EMPLOYEE AND JOB-APPLICANT PRIVACY NOTICE
Cascade Retail Holdings Inc.
4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Applicable to: All employees, former employees, and job applicants of Cascade Retail Holdings Inc. and its subsidiaries — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp.
Effective Date: September 12, 2025
Prepared by: Calderwood & Harkness LLP, Privacy & Data Security Practice Sara Hendricks, Associate; reviewed by Alan Burke, Senior Associate Matter Number: 1038-00010
Confidentiality Marking: Internal Use — Employee Distribution Only
Supersedes: Any prior employee privacy notice, employee data-collection disclosure, or analogous informational document issued by Cascade Retail Holdings Inc. or any of its subsidiaries, including but not limited to the prior online privacy policy last updated in March 2022, to the extent such prior disclosures addressed employee or job-applicant personal information.
Right-click to update Table of Contents
1. INTRODUCTION AND PURPOSE
Cascade Retail Holdings Inc. ("Cascade," "we," "us," or "our"), a Delaware corporation publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD, together with its wholly owned subsidiaries — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. (collectively, the "Cascade Group" or the "Company") — issues this Employee and Job-Applicant Privacy Notice (the "Notice") to provide transparent, comprehensive information to current and former employees and job applicants regarding the personal information that Cascade collects, uses, discloses, and retains in the employment and recruitment context.
The Cascade Group operates a diversified retail enterprise encompassing brick-and-mortar retail stores, e-commerce fulfillment operations, data analytics services, and a consumer loyalty-rewards program. As of the effective date of this Notice, Cascade operates approximately 186 retail locations across 31 states in the United States, maintains multiple e-commerce fulfillment centers operated by Ridgeline Fulfillment Services Inc., and employs approximately 22,500 individuals across all operations, including full-time, part-time, and seasonal employees at every level of the organization.
This Notice is provided pursuant to the requirements of the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), Cal. Civ. Code §§ 1798.100 et seq., and analogous state privacy statutes applicable in the jurisdictions where Cascade operates. Those statutes include, but are not limited to, the following:
• Virginia Consumer Data Protection Act ("VCDPA"), Va. Code Ann. §§ 59.1-575 et seq.;
• Colorado Privacy Act ("CPA"), Colo. Rev. Stat. §§ 6-1-1301 et seq.;
• Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 et seq.;
• Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code §§ 541.001 et seq.;
• Oregon Consumer Privacy Act ("OCPA"), Or. Rev. Stat. §§ 646A.570 et seq.;
• Delaware Personal Data Privacy Act ("DPDPA"), Del. Code Ann. tit. 6, ch. 12D;
• New Jersey Data Privacy Act ("NJDPA"), N.J.S.A. §§ 56:8-166 et seq.; and
• Additional privacy statutes across a total of 19 applicable state privacy laws as of the date of this Notice, as further described in Section 10 below.
Cascade is committed to respecting the privacy of its employees and job applicants and to handling personal information responsibly and in accordance with applicable law. This Notice describes the types of personal information we collect, the purposes for which we collect and use it, the categories of third parties with whom we may share it, and the rights that may be available to you under applicable privacy statutes.
Important: This Notice does not constitute an employment contract or an offer of employment, nor does it alter the terms of any existing employment agreement, offer letter, collective bargaining agreement, or other arrangement between you and the Company. Nothing in this Notice creates any obligation on the part of the Company to continue any individual's employment for any period of time or to refrain from modifying any term or condition of employment.
If you have questions regarding this Notice, please contact Diana Polk, Associate General Counsel and Interim Chief Privacy Officer, at diana.polk@cascade.com or (206) 555-0142, or Meredith Tanaka, General Counsel, at meredith.tanaka@cascade.com. Additional contact information is provided in Section 14 of this Notice.
2. SCOPE AND APPLICABILITY
2.1 Covered Individuals
This Notice applies to the following categories of individuals (collectively, "Covered Individuals"):
• Current employees of Cascade Retail Holdings Inc. and each of its subsidiaries, including full-time, part-time, and seasonal employees, regardless of work location, job title, or level within the organization;
• Former employees of Cascade Retail Holdings Inc. and each of its subsidiaries, to the extent that the Company continues to maintain personal information relating to such former employees; and
• Job applicants who have applied for employment with Cascade Retail Holdings Inc. or any of its subsidiaries, whether such application was submitted through the Company's online career portal, through a third-party recruiting platform, in person at a retail location or fulfillment center, or through any other means.
For the avoidance of doubt, this Notice also applies to individuals who may fall into more than one of the foregoing categories (for example, a current employee who previously applied for a different position, or a former employee who has submitted a new application for re-employment).
2.2 Covered Entities
This Notice is issued by and on behalf of the following legal entities (collectively, the "Covered Entities"):
Each of the foregoing entities may independently collect, use, disclose, or retain personal information about Covered Individuals in connection with its respective operations. However, the Cascade Group operates a centralized human resources function administered by Cascade Retail Holdings Inc. for the benefit of all subsidiaries. As a result, employee and applicant personal information may be shared among the Covered Entities for centralized HR administration, payroll processing, benefits management, and related purposes, as described in greater detail in Sections 5 and 6 below.
2.3 Geographic Scope
This Notice applies to employees and job applicants located in all 50 states of the United States and the District of Columbia. To the extent that specific state privacy laws confer additional or different rights upon employees or applicants located in particular jurisdictions, those state-specific rights and supplemental disclosures are set forth in Section 10 of this Notice.
2.4 Relationship to Consumer Privacy Policy
This Notice addresses the collection, use, disclosure, and retention of personal information in the employment and recruitment context specifically. It is separate and distinct from the following consumer-facing privacy disclosures maintained by the Company:
• Cascade Omnibus Privacy Policy (available at cascade.com/privacy), which governs the collection, use, and disclosure of personal information about consumers, website visitors, and customers of the Cascade Group's retail stores and e-commerce platforms; and
• California-Specific Privacy Disclosures Addendum (available at cascade.com/privacy/california), which supplements the Omnibus Privacy Policy with California-specific disclosures required under the CCPA/CPRA for consumers.
Employees of the Cascade Group who are also consumers of the Company's products and services — including, without limitation, employees who are registered members of the Cascade Rewards loyalty program (approximately 41.2 million total registered members as of the effective date of this Notice) — may also be covered by the Cascade Rewards Loyalty-Program Privacy Notice in their capacity as consumers. In the event of any conflict between this Notice and the consumer-facing privacy disclosures with respect to personal information collected, used, or disclosed in the employment or recruitment context, this Notice shall control.
3. CATEGORIES OF PERSONAL INFORMATION COLLECTED
The following sections describe the categories of personal information that Cascade collects about employees and job applicants. Not all categories of personal information are collected about every individual; the specific information collected depends on the individual's role, location, employment status, and the circumstances of the collection.
3.1 Identifiers. Cascade collects personal identifiers about employees and job applicants, including but not limited to the following:
• Full legal name, including any aliases, maiden names, and preferred names;
• Date of birth;
• Social Security number;
• Driver's license number or state-issued identification card number;
• Passport number and other government-issued identification numbers;
• Immigration and work-authorization documentation, including visa type and status, Employment Authorization Document (EAD) information, and Permanent Resident Card information;
• Home address, mailing address (if different from home address), and any forwarding address on file;
• Personal email address and company-assigned email address;
• Personal telephone number(s) and company-assigned telephone number(s);
• Company-assigned employee identification number;
• Company-issued badge number;
• Photograph (e.g., for employee badge, company directory, or internal communications).
3.2 Professional and Employment-Related Information
Cascade collects a broad range of professional and employment-related information, including but not limited to:
• Recruitment materials: Resume or curriculum vitae, cover letter, job application form and responses, writing samples or work-product samples submitted in connection with the application process, and any other materials provided by or on behalf of the applicant during the recruitment process;
• Employment and educational history: Prior employment history, including employer names, dates of employment, positions held, and reasons for departure; educational history, including institutions attended, degrees obtained, dates of attendance, and fields of study; professional licenses, certifications, and memberships in professional organizations;
• Position and organizational information: Current and historical job titles, department assignments, work locations (including specific retail store, fulfillment center, or corporate office assignment), reporting structure and supervisor information, employee classification (exempt/non-exempt, full-time/part-time/seasonal), and any applicable collective bargaining unit designation;
• Performance and development information: Performance evaluations and ratings, self-assessments, peer reviews, 360-degree feedback, disciplinary records (including written warnings, performance improvement plans, and suspension records), promotion and transfer history, and records relating to professional development and training activities, including participation in the employee privacy training program to be deployed across the organization in Q4 2025;
• Compensation and payroll data: Base salary or hourly wage rate, bonus and commission eligibility and payments, overtime records, pay grade and pay band, payroll deductions (including tax withholdings, benefit premium contributions, retirement plan contributions, and voluntary deductions), and year-to-date earnings;
• Benefits enrollment information: Health insurance plan elections and covered dependents, dental insurance plan elections, vision insurance plan elections, life insurance and accidental death and dismemberment (AD&D) insurance elections and beneficiary designations, retirement plan enrollment and contribution elections (including 401(k) and Roth 401(k) elections), flexible spending account (FSA) and health savings account (HSA) elections, and enrollment in any other voluntary benefits offered by the Company; and
• Time, attendance, and leave records: Clock-in and clock-out times, hours worked, shift schedules, overtime hours, paid time off (PTO) balances and usage, sick leave usage, leave of absence requests and approvals (including leave under the Family and Medical Leave Act ("FMLA"), the Americans with Disabilities Act ("ADA"), and applicable state family and medical leave laws), jury duty leave, bereavement leave, and military leave.
3.3 Financial Information
Cascade collects certain financial information about employees in connection with payroll, tax, and expense-management processes, including but not limited to:
• Bank account numbers and routing numbers provided by the employee for purposes of direct deposit of wages;
• Federal and state tax withholding forms, including IRS Form W-4, state equivalents, and IRS Form W-2 and state equivalents issued by the Company;
• Wage garnishment orders, child support withholding orders, tax levies, and related court-ordered or government-ordered deductions;
• Expense reimbursement records, including receipts and supporting documentation for business expenses; and
• Corporate credit card transaction data, where the employee has been issued a Company corporate credit card.
3.4 Sensitive Personal Information
As defined under the CCPA/CPRA and analogous state privacy statutes, Cascade may collect the following categories of sensitive personal information about employees and job applicants:
• Social Security number, collected for payroll, tax reporting, and benefits administration;
• Driver's license number, state identification card number, and passport number, collected for identity verification, I-9 compliance, and other lawful employment purposes;
• Account log-in credentials, including usernames and passwords for internal Company systems (e.g., the employee self-service HR portal, Company email, Company intranet, and other enterprise applications);
• Precise geolocation data, collected from Company-issued mobile devices or from applications used in fulfillment and logistics operations at Ridgeline Fulfillment Services Inc., including GPS data used for route optimization, delivery tracking, and fleet management;
• Racial or ethnic origin, collected solely for the purpose of equal employment opportunity ("EEO") reporting, affirmative-action compliance, and voluntary self-identification programs, and only to the extent that the employee or applicant voluntarily provides such information or as otherwise required by law;
• Contents of mail, email, and text messages where Cascade is not the intended recipient — Cascade does not intentionally collect the content of personal communications; however, personal communications transmitted through or stored on Company-owned systems, devices, or networks may be incidentally captured in the course of legitimate system monitoring, IT security operations, or workplace investigations;
• Information concerning health, including information provided in connection with requests for reasonable accommodations under the ADA or analogous state laws, workers' compensation claims, medical certifications for FMLA or other leave purposes, return-to-work certifications, and drug-test results;
• Information regarding sex life or sexual orientation, only if voluntarily provided by the employee in connection with the Company's diversity, equity, and inclusion ("DEI") programs, employee resource groups, or voluntary self-identification surveys; and
• Union membership, where applicable and to the extent necessary for administration of collective bargaining agreements and compliance with labor law obligations.
Cascade processes sensitive personal information only for the purposes authorized under the CCPA/CPRA and applicable state privacy regulations and does not use sensitive personal information for the purpose of inferring characteristics about employees or applicants beyond the specific purposes for which such information was collected.
3.5 Internet and Electronic Network Activity Information
Cascade collects information relating to employees' use of Company-owned systems, devices, and networks, including but not limited to:
• Company device usage logs, including computer and mobile-device activity, application usage, file-access records, and software-installation records;
• Network activity logs, including internet browsing history on Company networks, bandwidth usage, and connections to external websites and services;
• Company email activity logs, including metadata relating to the sending and receipt of email messages through Company email accounts;
• Badge-swipe and physical-access records generated when employees enter or exit Company facilities, including retail stores, fulfillment centers, corporate offices, and restricted areas within such facilities;
• Video surveillance footage captured by security cameras installed at Cascade retail locations, fulfillment centers, and corporate offices (cameras are located in common areas, entrances, exits, loading docks, sales floors, and warehouse areas, but not in restrooms, designated break rooms, or other areas where monitoring is prohibited by law); and
• GPS and geolocation data from Company-owned vehicles and Company-issued devices used in connection with Ridgeline Fulfillment Services Inc. delivery, logistics, and fleet-management operations.
3.6 Biometric Information
At certain retail store and fulfillment center locations, Cascade collects biometric information in the form of fingerprint scans or hand-geometry scans for time-clock (timekeeping) purposes. The collection of biometric information is limited to those locations where biometric timekeeping systems have been deployed and is subject to applicable state biometric-privacy laws, including the Illinois Biometric Information Privacy Act ("BIPA"), 740 ILCS 14/1 et seq. Additional information regarding Cascade's biometric-data practices is provided in Section 11 of this Notice.
3.7 Education Information
Cascade collects education-related information about employees and job applicants, including academic transcripts, copies of diplomas and degrees, records of professional certifications and licenses, and records of continuing education. Such information may be collected during the recruitment process in connection with the evaluation of an applicant's qualifications, or during the course of employment in connection with promotions, transfers, tuition-reimbursement programs, or professional-development initiatives.
3.8 Inferences. Cascade may draw inferences from the categories of personal information described in this Section 3 to create internal profiles reflecting an individual's job performance, professional qualifications, aptitude, skills, competencies, professional development needs, career trajectory, and suitability for particular roles, assignments, or training opportunities. Such inferences are drawn for legitimate employment-related purposes, including performance management, succession planning, and workforce development, and are subject to human review.
3.9 Job-Applicant-Specific Information
In addition to the categories of personal information described above, Cascade collects the following categories of information specifically in connection with the recruitment process:
• Application form data submitted through the Company's online career portal, a third-party recruiting platform (e.g., Ashbury & Co., indeed, Westmark Health IT), or in person at a Company location;
• Interview notes and evaluation forms completed by Company interviewers;
• Results of skills assessments, aptitude tests, or other pre-employment evaluations administered by the Company or a third-party assessment provider;
• Reference-check information obtained from references provided by the applicant or from prior employers;
• Background-check results, including criminal-history information, credit history (where permitted by applicable law and relevant to the position), driving-record information, and verification of employment history, educational credentials, and professional licenses, subject to all applicable fair-chance hiring, "ban-the-box," and other laws restricting the use of criminal-history information in employment decisions; and
• Pre-employment drug screening results, where required for the position or applicable work location.
4. SOURCES OF PERSONAL INFORMATION
Cascade collects personal information about employees and job applicants from the following categories of sources:
Directly from the individual. The primary source of employee and applicant personal information is the individual. Information is collected directly from you when you submit a job application, complete onboarding forms and new-hire paperwork, enroll in or make changes to benefits elections, update your personal information through the employee self-service HR portal, respond to voluntary diversity and self-identification surveys, submit expense reports, and interact with Company HR representatives in the course of your employment or application process.
From Cascade's internal systems and operations. Personal information is generated by and collected through the Company's internal systems and operations in the course of the employment relationship. These systems include, without limitation, the Company's payroll processing system, human resource information system (HRIS), performance management system, learning management system, IT network and security monitoring systems (including intrusion detection and data loss prevention tools), badge-access control systems, video surveillance systems, GPS and fleet-management systems, and Company-issued computers, mobile devices, and other equipment.
From third-party sources. Cascade receives personal information about employees and job applicants from range third-party sources, including:
• Background-check providers, which supply criminal-history reports, credit reports (where applicable), driving records, and verification of employment, education, and professional credentials;
• Recruitment agencies and staffing firms that refer candidates for open positions;
• Prior employers, contacted in connection with reference checks and employment verification;
• Educational institutions, contacted for degree and enrollment verification;
• Government agencies, including the U.S. Department of Homeland Security and the Social Security Administration (in connection with E-Verify and Form I-9 processes), the Internal Revenue Service and state tax authorities (in connection with tax withholding and reporting), and courts and government agencies that issue wage garnishment orders, child support withholding orders, and other legal process;
• Benefits providers and insurance carriers, including health, dental, vision, life, disability, and workers' compensation insurance carriers, which may provide claims-related information and enrollment confirmations. This category also includes Northcastle Indemnity Company, in its capacity as the Company's cyber/privacy-liability insurer, to the extent that employee-data-related incidents trigger coverage obligations and necessitate the exchange of information relevant to coverage determinations and claims management; and
• Ridgepoint Insurance Brokers Inc., the Company's insurance broker, which facilitates the placement and administration of insurance coverage, including workers' compensation and employee benefits programs.
From Cascade subsidiaries. Because the Cascade Group operates a centralized human resources function, employee and applicant personal information may be transferred between and among the Covered Entities — Cascade Retail Holdings Inc., Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. — for purposes of centralized HR administration, payroll processing, benefits management, internal mobility and transfer management, and other legitimate business purposes.
5. PURPOSES FOR COLLECTION, USE, AND DISCLOSURE
5.1 Business Purposes
Cascade collects, uses, and discloses employee and applicant personal information for the following business purposes:
Recruitment and Hiring. Cascade uses personal information to evaluate job applications, identify and assess qualified candidates, conduct interviews and skills assessments, perform background checks and reference checks (in compliance with applicable fair-chance and ban-the-box laws), verify employment eligibility, communicate with applicants regarding the status of their applications, and make hiring decisions. Personal information collected during the recruitment process may also be used to consider applicants for future open positions, unless the applicant requests otherwise.
Employment Administration. Cascade uses personal information throughout the employment lifecycle for purposes including, without limitation, onboarding and new-hire processing, payroll processing and wage disbursement, administration of benefits programs (health insurance, retirement plans, paid time off, and other benefits), tax withholding and reporting (including preparation and filing of W-2s and other tax forms), timekeeping and attendance tracking, management of leaves of absence (FMLA, ADA accommodations, state leave programs, and other types of leave), administration of internal transfers and promotions, and management of the employee separation process (including final pay, COBRA administration, and exit processing).
Performance Management. Cascade uses personal information to manage employee performance, including conducting regular performance reviews, establishing and tracking individual and team performance goals, administering disciplinary processes (including written warnings, performance improvement plans, and suspensions), managing succession planning for key roles, and providing professional development and training opportunities. This includes the Company's forthcoming employee privacy training program, which is being developed in collaboration with the Privacy Office and is scheduled for deployment across the organization in Q4 2025.
Workplace Safety and Security. Cascade uses personal information to maintain a safe and secure work environment, including monitoring physical access to Company facilities through badge-swipe systems, operating video surveillance in retail stores, fulfillment centers, and corporate offices, investigating workplace safety incidents and near-miss events, administering workers' compensation claims, and conducting drug and alcohol testing where permitted by applicable law and Company policy. The Company's security operations are coordinated with the Chief Information Security Officer, Gregory Farris, and the information security team to ensure that physical and digital security measures operate in a coordinated manner.
Legal Compliance. Cascade uses personal information to comply with its obligations under a wide range of federal, state, and local laws and regulations, including but not limited to employment and labor laws, anti-discrimination laws, EEO and affirmative-action reporting requirements, OSHA workplace safety regulations, tax and payroll regulations, employee benefits regulations (ERISA, ACA, COBRA, HIPAA), immigration laws (Form I-9, E-Verify), and wage-and-hour laws. Cascade also uses personal information to respond to lawful subpoenas, court orders, regulatory inquiries, and other legal process.
IT Security and Network Administration. Cascade uses personal information in connection with the management and protection of the Company's information technology infrastructure, including monitoring Company systems and devices for security threats and vulnerabilities, managing user access credentials and permissions, enforcing the Company's Acceptable Use Policy, detecting and responding to potential data-security incidents, and conducting forensic investigations of security events. These activities are overseen by Chief Information Security Officer Gregory Farris and the information security team.
Internal Investigations. Cascade uses personal information in connection with internal investigations relating to potential violations of Company policies, including the Company's Code of Conduct, anti-harassment and anti-discrimination policies, anti-fraud and anti-corruption policies, insider trading policies, and other workplace rules. Such investigations may be conducted by the Company's HR department, Legal department, or Compliance function, or by outside counsel or investigators retained by the Company.
Corporate Transactions. Cascade may use and disclose personal information in connection with due diligence, negotiation, and integration activities relating to potential or completed mergers, acquisitions, reorganizations, divestitures, joint ventures, or asset sales involving the Company or any of its subsidiaries. In such circumstances, personal information may be disclosed to prospective counterparties and their advisors under appropriate confidentiality protections.
5.2 Purposes Not Permitted
No Sale or Sharing. Cascade does not sell employee or applicant personal information, nor does it "share" employee or applicant personal information for cross-context behavioral advertising, as those terms are defined under the CCPA/CPRA. The Company has not sold or shared employee or applicant personal information in the 12-month period preceding the effective date of this Notice, and the Company does not intend to do so.
No Automated Decision-Making with Legal Effects Without Human Review. Employee and applicant personal information is not used for profiling in furtherance of decisions that produce legal or similarly significant effects on an individual without meaningful human review. While Cascade may use automated tools to assist in screening applications, scheduling interviews, or analyzing workforce data, all significant employment decisions — including hiring, promotion, discipline, and termination — involve human judgment and review.
6. CATEGORIES OF RECIPIENTS / DISCLOSURE OF PERSONAL INFORMATION
Cascade may disclose employee and applicant personal information to the following categories of recipients for the purposes described in Section 5:
Cascade Subsidiaries. Personal information may be disclosed among the Covered Entities — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. — for centralized HR administration, payroll processing, benefits management, and other shared corporate functions. Each subsidiary operates under the data-governance policies established by Cascade Retail Holdings Inc., and inter-company transfers of personal information are conducted in accordance with applicable law and internal data-handling standards.
Service Providers and Processors. Cascade engages third-party service providers to perform services on the Company's behalf, and those service providers may receive or access employee and applicant personal information in the course of providing such services. All service providers that process personal information on behalf of Cascade are contractually bound under written data processing agreements that restrict their use of personal information to the specific purposes for which they are engaged, require them to implement appropriate security measures, and obligate them to comply with applicable privacy laws. Categories of service providers include, without limitation:
• Payroll processing providers;
• Benefits administration platforms and third-party administrators;
• Background-check and employment-verification vendors;
• Recruiting platforms and applicant tracking system providers;
• Information technology service providers, including cloud hosting, software-as-a-service (SaaS), and managed IT services providers;
• Employee training and learning management system providers; and
• Fieldhaven Consulting Group LLC, in its capacity as the technical implementer of Cascade's privacy compliance program, to the extent that Fieldhaven personnel access employee personal information in connection with data-mapping exercises, data-inventory creation, data-subject request ("DSR") automation configuration, and related implementation activities. Fieldhaven's access to personal information is governed by a written data processing agreement and is limited to the scope of the compliance engagement.
Insurance Carriers and Brokers. Cascade may disclose employee personal information to its insurance carriers and brokers in connection with insurance program administration and claims management, including:
• Northcastle Indemnity Company, the Company's cyber/privacy-liability insurer, to the extent that employee-data-related incidents trigger coverage obligations, require notice to the insurer, or involve claims administration and defense activities; and
• Ridgepoint Insurance Brokers Inc., the Company's insurance broker, which facilitates the placement and administration of the Company's insurance program, including workers' compensation, general liability, and employee benefits coverage.
In addition, employee personal information may be disclosed to workers' compensation insurance carriers, health insurance carriers, disability insurance carriers, and other benefits-related insurance carriers in the ordinary course of benefits administration and claims processing.
External Auditors. Cascade may disclose employee personal information to Lakemont Audit Partners LLP (engagement partner: Sheila Brogan), the Company's independent auditing firm, in connection with annual financial audits, SOC 2 assessments, internal-control evaluations, and other audit and assurance activities that encompass the Company's employee-data controls and HR-related financial processes.
Legal Counsel. Cascade may disclose employee and applicant personal information to the Company's outside legal counsel, including:
• Calderwood & Harkness LLP, which serves as the Company's privacy and data security counsel and has prepared this Notice; and
• Whitfield Greaves LLP (lead partner: Carolyn J. Marsden), which serves as the Company's corporate and securities counsel and may receive employee personal information in connection with legal advice relating to employment matters, regulatory compliance, corporate transactions, and litigation.
Disclosures to legal counsel are made for the purpose of obtaining legal advice and representation and are protected by the attorney-client privilege and/or the work-product doctrine, as applicable.
Government Agencies and Regulators. Cascade discloses employee personal information to government agencies and regulators as required by applicable law, including but not limited to the Internal Revenue Service, state and local tax authorities, the Social Security Administration, the U.S. Department of Labor, the Equal Employment Opportunity Commission ("EEOC"), the Occupational Safety and Health Administration ("OSHA"), state attorneys general, the Federal Trade Commission ("FTC"), and other federal, state, and local agencies. Such disclosures are made in connection with tax reporting, benefits administration, EEO compliance, workplace safety reporting, and responses to lawful regulatory inquiries and investigations.
Law Enforcement. Cascade may disclose employee personal information to law enforcement agencies in response to valid subpoenas, search warrants, court orders, or other lawful process, or where disclosure is reasonably necessary to protect the safety or rights of the Company, its employees, or third parties.
Authorized Third Parties. Cascade may disclose employee personal information to third parties designated or authorized by the employee, including 401(k) plan administrators and recordkeepers, union representatives (where applicable), voluntary benefit providers selected by the employee, and financial institutions or creditors designated by the employee for wage-assignment or other purposes.
7. RETENTION OF EMPLOYEE AND APPLICANT PERSONAL INFORMATION
Cascade retains employee and applicant personal information for the duration of the employment relationship (or, in the case of applicants, the duration of the recruitment process) and for a period thereafter as required by applicable law, regulation, contractual obligation, or legitimate business need. The Company's approach to data retention is guided by the principle that personal information should be retained only as long as necessary to fulfill the purposes for which it was collected or as required by law, and should be securely destroyed or de-identified when it is no longer needed.
Specific retention periods for each category of employee and applicant personal information are set forth in Cascade's Data Retention & Disposal Schedule, which was adopted in October 2025 and establishes retention periods based on the nature of the personal information, the applicable legal and regulatory requirements, and the Company's operational needs. The following general guidelines summarize the key retention periods:
These retention periods represent the standard schedule for disposition of employee and applicant records. In practice, certain records may be retained for longer periods in the following circumstances:
• Legal holds. When the Company reasonably anticipates litigation, a regulatory investigation, or other legal proceeding that may involve particular employee records, a legal hold may be issued by the Legal Department that suspends the normal disposition schedule for the affected records. Legal holds are managed under the supervision of General Counsel Meredith Tanaka and remain in effect until formally released by the Legal Department.
• Contractual obligations. Certain contractual arrangements with third parties (e.g., government contracts, customer agreements, or insurance policies) may impose record-keeping obligations that extend beyond the standard retention periods.
• Ongoing investigations. Records relating to pending workplace investigations, disciplinary proceedings, or compliance reviews may be retained beyond the standard period until the matter is fully resolved and any applicable appeal or review period has expired.
Disposal. Upon expiration of the applicable retention period and in the absence of any legal hold, contractual obligation, or other basis for continued retention, employee and applicant personal information is securely deleted or destroyed in accordance with the Data Retention & Disposal Schedule. Secure disposal methods include physical shredding of paper records, cryptographic erasure of electronic records, and secure degaussing or destruction of storage media, as appropriate to the format and sensitivity of the information.
8. SECURITY OF PERSONAL INFORMATION
Cascade is committed to protecting the confidentiality, integrity, and availability of employee and applicant personal information. The Company implements and maintains reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, disclosure, alteration, destruction, and other forms of unlawful or unauthorized processing. These safeguards are calibrated to the sensitivity of the information involved, the nature and scope of the Company's data-processing activities, and the risks presented by the Company's operating environment.
The Company's information security program is overseen by Chief Information Security Officer Gregory Farris and is implemented in coordination with the Company's IT department, the Privacy Office, and senior management. Key elements of the Company's security program include, but are not limited to:
• Access controls. Role-based access controls ("RBAC") are implemented across all enterprise systems that store or process employee and applicant personal information, ensuring that access is limited to authorized personnel who need such access for legitimate business purposes. Access privileges are reviewed and updated on a regular basis and are promptly revoked upon employee separation or role change.
• Encryption. Personal information is encrypted at rest and in transit using industry-standard encryption algorithms and protocols. Data stored in the Company's cloud-hosted HR systems is encrypted using AES-256 encryption, and data transmitted over public networks is protected using TLS 1.2 or higher.
• Multi-factor authentication ("MFA"). MFA is required for access to all enterprise systems containing employee and applicant personal information, including the HRIS, payroll system, and employee self-service portal.
• Security assessments. The Company conducts regular vulnerability assessments, penetration testing, and security audits of its information systems. Third-party service providers that process personal information on behalf of the Company are subject to security assessments during the vendor onboarding process and on a periodic basis thereafter.
• Employee security-awareness training. All employees are required to complete annual security-awareness training covering topics such as phishing awareness, password hygiene, social engineering, data classification, and incident reporting. The Company's forthcoming employee privacy training program, scheduled for deployment in Q4 2025, will complement existing security training with privacy-specific content.
• Incident response. The Company maintains a documented incident response plan that provides for prompt identification, containment, investigation, remediation, and reporting of data-security incidents. The incident response plan is tested through periodic tabletop exercises and updated as necessary to reflect changes in the threat landscape and regulatory requirements.
Cyber/Privacy-Liability Insurance. In addition to the foregoing technical and organizational measures, Cascade maintains cyber/privacy-liability insurance through Northcastle Indemnity Company to provide financial protection against losses arising from data-security incidents involving employee or other personal information. The current policy provides coverage of $25 million per occurrence and $50 million in annual aggregate, with a policy period of July 1, 2025 through June 30, 2026. The Company's insurance program is administered in coordination with Ridgepoint Insurance Brokers Inc.
No system of safeguards can guarantee absolute security. While Cascade strives to protect employee and applicant personal information through the measures described above, the Company cannot guarantee that unauthorized access, use, or disclosure will never occur. In the event of a data-security incident affecting employee personal information, Cascade will respond in accordance with its incident response plan and comply with all applicable breach-notification requirements under federal, state, and local law.
9. YOUR RIGHTS UNDER APPLICABLE STATE PRIVACY LAWS
Depending on your state of residence and the laws applicable to you, you may have certain rights with respect to the personal information that Cascade collects and maintains about you. This section summarizes the rights available under major state privacy statutes and explains how to exercise those rights.
9.1 California Employees and Applicants — CCPA/CPRA Rights
If you are a California employee or job applicant, you have the following rights under the CCPA/CPRA with respect to the personal information that Cascade has collected about you:
Right to Know / Right to Access. You have the right to request that Cascade disclose to you the categories of personal information it has collected about you, the categories of sources from which the personal information was collected, the business or commercial purposes for which the personal information was collected, the categories of third parties to whom the personal information was disclosed, and the specific pieces of personal information that Cascade has collected about you. You may make a verifiable request to know up to two times within a 12-month period.
Right to Delete. You have the right to request that Cascade delete personal information about you that it has collected from you, subject to certain exceptions. Cascade may deny a deletion request if retention of the personal information is necessary to complete the transaction for which it was collected, to comply with a legal obligation, to detect security incidents, to exercise a legal right, or for other purposes permitted under the CCPA/CPRA. In the employment context, Cascade is required by law to retain substantial categories of employee records for specified periods, as described in Section 7, and those legal obligations may limit the Company's ability to honor a deletion request in full.
Right to Correct. You have the right to request that Cascade correct inaccurate personal information that it maintains about you. Upon receiving a verified request to correct, Cascade will use commercially reasonable efforts to correct the inaccuracy, taking into account the nature of the personal information and the purposes of the processing.
Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to direct Cascade to limit its use of your sensitive personal information (as identified in Section 3.4 of this Notice) to purposes that are necessary for performing services or providing goods reasonably expected by an average employee, as specified in the CCPA/CPRA regulations. Cascade processes sensitive personal information only for such authorized purposes and not for the purpose of inferring characteristics about you.
Right to Non-Discrimination. Cascade will not retaliate against or discriminate against you in any manner for exercising any of the rights described in this section. You will not be subject to any adverse employment action, reduction in benefits, diminished service quality, or other negative treatment as a result of submitting a data-subject request or exercising your privacy rights.
No Sale or Sharing. As stated in Section 5.2, Cascade does not sell or share employee or applicant personal information as those terms are defined under the CCPA/CPRA. Because no sale or sharing occurs, there is no need for you to exercise a right to opt out of sale or sharing in the employment context.
Annual Metrics. In accordance with the CCPA/CPRA regulations, the following metrics reflect Cascade's data-subject request activity for fiscal year 2024 (FY2024), aggregated across consumer and employee requests:
The average response time across all request types during FY2024 was approximately 27 calendar days. Under Cascade's new privacy compliance program, the target response time is 15 business days or fewer. Beginning December 1, 2025, coinciding with the go-live of the Company's DSR workflow automation, employee-specific DSR metrics will be tracked and reported separately from consumer DSR metrics.
9.2 Virginia, Colorado, Connecticut, and Other State-Law Rights
Employees and job applicants located in Virginia, Colorado, Connecticut, and other states with applicable consumer privacy statutes may have additional or analogous rights, including:
• Right to Access — the right to confirm whether a controller is processing your personal data and to access such personal data;
• Right to Delete — the right to request deletion of personal data that you have provided to or that the controller has obtained about you;
• Right to Correct — the right to request correction of inaccurate personal data;
• Right to Data Portability — the right to obtain a copy of your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance; and
• Right to Appeal — if your data-subject request is denied in whole or in part, you have the right to appeal the denial. Cascade provides an appeal-process mechanism through the DSR portal (available upon go-live on December 1, 2025), as required by the Virginia VCDPA, Colorado CPA, Connecticut CTDPA, and other applicable state privacy statutes. Appeals will be reviewed and resolved within the timeframes required by applicable law (generally 60 days).
The specific rights available to you and the procedures for exercising those rights may vary depending on the state in which you are located and the applicable statute. State-specific rights are further detailed in the State-Specific Consumer Rights Supplement, dated September 12, 2025, which applies to employee and applicant requests as well as consumer requests where state law so requires. The State-Specific Consumer Rights Supplement is available on the Cascade employee intranet and at cascade.com/privacy/state-rights.
9.3 How to Submit a Request
Employees and job applicants may submit data-subject requests through any of the following methods:
DSR Portal. Cascade's online Data Subject Request Portal will be available at cascade.com/privacy/request beginning on the go-live date of December 1, 2025. The portal provides a guided interface for submitting access, deletion, correction, and other requests, and includes an appeal-submission mechanism for requests that are denied. Prior to the go-live date, requests may be submitted via email or mail as described below.
Email. You may submit a data-subject request by sending an email to privacy@cascade.com. Your email should include your full name, the Cascade entity with which you are or were employed (or to which you applied), your employee ID number (if applicable), and a description of the right you wish to exercise (e.g., access, deletion, correction).
Mail. You may submit a data-subject request by mailing a written request to:
Cascade Retail Holdings Inc.