction and Scope
This Cookie and Tracking-Technology Notice ("Notice") explains how Cascade Retail Holdings Inc. ("Cascade," "we," "us," or "our") uses cookies, pixels, software development kits ("SDKs"), and other tracking technologies on cascade.com — including cascade.com/marketplace, which is operated by Cascade Digital Marketplace LLC, a wholly owned subsidiary of Cascade — and the Cascade mobile application, available on Tidewater Industries iOS and Severin Industries Android (collectively, the "Digital Properties").
This Notice supplements, and should be read in conjunction with, the Cascade Omnibus Privacy Policy and the California-Specific Privacy Disclosures Addendum, both effective September 12, 2025. In the event of a conflict between this Notice and the Omnibus Privacy Policy with respect to the use of cookies and tracking technologies, the terms of this Notice shall control.
This Notice applies to all visitors to and users of the Digital Properties, regardless of whether they are registered account holders or guest users. It applies to registered members of the Cascade Rewards loyalty program, which is administered by Cascade Rewards Corp. and currently serves approximately 41.2 million registered members across the United States. Whether you are browsing cascade.com without an account, have created an account for the purpose of making purchases, or are a longstanding Cascade Rewards member, this Notice describes the tracking technologies you may encounter when interacting with our Digital Properties and the choices available to you.
Cascade operates 186 retail locations in 31 states across the United States and ships products to all 50 states plus the District of Columbia. Certain in-store technologies — including Wi-Fi analytics and Bluetooth Low Energy ("BLE") beacon tracking technologies deployed in select retail locations — may also collect information about visitors to our physical stores. Those in-store tracking technologies are addressed in the Cascade Omnibus Privacy Policy rather than in this Notice, which is limited in scope to the Digital Properties.
This Notice has been prepared to comply with the requirements of applicable United States state privacy statutes. As of the Effective Date, Cascade has identified 19 state privacy statutes that impose obligations relevant to the use of cookies and tracking technologies and the collection, sale, or sharing of personal information through such technologies. These statutes include, without limitation, the California Consumer Privacy Act as amended by the California Privacy Rights Act of 2020 ("CCPA/CPRA"), the Virginia Consumer Data Protection Act ("VCDPA"), the Colorado Privacy Act ("CPA"), the Connecticut Data Privacy Act ("CTDPA"), the Texas Data Privacy and Security Act ("TDPSA"), the Oregon Consumer Privacy Act ("OCPA"), and the other state statutes enumerated in Section XII below. Cascade is committed to meeting or exceeding the requirements imposed by each of these statutes and, where the requirements of different state laws diverge, Cascade applies the more protective standard to all users unless a state-specific approach is required by law.
Nothing in this Notice is intended to create rights or obligations beyond those required by applicable law. This Notice is provided for informational purposes and to promote transparency about Cascade's use of tracking technologies across its Digital Properties.
II. What Are Cookies and Tracking Technologies?
This Section describes the types of tracking technologies that Cascade and its partners may deploy on the Digital Properties. Understanding these technologies will help you make informed decisions about your privacy preferences.
Cookies. A "cookie" is a small text file that a web server places on your device (computer, smartphone, tablet, or other internet-connected device) when you visit a website. Cookies allow the website to recognize your device on subsequent visits, store certain information about your preferences or past actions, and facilitate various site functions. Cookies are widely used across the internet and are a fundamental component of modern web functionality.
Session Cookies vs. Persistent Cookies. Cookies may be classified based on their duration. A "session cookie" is a temporary cookie that is stored in your device's memory only during your browsing session and is automatically deleted when you close your browser. Session cookies are commonly used to maintain the state of your interaction with a website — for example, to keep items in your shopping cart as you navigate between pages. A "persistent cookie," by contrast, remains on your device after you close your browser and persists until it reaches its designated expiration date or until you manually delete it. Persistent cookies are used for range purposes, including remembering your login credentials, storing your language and display preferences, and enabling analytics and advertising functions over time.
Tracking Pixels and Web Beacons. A "tracking pixel" (also referred to as a "web beacon," "clear GIF," or "1x1 pixel") is a small, typically transparent image file that is embedded in a web page, email message, or other digital content. When you load the page or open the email, the pixel sends a request to the server that hosts it, which allows the operator to record that the content was viewed, along with associated metadata such as the time of the request, the IP address of the requesting device, and the type of browser or email client used. Tracking pixels are commonly used to measure the effectiveness of marketing campaigns, monitor email open rates, and gather analytics data about user engagement.
Software Development Kits (SDKs). A "software development kit" or "SDK" is a collection of software tools, code libraries, and related documentation that is integrated into a mobile application to provide specific functionality. In the context of the Cascade mobile application, SDKs are used for purposes including analytics, advertising, crash reporting, geolocation services, and social media integration. SDKs may collect and transmit data about your device, your use of the mobile application, and your interactions with content, and may function in ways that are analogous to cookies in a web-browser environment.
Local Storage Objects. In addition to traditional cookies, cascade.com and the Cascade mobile application may use local storage mechanisms provided by your browser or device, including HTML5 local storage and IndexedDB. These technologies allow larger amounts of data to be stored on your device compared to traditional cookies and are not subject to the same automatic-expiration mechanisms. Local storage objects may be used for performance optimization, caching of content, and storage of user preferences.
Device Fingerprinting and Statistical Identifiers. "Device fingerprinting" (also known as "browser fingerprinting") is a technique that involves collecting a combination of attributes about your device — such as your operating system, browser version, installed plugins, screen resolution, time zone, language settings, and other technical parameters — to create a statistical identifier that can be used to recognize your device across visits without relying on a traditional cookie. Device fingerprinting may be used in conjunction with other tracking technologies to link your activity across sessions, even if you have deleted your cookies or are browsing in a private/incognito mode. Cascade uses device fingerprinting in limited circumstances, primarily in connection with cross-device tracking and fraud-prevention functions, as described further in Section III below.
First-Party vs. Third-Party Technologies. Tracking technologies deployed on the Digital Properties may be "first-party" or "third-party." A first-party technology is set by Cascade itself — that is, the domain of the cookie or the operator of the SDK is Cascade or one of its subsidiaries (including Peakview Analytics Inc. and Cascade Digital Marketplace LLC). A third-party technology is set by a separate entity whose services are integrated into cascade.com or the Cascade mobile application — for example, an advertising network, an analytics provider, or a social media platform. Third-party technologies may allow those third parties to collect data about your activity on the Digital Properties and combine it with data they collect about your activity on other, unaffiliated websites and applications.
As of the May 19, 2025 data-mapping report prepared by Fieldhaven Consulting Group LLC, Cascade has identified 47 third-party advertising and analytics partners that may set third-party tracking technologies on the Digital Properties. The specific technologies deployed by these partners, and the data they may collect, are described further in Sections III and VIII of this Notice.
III. Categories of Cookies and Tracking Technologies
Cascade uses 12 categories of cookies and tracking technologies on cascade.com and the Cascade mobile application. Each category is described below, including the purposes for which the technologies in that category are used, whether the technologies are first-party or third-party, their typical duration on your device, and whether your consent is required before the technologies are deployed.
Category 1: Strictly Necessary / Essential Cookies
Purpose. Strictly Necessary cookies are essential to the basic functionality of cascade.com and the Cascade mobile application. These cookies enable core features that are necessary to provide the services you have requested, including shopping-cart functionality (maintaining the contents of your cart as you browse the site), secure-checkout processing, account authentication (verifying your identity when you log in), server load balancing (distributing traffic across Cascade's infrastructure to maintain site performance), fraud prevention and detection (identifying potentially fraudulent transactions or unauthorized access attempts), and general website security. Without these cookies, cascade.com and the Cascade mobile application cannot function properly, and you would be unable to complete purchases or access your account.
First-Party or Third-Party. Strictly Necessary cookies deployed on the Digital Properties are first-party cookies set by Cascade.
Duration. Strictly Necessary cookies include both session cookies, which expire when you close your browser, and short-duration persistent cookies, which may persist on your device for up to 30 days.
Legal Basis and Consent. These cookies are essential to provide the services you have explicitly requested and are therefore exempt from consent requirements under the CCPA/CPRA and other applicable state privacy statutes. Strictly Necessary cookies cannot be disabled through the Cascade consent-management platform. If you block these cookies through your browser settings, certain portions of cascade.com may not function correctly, and you may be unable to complete transactions or access your account.
Category 2: Authentication and Account-Management Cookies
Purpose. Authentication and Account-Management cookies are used to maintain your logged-in session when you access your cascade.com account or your Cascade Rewards loyalty-program account. These cookies store session tokens that verify your identity, reduce the need for repeated authentication, and preserve user preferences related to your account settings, such as saved payment-method preferences, default shipping addresses, and notification configurations. These cookies also support multi-device session management, allowing you to remain logged in across multiple browser tabs and windows.
First-Party or Third-Party. Authentication and Account-Management cookies are first-party cookies set by Cascade.
Duration. These are persistent cookies that may remain on your device for up to 12 months from the date of your last authenticated session. If you log out of your cascade.com account or your Cascade Rewards account, the authentication token stored in the cookie will be invalidated on the server side, although the cookie file may remain on your device until it expires or is manually deleted.
Additional Information. The Cascade Rewards loyalty program is administered by Cascade Rewards Corp., a wholly owned subsidiary of Cascade. The Cascade Rewards program currently has approximately 41.2 million registered members. Authentication cookies used in connection with Cascade Rewards accounts are subject to the Cascade Rewards Loyalty-Program Privacy Notice, effective September 12, 2025.
Consent. Because Authentication and Account-Management cookies are necessary to provide the authenticated-account services that you have requested, they are generally treated as functionally necessary and do not require separate opt-in consent. However, to the extent that any specific Account-Management cookie collects data beyond what is strictly necessary to maintain your session, it will be subject to the consent requirements described in the applicable category below.
Category 3: Performance and Analytics Cookies
Purpose. Performance and Analytics cookies collect aggregated, statistical data about how visitors interact with cascade.com and the Cascade mobile application. The data collected through these cookies includes, without limitation, page-view counts, click paths (the sequence of pages a visitor navigates), site load times, JavaScript error rates, form-abandonment rates, scroll depth, and session duration. This data is used to identify performance issues, optimize the user experience, improve site navigation, and inform product and content decisions. Performance and Analytics cookies do not, by themselves, identify individual users by name; however, the data they collect may be linked to individual user accounts or device identifiers when combined with other data held by Cascade.
First-Party or Third-Party. Performance and Analytics cookies deployed on the Digital Properties include a mix of first-party and third-party technologies. First-party analytics data is processed by Peakview Analytics Inc. ("Peakview"), Cascade's in-house analytics subsidiary (a Delaware corporation and wholly owned subsidiary of Cascade). In addition, select third-party analytics providers may deploy their own cookies and tracking technologies on the Digital Properties in connection with their analytics services.
Duration. Performance and Analytics cookies are persistent cookies that may remain on your device for up to 24 months.
Consent. Consent is required for Performance and Analytics cookies. In jurisdictions that mandate opt-in consent for analytics tracking (including, for example, certain requirements applicable to sensitive data under specific state statutes), Cascade obtains affirmative opt-in consent before deploying these cookies. In all other jurisdictions, Cascade honors opt-out requests. You may disable Performance and Analytics cookies at any time through the Cascade consent-management platform, as described in Section IX below.
Category 4: Functional / Preference Cookies
Purpose. Functional cookies remember your preferences and settings to provide a more tailored experience when you return to cascade.com or the Cascade mobile application. The preferences stored by these cookies include your preferred language, your selected geographic region (which may affect displayed product availability and pricing), your display settings (such as grid-view vs. list-view for product search results), your recently viewed products, and other user-interface preferences. Functional cookies improve your user experience by reducing the need to re-enter preferences on each visit.
First-Party or Third-Party. Functional cookies are first-party cookies set by Cascade.
Duration. Functional cookies are persistent cookies that may remain on your device for up to 12 months.
Consent. Consent is required for Functional cookies where applicable under state law. You may disable Functional cookies through the Cascade consent-management platform. Please note that if you disable Functional cookies, your preferences may not be remembered between visits, and certain features of cascade.com and the Cascade mobile application may not operate as intended.
Category 5: First-Party Advertising and Personalization Cookies
Purpose. First-Party Advertising and Personalization cookies are used by Cascade to deliver personalized product recommendations, on-site promotional content, customized homepage experiences, and targeted in-app messages based on your browsing history, purchase behavior, product-category affinities, and other data Cascade holds about you. These cookies enable Cascade to tailor the content and offers you see on cascade.com and in the Cascade mobile application to your interests and preferences, enhancing the relevance of your experience.
First-Party or Third-Party. These cookies are first-party cookies set by Cascade. The data collected through these cookies is processed by Peakview Analytics Inc. Peakview processes approximately 2.1 billion consumer-event data records per month for ad targeting and personalization across the Digital Properties.
Duration. First-Party Advertising and Personalization cookies are persistent cookies that may remain on your device for up to 12 months.
Consent. Consent is required for First-Party Advertising and Personalization cookies. You may disable these cookies at any time through the Cascade consent-management platform. If you disable these cookies, you will continue to see advertisements and promotional content on cascade.com and in the Cascade mobile application, but the content will be less personalized and may be less relevant to your interests.
Category 6: Third-Party Programmatic Advertising Cookies
Purpose. Third-Party Programmatic Advertising cookies enable programmatic advertising, audience targeting, real-time bidding ("RTB"), and ad delivery by third-party advertising partners on cascade.com and in the Cascade mobile application. These cookies allow Cascade's advertising partners to serve advertisements on the Digital Properties, measure the performance and reach of advertising campaigns, build audience segments for targeted advertising, and participate in real-time bidding auctions for the delivery of display, video, and native advertising units.
First-Party or Third-Party. Third-Party Programmatic Advertising cookies are third-party cookies set by Cascade's advertising partners. Cascade's primary programmatic-advertising and audience-targeting partner is Thornbridge Media Corp. ("Thornbridge"), a Nevada corporation. Thornbridge is Cascade's largest third-party advertising partner by spend, with FY2024 programmatic advertising expenditures of approximately $18.4 million. Other third-party advertising partners may also deploy programmatic advertising cookies on the Digital Properties.
Duration. Third-Party Programmatic Advertising cookies are persistent cookies. Duration varies by partner but may persist on your device for up to 13 months.
Sale/Sharing Classification. The deployment of Third-Party Programmatic Advertising cookies, and the data collected through them, may constitute a "sale" or "sharing" of personal information (as those terms are defined under the CCPA/CPRA, Cal. Civ. Code § 1798.140(ad) and (ah)) and under analogous provisions of other state privacy statutes. Accordingly, the use of these cookies is subject to the opt-out-of-sale/sharing mechanisms described in Sections V and VI of this Notice.
Consent. Consent is required for Third-Party Programmatic Advertising cookies. In jurisdictions that require opt-in consent for targeted advertising, Cascade obtains affirmative consent before deploying these cookies. In all applicable states, consumers may opt out of the sale or sharing of personal information facilitated by these cookies through the mechanisms described in Sections V and VI below.
Category 7: Retargeting and Behavioral Advertising Cookies
Purpose. Retargeting and Behavioral Advertising cookies track your browsing activity across cascade.com and other websites to deliver targeted advertisements on third-party websites and platforms (such as news sites, social media platforms, and other digital properties) based on your prior browsing or purchase activity on the Digital Properties. For example, if you view a particular product on cascade.com but do not complete a purchase, these cookies may enable Cascade's advertising partners to show you an advertisement for that product when you visit a different website.
First-Party or Third-Party. Retargeting and Behavioral Advertising cookies are third-party cookies set by advertising partners from among Cascade's 47 third-party advertising and analytics partners as identified in the May 19, 2025 data-mapping report.
Duration. These are persistent cookies that may remain on your device for up to 12 months.
Sale/Sharing Classification. Like Third-Party Programmatic Advertising cookies (Category 6), the data collected through Retargeting and Behavioral Advertising cookies may constitute "sharing" of personal information under the CCPA/CPRA and analogous state-law provisions, as the data is made available to third-party advertising partners for the purpose of cross-context behavioral advertising.
Consent. Consent is required. You may opt out of Retargeting and Behavioral Advertising cookies through the consent-management platform, through the Global Privacy Control signal, or through the "Do Not Sell or Share My Personal Information" link, as described in Sections V, VI, and IX of this Notice.
Category 8: Social Media Integration Cookies
Purpose. Social Media Integration cookies enable social-media sharing buttons, embedded content (such as embedded video players or social-media posts), and social-login functionality on cascade.com. For example, these cookies allow you to share a product page from cascade.com to a social media platform, log in to your cascade.com account using your social media credentials, or view embedded social media content within the cascade.com experience.
First-Party or Third-Party. Social Media Integration cookies are third-party cookies set by the respective social media platforms whose features are integrated into cascade.com. Cascade does not control the data-collection practices of these platforms.
Duration. Social Media Integration cookies include both session cookies and persistent cookies. Duration varies by platform.
Consent. Consent is required for Social Media Integration cookies. You may disable these cookies through the consent-management platform. Please note that if you disable Social Media Integration cookies, social-sharing buttons, social-login functionality, and embedded social-media content may not function on cascade.com.
Category 9: Cross-Device Tracking Technologies
Purpose. Cross-Device Tracking technologies are used to link your activity across multiple devices — for example, your desktop computer, your mobile phone's web browser, and the Cascade mobile application — to create a unified user profile. This unified profile is used for personalization and advertising purposes, enabling Cascade to deliver a consistent and relevant experience regardless of the device you are using and to measure the effectiveness of advertising campaigns across devices.
First-Party or Third-Party. Cross-Device Tracking technologies include both first-party and third-party technologies. Data collected through these technologies is processed by Peakview Analytics Inc. and by third-party partners.
Matching Methods. Cross-Device Tracking on the Digital Properties relies on two primary matching methods:
(a) Deterministic Matching: When you log in to your cascade.com account or your Cascade Rewards account on multiple devices, Cascade uses your authenticated account credentials to link your activity across those devices with a high degree of certainty. Deterministic matching relies on logged-in account data and provides the most accurate cross-device linkage.
(b) Probabilistic Matching: When deterministic matching is not available (for example, when you have not logged in on a particular device), Cascade and its partners may use device-fingerprinting techniques and statistical algorithms to infer that multiple devices belong to the same user. Probabilistic matching relies on shared device attributes, IP addresses, and behavioral patterns and is inherently less precise than deterministic matching.
Consent. Consent is required for Cross-Device Tracking technologies. You may disable cross-device tracking through the consent-management platform. When a Global Privacy Control signal is detected, Cross-Device Tracking technologies will be suppressed to the extent they involve sharing data with third parties, as described in Section V.
Category 10: Geolocation Technologies
Purpose. Geolocation technologies collect precise geolocation data from the Cascade mobile application using GPS, Wi-Fi triangulation, and Bluetooth signals. This data is used to enable store-locator functionality (helping you find the nearest Cascade retail location), display local inventory availability (showing you which products are in stock at nearby stores), deliver location-based promotions and offers (such as coupons valid at a specific store), and provide in-app navigation assistance within select Cascade retail locations that support indoor positioning.
First-Party or Third-Party. Geolocation technologies on the Cascade mobile application are first-party, implemented through SDKs integrated into the mobile app.
Sensitive Personal Information Classification. Precise geolocation data (defined as geolocation data that is sufficiently precise to identify a consumer's location within a geographic area that is no larger than the area of a circle with a radius of 1,850 feet) constitutes sensitive personal information under the CCPA/CPRA, Cal. Civ. Code § 1798.121, the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, and other applicable state privacy statutes. The collection and processing of precise geolocation data is subject to heightened legal requirements.
Consent. Cascade will not collect or process precise geolocation data without first obtaining separate, affirmative opt-in consent from the user. This consent is obtained through a dedicated geolocation consent prompt presented within the Cascade mobile application, which is separate from and in addition to the general cookie-consent banner. Users may revoke their geolocation consent at any time by adjusting the location-permissions settings within the Cascade mobile application's privacy settings menu or through the location-permission controls provided by the device's operating system (iOS Settings > Privacy & Security > Location Services > Cascade; Android Settings > Location > App Permissions > Cascade).
Category 11: Email and Communication Tracking Pixels
Purpose. Email and Communication Tracking Pixels are embedded in Cascade marketing emails, transactional email communications, and push notifications sent through the Cascade mobile application. These pixels allow Cascade to track open rates (whether and when you open an email), click-through rates (whether and which links you click within an email), and overall engagement with Cascade communications. The data collected through these pixels is used to measure the effectiveness of Cascade's email marketing campaigns, to optimize email content and timing, and to maintain the health and deliverability of Cascade's email-sending infrastructure.
First-Party or Third-Party. Email and Communication Tracking Pixels are first-party pixels deployed by Cascade. Data collected through these pixels is processed by Peakview Analytics Inc.
Duration. These pixels operate on a session basis when the email or notification is opened. No persistent cookie is stored on your device as a result of an Email or Communication Tracking Pixel firing.
Consent. The use of Email and Communication Tracking Pixels is subject to your email-marketing consent and unsubscribe preferences. If you have opted in to receive Cascade marketing emails, tracking pixels may be included in those communications. You may unsubscribe from Cascade marketing emails at any time by clicking the "Unsubscribe" link at the bottom of any marketing email, by adjusting your communication preferences in your cascade.com account settings, or by contacting Cascade as described in Section X below. Transactional emails (such as order confirmations and shipping notifications) may continue to include tracking pixels to the extent they relate to services you have requested.
Category 12: Marketplace Seller Tracking Technologies
Purpose. Marketplace Seller Tracking Technologies support the operation of Cascade Digital Marketplace LLC, which hosts approximately 3,800 third-party sellers on cascade.com/marketplace. These technologies collect data about product views, add-to-cart events, conversion rates, and seller-storefront performance, which is aggregated and provided to marketplace sellers in the form of analytics reports and dashboards. This data enables sellers to understand how their products and storefronts perform, optimize their listings and pricing, and improve the customer experience.
First-Party or Third-Party. Marketplace Seller Tracking Technologies are first-party cookies set by Cascade. While the analytics data derived from these cookies is shared with marketplace sellers, the data is aggregated before sharing, and individual customer-level personal information is not disclosed to sellers through these analytics reports, except as expressly described in the Cascade Digital Marketplace Seller Agreement.
Duration. These are persistent cookies that may remain on your device for up to 12 months.
Data Segregation. Cascade is aware that, prior to the date of this Notice, certain first-party customer data and seller-related marketplace data were commingled in shared data environments. Cascade is undertaking remediation efforts to segregate seller-related data and first-party customer data in compliance with applicable data-protection requirements. These remediation efforts are being conducted under the oversight of Cascade's privacy compliance program and are expected to be substantially completed in connection with the broader compliance-program milestones described in this Notice.
Consent. Consent is required for Marketplace Seller Tracking Technologies where applicable under state law. You may disable these cookies through the consent-management platform.
IV. Consent-Management Platform
Cascade has deployed a consent-management platform (the "CMP") to provide users of the Digital Properties with clear, granular control over their cookie and tracking-technology preferences. The CMP is provided by OnPoint Data Solutions Inc. ("OnPoint"), a Delaware corporation headquartered at 800 West El Camino Real, Suite 220, Mountain View, CA 94040. OnPoint is a leading provider of privacy-compliance infrastructure and consent-management tools.
The OnPoint CMP is integrated into both cascade.com and the Cascade mobile application. Cascade has entered into a three-year licensing agreement with OnPoint for the CMP, with an annual license fee of $480,000, resulting in a total contract value of $1,440,000 over the contract term. The technical implementation of the CMP on the Digital Properties is being managed by Fieldhaven Consulting Group LLC, with engagement lead Marcus Ellerby overseeing the deployment. The target deployment date for the CMP is December 15, 2025. In the interim, Cascade maintains a simplified cookie-consent mechanism on cascade.com and the Cascade mobile application that allows users to accept or reject non-essential cookies; the full category-level controls described below will be available upon CMP deployment.
Cookie-Consent Banner. The OnPoint CMP presents a cookie-consent banner upon a user's first visit to cascade.com or first launch of the Cascade mobile application. The banner provides the user with the following options:
(a) Accept All: Accept all non-essential cookies and tracking technologies across all categories described in Section III above;
(b) Reject All: Reject all non-essential cookies and tracking technologies, limiting Cascade to the use of Strictly Necessary / Essential Cookies (Category 1) only;
(c) Customize Preferences: Access a detailed preference center in which the user may select or deselect individual categories of cookies and tracking technologies (from among the 12 categories described in Section III), with the exception of Strictly Necessary / Essential Cookies (Category 1), which cannot be disabled through the CMP because they are essential to site functionality; and
(d) Modify Preferences at Any Time: After the initial consent decision, users may return to the preference center at any time by clicking the "Cookie Preferences" or "Your Privacy Choices" link, which is persistently displayed in the footer of every page of cascade.com and in the settings menu of the Cascade mobile application.
State-Specific Consent Models. The CMP is configured to automatically detect the user's geographic location based on IP address geolocation (for web visitors) or device-location settings (for mobile app users) and to apply the consent model that is appropriate for the user's jurisdiction. The state-specific consent models include:
• California Residents (CCPA/CPRA): The CMP applies an opt-out model for the sale or sharing of personal information. Users are presented with a "Do Not Sell or Share My Personal Information" option. For the collection of sensitive personal information — specifically, precise geolocation data (Category 10) — the CMP requires separate, affirmative opt-in consent before such data is collected or processed. The CMP also honors Global Privacy Control ("GPC") signals as described in Section V.
• Residents of States with Opt-Out Requirements (Virginia, Colorado, Connecticut, Texas, Oregon, and others): The CMP applies an opt-out model consistent with the requirements of each applicable state statute, enabling users to opt out of targeted advertising, profiling, and (where applicable) the sale of personal data.
• Residents of States with Opt-In Requirements for Certain Data Categories: Where a state statute requires opt-in consent for the processing of specific categories of data (such as sensitive personal information), the CMP obtains affirmative consent from the user prior to deploying the relevant tracking technologies.
• All Other Users: The CMP presents the consent banner and preference center to all users, regardless of jurisdiction, ensuring that all visitors to the Digital Properties have the opportunity to exercise control over their cookie and tracking-technology preferences.
Consent Records. The CMP generates and maintains a consent receipt for each user interaction with the consent banner or preference center. Consent receipts include a timestamped record of the user's selections, the version of the consent banner displayed, the user's detected jurisdiction, and a unique consent-receipt identifier. These records are retained by OnPoint on Cascade's behalf for audit and compliance purposes and are available to Cascade's privacy team for review in connection with regulatory inquiries, data-subject requests, and internal-compliance assessments.
OnPoint's Role. OnPoint is classified as a "service provider" under the CCPA/CPRA and as a "processor" under the VCDPA, CPA, CTDPA, and other applicable state privacy statutes. Cascade and OnPoint have executed a Data Processing Addendum that governs OnPoint's processing of personal information in connection with the CMP, including obligations related to data security, data minimization, subprocessor management, and cooperation with consumer-rights requests.
V. Global Privacy Control (GPC) and Universal Opt-Out Mechanisms
Cascade recognizes and honors the Global Privacy Control ("GPC") browser signal as a valid opt-out of the sale and sharing of personal information. GPC is a browser-level or extension-level signal that communicates a user's preference not to have their personal information sold or shared. Cascade's recognition of GPC is consistent with the requirements of the CCPA/CPRA and the regulations promulgated by the California Privacy Protection Agency ("CPPA"), as well as the requirements of the Colorado CPA, the Connecticut CTDPA, the Texas TDPSA, the Oregon OCPA, and other applicable state statutes that mandate recognition of universal opt-out mechanisms.
When a GPC signal is detected by cascade.com or the Cascade mobile application, Cascade will take the following actions:
(a) Suppress Third-Party Advertising Cookies: All Third-Party Programmatic Advertising cookies (Category 6), Retargeting and Behavioral Advertising cookies (Category 7), and Social Media Integration cookies (Category 8) will be automatically suppressed and will not be deployed on the user's device.
(b) Suppress Cross-Device Tracking with Third Parties: Cross-Device Tracking technologies (Category 9) will be suppressed to the extent that they involve the sharing of data with third-party partners. First-party, deterministic cross-device linking based on authenticated account data may continue to the extent it does not involve sharing with third parties and is not subject to the opt-out-of-sale/sharing framework.
(c) Process as "Do Not Sell or Share" Request: The GPC signal will be processed as a valid "Do Not Sell or Share My Personal Information" request under the CCPA/CPRA and analogous state-law provisions, without requiring the user to take any additional action, create a Cascade account, or submit a separate request.
(d) Downstream Signal Propagation: Cascade will pass the GPC signal downstream to applicable third-party advertising partners, including Thornbridge Media Corp., pursuant to the restructured Cascade–Thornbridge data-sharing agreement. The restructured agreement, which addresses GPC signal pass-through, CCPA sale/sharing classification, data minimization obligations, and consumer-rights cooperation, is targeting execution on October 31, 2025.
The implementation of GPC recognition on the Digital Properties remedies a previously identified compliance gap in which no universal opt-out mechanism was honored by Cascade prior to the commencement of the current compliance-remediation program. Going forward, Cascade is committed to recognizing GPC and any other universal opt-out mechanisms that may be required by applicable law.
Users do not need to create a Cascade account, log in, or take any additional steps beyond enabling GPC in their browser or browser extension to exercise this right. The GPC signal is processed automatically upon detection. GPC does not affect Strictly Necessary / Essential Cookies (Category 1) or first-party Functional / Preference Cookies (Category 4) that do not involve the sale or sharing of personal information with third parties.
For information on how to enable GPC in your browser, please refer to Section IX.D of this Notice.
VI. Opt-Out of Sale and Sharing of Personal Information
In addition to the GPC signal described in Section V above, consumers may exercise their right to opt out of the sale and sharing of personal information through any of the following methods:
(a) "Do Not Sell or Share My Personal Information" Link: A link titled "Do Not Sell or Share My Personal Information" is available in the footer of every page of cascade.com and in the settings menu of the Cascade mobile application. Clicking this link will direct you to a page where you can submit your opt-out request. Upon submission, Cascade will cease the sale and sharing of your personal information with third parties for targeted advertising, retargeting, and behavioral advertising purposes.
(b) Consumer-Rights Portal (DSR Portal): You may submit an opt-out-of-sale/sharing request through Cascade's online consumer-rights portal (also referred to as the "DSR portal"), accessible via the Cascade Omnibus Privacy Policy or by navigating to cascade.com/privacy/requests. The DSR portal also supports requests for access to, deletion of, and correction of personal information.
(c) Email or Telephone: You may submit an opt-out request by contacting Cascade using the email address or toll-free telephone number provided in Section X of this Notice.
Processing Timeline. Opt-out-of-sale/sharing requests are processed within 15 business days of receipt. This target response time has been established under Cascade's current compliance program and represents a significant improvement over the prior average processing time of 27 calendar days.
DSR Volume. In Fiscal Year 2024, Cascade received a total of approximately 38,400 data-subject requests across all categories. Of that total, approximately 12,800 were requests for access to personal information, approximately 19,100 were requests for deletion of personal information, and approximately 6,500 were requests to opt out of the sale or sharing of personal information. Cascade expects DSR volume to increase in Fiscal Year 2025 as awareness of consumer-privacy rights continues to grow and as additional state privacy statutes take effect.
Verification. Cascade may take reasonable steps to verify the identity of a consumer submitting an opt-out request, in accordance with applicable law. For opt-out-of-sale/sharing requests, Cascade does not require a verified identity to process the request; however, Cascade may request that you provide sufficient information to enable Cascade to associate the opt-out request with your account, device, or browsing data.
VII. Sensitive Personal Information — Geolocation Consent
Precise geolocation data collected through the Cascade mobile application (Category 10, as described in Section III above) is classified as sensitive personal information under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ae) and § 1798.121) and under multiple other state privacy statutes, including the VCDPA, the CPA, the CTDPA, and the TDPSA. The collection, use, and disclosure of precise geolocation data is subject to heightened legal protections, including the requirement to obtain separate, affirmative opt-in consent.
Cascade will not collect or process precise geolocation data from the Cascade mobile application without first obtaining your separate, affirmative opt-in consent. This consent is requested through a dedicated geolocation consent prompt within the mobile application, which clearly describes the types of geolocation data to be collected, the purposes for which the data will be used, and your right to decline or later revoke consent. The geolocation consent prompt is presented separately from the general cookie-consent banner and requires an affirmative action (such as tapping "Allow" or "Enable Location Services") before any geolocation data is collected.
You may limit Cascade's use and disclosure of precise geolocation data by taking any of the following actions:
(a) Decline the Geolocation Consent Prompt: When the Cascade mobile application requests access to your device's location services, you may decline the request by tapping "Don't Allow" or the equivalent option presented by your device's operating system. If you decline, the Cascade mobile application will not collect precise geolocation data, and location-dependent features (such as the store locator, local inventory availability, and location-based promotions) will be unavailable or will rely on approximate, IP-based location information.
(b) Revoke Consent via the Mobile App: You may revoke your geolocation consent at any time by navigating to the privacy settings menu within the Cascade mobile application and disabling location access.
(c) Revoke Consent via Device Operating-System Settings: You may revoke location-permission access for the Cascade mobile application through your device's operating-system settings. On iOS, navigate to Settings > Privacy & Security > Location Services > Cascade and select "Never." On Android, navigate to Settings > Location > App Permissions > Cascade and select "Deny" or "Don't Allow."
(d) Exercise the Right to Limit Use of Sensitive Personal Information: Under the CCPA/CPRA, California consumers have the right to limit the use and disclosure of sensitive personal information. You may exercise this right by submitting a request through the consumer-rights portal (DSR portal) or by clicking the "Limit the Use of My Sensitive Personal Information" link available on cascade.com. Upon receipt and processing of such a request, Cascade will limit its use of your precise geolocation data to the purposes expressly authorized by applicable law.
VIII. Third-Party Technologies and Data-Sharing Partners
Certain cookies and tracking technologies deployed on cascade.com and in the Cascade mobile application are set by third-party advertising and analytics partners whose services Cascade has engaged. These third-party technologies enable advertising, analytics, social media integration, and other functions as described in Section III.
As of the May 19, 2025 data-mapping report prepared by Fieldhaven Consulting Group LLC, Cascade works with 47 third-party advertising and analytics partners that deploy tracking technologies on the Digital Properties. The personal information collected by or made accessible to these partners through their tracking technologies may constitute a "sale" or "sharing" of personal information under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ad) and (ah)) and under analogous definitions in other state privacy statutes. Cascade treats these data flows as potential sales or sharing and provides consumers with the opt-out mechanisms described in Sections V and VI of this Notice.
Data Processing Agreements. Cascade is in the process of executing Data Processing Agreements ("DPAs") with all 47 of its third-party advertising and analytics partners. As of the Effective Date of this Notice, 23 of the 47 partners previously lacked executed DPAs with Cascade. Cascade has initiated a rollout program to negotiate, finalize, and execute DPAs with all outstanding partners, with a target completion date of December 31, 2025. Each DPA will include provisions addressing the partner's obligations with respect to data security, data minimization, purpose limitation, consumer-rights cooperation, and compliance with applicable state privacy statutes.
Thornbridge Media Corp. Cascade's largest data-sharing partner for advertising purposes is Thornbridge Media Corp. ("Thornbridge"), which deploys Third-Party Programmatic Advertising cookies (Category 6) and Retargeting and Behavioral Advertising cookies (Category 7) on the Digital Properties. Thornbridge receives consumer behavioral data — including browsing activity, product interactions, and audience-segment identifiers — for the purpose of programmatic advertising, audience targeting, and real-time bidding. The Cascade–Thornbridge data-sharing relationship is governed by a restructured data-sharing agreement that has been negotiated to address the CCPA sale/sharing classification of the data flows, the pass-through of GPC signals from Cascade to Thornbridge, data-minimization requirements, purpose limitations, retention schedules, and Thornbridge's obligation to cooperate with consumer-rights requests (including opt-out, access, deletion, and correction requests) forwarded by Cascade. The restructured agreement is targeting execution on October 31, 2025.
Contractual Obligations of Third-Party Partners. All third-party partners that set cookies or tracking technologies on the Digital Properties are required by contract to:
(a) Honor opt-out and GPC signals forwarded by Cascade, and to cease the use of personal information for targeted-advertising purposes with respect to any consumer who has opted out;
(b) Comply with all applicable state privacy laws, including the CCPA/CPRA, VCDPA, CPA, CTDPA, TDPSA, OCPA, and all other state statutes listed in Section XII;
(c) Limit their use of consumer data to the specific, documented purposes set forth in their DPA with Cascade, and not to sell, share, or otherwise disclose consumer data for purposes other than those specified;
(d) Cooperate with consumer-rights requests — including requests for access to, deletion of, and correction of personal information — that are forwarded by Cascade on behalf of consumers who have exercised their rights under applicable law; and
(e) Implement and maintain reasonable data-security measures to protect consumer data from unauthorized access, use, or disclosure.
Partner List. A current list of the third-party advertising and analytics partners whose tracking technologies are deployed on cascade.com and in the Cascade mobile application is available upon request by contacting Cascade using the information provided in Section X. The partner list is reviewed and updated on a quarterly basis to reflect changes in Cascade's third-party partner relationships.
IX. How to Manage Your Cookie and Tracking Preferences
Cascade provides multiple methods by which you can manage your cookie and tracking-technology preferences. The available methods are described below.
A. Through the Cascade Consent-Management Platform (OnPoint CMP)
The primary and most comprehensive way to manage your cookie and tracking-technology preferences is through the Cascade consent-management platform, powered by OnPoint Data Solutions Inc.
To access the CMP on cascade.com, click the "Cookie Preferences" or "Your Privacy Choices" link located in the footer of every page. To access the CMP in the Cascade mobile application, navigate to the settings menu and select "Privacy & Cookie Preferences."
Within the CMP, you may:
• Review the 12 categories of cookies and tracking technologies described in Section III;
• Select or deselect individual categories to enable or disable the associated tracking technologies;
• Accept all non-essential cookies, reject all non-essential cookies, or customize your preferences on a category-by-category basis; and
• Update your preferences at any time — your new selections will take effect immediately.
When you update your preferences through the CMP, a consent-receipt record is generated and stored by OnPoint on Cascade's behalf, documenting your selections and the date and time of the change.
B. Through Browser Settings
Most web browsers allow you to manage cookie settings through the browser's built-in privacy or settings menu. You can typically configure your browser to:
• Block all cookies;
• Block only third-party cookies;
• Delete all cookies when the browser is closed;
• Be notified each time a cookie is set; or
• Delete specific cookies manually.
The method for accessing and configuring cookie settings varies by browser. Consult your browser's help documentation or support resources for specific instructions. Common browsers and their settings pages include Ashford Services Inc. (Settings > Privacy and Security > Cookies and Other Site Data), Mozilla Firefox (Settings > Privacy & Security > Cookies and Site Data), Stonefield Services Inc. (Preferences > Privacy), and Penrose Systems (Settings > Cookies and Site Permissions).
Please note that if you configure your browser to block all cookies, including Strictly Necessary / Essential Cookies (Category 1), certain portions of cascade.com may not function correctly. You may be unable to add items to your shopping cart, complete checkout, access your account, or use other core site functionality.
In addition, most browsers offer a "private browsing" or "incognito" mode that does not store cookies or browsing history after the session ends. Using private browsing mode will prevent persistent cookies from being stored on your device, but session cookies will still be used during your browsing session.
C. Through Device Settings (Mobile App)
If you use the Cascade mobile application, your mobile device provides settings that allow you to manage how applications collect and use certain data:
• Location Permissions (Category 10): You may manage the Cascade mobile application's access to your device's precise geolocation data through your device's location-permission settings. On iOS, navigate to Settings > Privacy & Security > Location Services > Cascade. On Android, navigate to Settings > Location > App Permissions > Cascade. You can choose to allow location access "Always," "While Using the App," or "Never," or you can deny location access entirely.
• Advertising Identifiers: Your mobile device assigns an advertising identifier (Tidewater Industries's Identifier for Advertisers, or "IDFA," on iOS; Severin Industries's Severin Industries Advertising ID, or "GAID," on Android) that may be used by the Cascade mobile application and its integrated SDKs for advertising and analytics purposes. You can reset your advertising identifier or opt out of personalized advertising through your device's settings. On iOS, navigate to Settings > Privacy & Security > Tracking and disable "Allow Apps to Request to Track." On Android, navigate to Settings > Privacy > Ads and select "Delete advertising ID" or "Opt out of Ads Personalization."
• Limit Ad Tracking: Both iOS and Android provide device-level settings that allow you to limit the ability of applications to track your activity for advertising purposes. Enabling these settings will reduce the data available to the Cascade mobile application and its advertising SDKs for targeted-advertising purposes.
D. Through Global Privacy Control (GPC)
You can enable the Global Privacy Control signal in your web browser or through a browser extension to automatically communicate your opt-out preference to cascade.com and other websites that honor GPC. GPC is currently supported by several browsers and browser extensions, including Mozilla Firefox (built-in), Brave Browser (built-in), DuckDuckGo Browser (built-in), and the Privacy Badger and OptMeowt browser extensions. To enable GPC, consult the settings or preferences menu of your browser or install a browser extension that supports the GPC standard.
When GPC is enabled, cascade.com will automatically honor the signal as described in Section V of this Notice. For additional details on GPC and its effects on Cascade's tracking technologies, please refer to Section V above.
E. Through the "Do Not Sell or Share" Link
You may exercise your right to opt out of the sale and sharing of personal information by clicking the "Do Not Sell or Share My Personal Information" link available in the footer of every page of cascade.com and in the settings menu of the Cascade mobile application. For additional details on the opt-out-of-sale/sharing process, please refer to Section VI above.
F. Industry Opt-Out Tools
In addition to the Cascade-specific mechanisms described above, you may use the following industry opt-out tools to manage your advertising and tracking preferences across multiple participating companies:
• Digital Advertising Alliance (DAA): The DAA offers the WebChoices tool and the AppChoices application, which allow you to opt out of interest-based advertising from DAA-participating companies. Visit [www.aboutads.info/choices](http://www.aboutads.info/choices) to access the WebChoices tool or download the AppChoices application from the Tidewater Industries App Store or Severin Industries Play Store.
• Network Advertising Initiative (NAI): The NAI provides an opt-out page that allows you to opt out of interest-based advertising from NAI-member companies. Visit [www.networkadvertising.org/choices](http://www.networkadvertising.org/choices) to access the NAI opt-out page.
Please note that these industry tools are supplemental and do not replace the Cascade-specific opt-out mechanisms described in this Notice. Opting out through DAA or NAI tools may not affect all tracking technologies deployed on the Digital Properties, and you should use the Cascade CMP and the "Do Not Sell or Share My Personal Information" link for the most comprehensive control over your privacy preferences on cascade.com and the Cascade mobile application.
X. Contact Information
If you have questions about this Notice, Cascade's use of cookies and tracking technologies, or your privacy rights, you may contact Cascade using any of the following methods:
Email: privacy@cascade.com
Toll-Free Telephone: 1-888-492-7233 (1-888-4CASCADE)
Mail:
Cascade Retail Holdings Inc.
Attn: Privacy Team (Diana Polk, Associate General Counsel / Interim Chief Privacy Officer)
4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Consumer-Rights Requests. To submit a data-subject request — including a request for access to personal information, deletion of personal information, correction of personal information, opt-out of sale or sharing of personal information, or limitation of the use and disclosure of sensitive personal information — please visit Cascade's online consumer-rights portal at cascade.com/privacy/requests.
Interim Chief Privacy Officer. As of the Effective Date of this Notice, interim Chief Privacy Officer responsibilities are held by Diana Polk, Associate General Counsel. Cascade intends to hire a full-time Chief Privacy Officer by the fourth quarter of 2025. Once appointed, the full-time Chief Privacy Officer will assume responsibility for the administration of this Notice and Cascade's broader privacy-compliance program.
XI. Changes to This Notice
Cascade reserves the right to update or modify this Notice from time to time to reflect changes in technology, changes in applicable legal or regulatory requirements, changes in Cascade's business practices or third-party partner relationships, or other developments that affect the use of cookies and tracking technologies on the Digital Properties.
The "Effective Date" at the top of this Notice indicates the date of the most recent update. You are encouraged to review this Notice periodically to stay informed about how Cascade uses cookies and tracking technologies.
Cascade's prior disclosure regarding the use of cookies and tracking technologies was contained within the cascade.com online privacy policy, which was last updated in March 2022. This Notice replaces that prior disclosure in its entirety and constitutes the sole and authoritative description of Cascade's current cookie and tracking-technology practices.
Material changes to this Notice — including changes that expand the categories of tracking technologies used, introduce new third-party data-sharing relationships, or alter the available consent and opt-out mechanisms — will be communicated to users via a prominent banner notice on cascade.com and/or through an in-app notification in the Cascade mobile application. Where required by applicable law, Cascade will obtain renewed consent for any material changes that affect the processing of personal information through cookies and tracking technologies.
XII. Applicable State Laws
This Notice is designed to comply with the requirements of the following United States state privacy statutes, as well as any additional state privacy statutes that may be enacted or take effect after the Effective Date:
Where the requirements of different state privacy statutes diverge with respect to the use of cookies and tracking technologies, opt-in vs. opt-out consent models, the classification of data a