1038-00010 · Cascade Retail Holdings · Policies & Notices

loyalty-program-privacy-notice.docx DOCUMENT Finance & Banking

35 / 38 ← → ✕

CASCADE REWARDS LOYALTY-PROGRAM PRIVACY NOTICE

Supplemental Privacy Notice for the Cascade Rewards Program

Financial Incentive Disclosure Pursuant to California Civil Code § 1798.125 and Applicable State Privacy Laws

Issuing Entity: Cascade Retail Holdings Inc., through its subsidiary Cascade Rewards Corp.

Effective Date: September 12, 2025

Prepared by: Cascade Rewards Corp. in coordination with Calderwood & Harkness LLP (Sara Hendricks, Associate, Privacy & Data Security)

Document Status: Final Draft for Deployment

Relationship to Other Notices. This Loyalty-Program Privacy Notice (this "Notice") supplements the Cascade Retail Holdings Inc. Omnibus Privacy Policy (effective September 12, 2025) (the "Omnibus Privacy Policy") and the California-Specific Privacy Disclosures Addendum (effective September 12, 2025) (the "California Addendum"). Together, those documents and this Notice comprise the comprehensive privacy-disclosure suite for the Cascade Rewards program. In the event of any conflict or inconsistency between this Notice and the Omnibus Privacy Policy or the California Addendum, this Notice shall govern with respect to the collection, use, retention, sale, sharing, and disclosure of personal information in connection with the Cascade Rewards program.

Capitalized terms not otherwise defined herein shall have the meanings ascribed to them in the Omnibus Privacy Policy.

Right-click to update Table of Contents

1. Introduction and Purpose

This Notice is provided to members and prospective members of the Cascade Rewards loyalty program (the "Program" or "Cascade Rewards"), which is operated by Cascade Rewards Corp., a Delaware corporation (EIN: 86-3381729) and wholly owned subsidiary of Cascade Retail Holdings Inc., a Delaware corporation (Nasdaq: CSRD; EIN: 84-3192057) ("Cascade," "we," "us," or "our").

The purpose of this Notice is to satisfy the financial-incentive disclosure requirements imposed by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and specifically California Civil Code § 1798.125(b), which requires businesses that offer financial incentives, including loyalty programs, to notify consumers of the material terms of the financial incentive, including the categories of personal information collected and the value of the consumer's data. This Notice is also intended to satisfy analogous disclosure obligations under other applicable state privacy statutes, as identified in Section 14 below.

The Cascade Rewards program constitutes a "financial incentive" as that term is defined under California Civil Code § 1798.125(b)(1), because the Program offers price or service differences to consumers — including, without limitation, member-only discounts, loyalty-point accrual and redemption benefits, free or reduced-cost shipping, and personalized promotional offers — in exchange for the collection, retention, use, sale, and sharing of those consumers' personal information as described in this Notice and the Omnibus Privacy Policy.

Cascade Rewards currently has approximately 41.2 million registered members across all 50 U.S. states and the District of Columbia. Cascade operates 186 retail locations in 31 U.S. states and ships e-commerce orders to all 50 states and the District of Columbia. Cascade Rewards members may earn and redeem Program benefits through any available channel, including in-store purchases at Cascade retail locations, online purchases at cascade.com (including the Cascade Digital Marketplace), and purchases made through the Cascade mobile application (the "Cascade App").

This Notice should be read carefully and in conjunction with the Omnibus Privacy Policy, the California Addendum, and the Cascade Rewards Terms and Conditions. We encourage all Cascade Rewards members to review these documents to understand how their personal information is collected, used, and protected in connection with the Program.

2. Material Terms of the Cascade Rewards Program

2.1 Program Overview

Cascade Rewards is a free-to-join loyalty program available to consumers who register with a valid name and email address. Providing a phone number and mailing address is optional at the time of enrollment, though certain Program benefits (such as direct-mail promotional offers and SMS notifications) may require the provision of this additional information.

The Program is operated by Cascade Rewards Corp. (EIN: 86-3381729), a Delaware corporation organized under the laws of the State of Delaware, on behalf of Cascade Retail Holdings Inc. (Nasdaq: CSRD). Cascade Rewards Corp. serves as the entity responsible for the day-to-day administration of the Program, including points tracking, redemption processing, stored-value card management, and member communications.

Members earn loyalty points ("Cascade Points") on qualifying purchases made at any of the 186 Cascade retail locations nationwide, on cascade.com (including the Cascade Digital Marketplace operated by Cascade Digital Marketplace LLC, a wholly owned subsidiary of Cascade Retail Holdings Inc.), and through the Cascade App. Qualifying purchases include purchases of eligible merchandise and services from Cascade and from participating third-party sellers on the Cascade Digital Marketplace, subject to the terms and exclusions set forth in the Cascade Rewards Terms and Conditions.

2.2 Benefits Offered to Members

Participation in the Cascade Rewards program entitles members to the following benefits, which may be modified, expanded, or discontinued from time to time at Cascade's discretion and upon reasonable notice to members:

• Loyalty Points Accrual. Members earn Cascade Points on qualifying purchases at a base rate of one (1) point per one dollar ($1.00) spent, before applicable taxes and after the application of any discounts or promotional credits. Accelerated earning rates may apply during promotional periods or for members in higher loyalty tiers.

• Member-Only discounts, Promotions, and Early-Access Events. From time to time, Cascade offers exclusive discounts, promotional pricing, and early access to sale events that are available only to registered Cascade Rewards members. These promotions are communicated through email, push notifications (via the Cascade App), direct mail, and in-store signage.

• Birthday Rewards and Anniversary Incentives. Members who have provided a date of birth receive a personalized birthday reward, typically in the form of bonus points or a discount coupon, during their birthday month. Anniversary incentives recognize the member's enrollment anniversary with the Program.

• Free or Reduced-Cost Shipping. Cascade Rewards members may qualify for free standard shipping or reduced-cost expedited shipping on e-commerce orders that meet certain minimum purchase thresholds, as set forth in the Cascade Rewards Terms and Conditions and as communicated at the time of checkout.

• Personalized Product Recommendations and Curated Offers. Based on a member's purchase history, browsing behavior, and inferred preferences, Cascade provides personalized product recommendations and curated promotional offers through cascade.com, the Cascade App, email, and other communication channels. These personalization features are powered by Peakview Analytics Inc., a wholly owned subsidiary of Cascade Retail Holdings Inc.

• Stored-Value Card Functionality. Members may use the Cascade Rewards stored-value card to pre-load balances for use toward future purchases. The stored-value card may be used in-store, online, and through the Cascade App, subject to the terms governing stored-value card transactions.

• Points Redemption. Accumulated Cascade Points may be redeemed toward future purchases of eligible merchandise and services, Cascade gift cards, or other Program benefits as identified and made available by Cascade from time to time. Points redemption rates, minimum redemption thresholds, and expiration policies are governed by the Cascade Rewards Terms and Conditions.

2.3 Eligibility and Enrollment

The Cascade Rewards program is open to residents of the United States who are aged sixteen (16) years or older at the time of enrollment. There is no purchase requirement to enroll in the Program, and there is no membership fee or recurring charge associated with basic Program membership.

Enrollment is available through the following channels:

• Online: Consumers may enroll at cascade.com/rewards by completing the online registration form.

• Mobile App: Consumers may enroll through the Cascade App by navigating to the Rewards section and completing the in-app registration process.

• In-Store: Consumers may enroll at any of Cascade's 186 retail locations by requesting enrollment assistance from a Cascade associate or completing a registration form at a designated in-store kiosk.

Upon enrollment, members are provided with a unique Cascade Rewards account number and may create online account credentials for accessing their Rewards account through cascade.com and the Cascade App.

3. Categories of Personal Information Collected Through the Program

Cascade collects the following categories of personal information from and about Cascade Rewards members in connection with the administration and operation of the Program. These categories correspond to the categories enumerated in California Civil Code § 1798.140(v) and related statutory provisions:

Identifiers. Full legal name, email address, telephone number (if provided), mailing address (if provided), date of birth (if provided), Cascade Rewards account number, and online account credentials (username and password) used to access the member's Rewards account through cascade.com and the Cascade App.

Commercial Information. Records of products and services purchased, returned, or exchanged by the member, including transaction amounts, itemized product details, transaction dates and times, associated store or channel information, return and exchange history, stored-value card balances and transaction history, and Cascade Points earned, redeemed, expired, and currently held.

Internet or Other Electronic Network Activity Information. Browsing history on cascade.com and the Cascade App, click-stream data reflecting navigation patterns and page interactions, search queries entered on Cascade properties, interaction data from promotional emails (including open rates and click-through events) and push notifications sent through the Cascade App, and cookie and tracking-technology data. As of the effective date of this Notice, Cascade employs twelve (12) categories of cookies and tracking technologies across its digital properties, as described in the Cascade Cookie Policy (accessible at cascade.com/cookies).

Geolocation Data. Precise geolocation data collected from the Cascade App when the member has enabled location services on their mobile device. Precise geolocation data constitutes "sensitive personal information" under the CCPA/CPRA (California Civil Code § 1798.140(ae)) and is subject to the additional protections described in Section 10 of this Notice.

Inferences. Consumer preferences, predicted purchase interests, loyalty tier classifications, propensity scores (including purchase-likelihood scores and churn-risk scores), and audience segment assignments. These inferences are generated by Peakview Analytics Inc. (a Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc.) through the application of machine-learning models and statistical algorithms to the categories of personal information described above, for the purpose of personalizing the member experience and delivering targeted advertising.

Sensitive Personal Information. The following categories of personal information collected through the Program are classified as sensitive personal information under the CCPA/CPRA:

(a) Precise geolocation data collected from the Cascade App when location services are enabled;

(b) Account login credentials (username and password) used to access the member's Cascade Rewards account; and

(c) Payment-card data (including card number, expiration date, and security code) to the extent stored in connection with stored-value card transactions or saved payment methods.

The specific purposes for which each category of personal information is collected and used are set forth in Section 4 below.

4. Purposes of Collection and Use of Personal Information

Personal information collected from Cascade Rewards members is used for the following business and commercial purposes:

Program Administration. Administering the Cascade Rewards program, including tracking Cascade Points accrual and balances, processing points redemptions, managing stored-value card balances and transactions, maintaining accurate member accounts, communicating program updates and benefit changes, and ensuring the integrity of the Program. This purpose encompasses all processing activities that are reasonably necessary to operate the Program as described in Section 2 of this Notice and in the Cascade Rewards Terms and Conditions.

Personalization of the Member Experience. Providing tailored product recommendations, curated offers, and relevant promotions to members based on their purchase history, browsing behavior, and inferred preferences. Personalization is powered by Peakview Analytics Inc., which applies proprietary algorithms and machine-learning models to member data to generate individualized content and offers. Cascade believes that personalization is a core value proposition of the Cascade Rewards program and a material benefit to members.

Marketing and Advertising. Delivering targeted advertising and promotional communications to Cascade Rewards members through Cascade's advertising technology stack, which is operated by Peakview Analytics Inc. Peakview Analytics processes approximately 2.1 billion consumer-event data records per month for the purpose of advertising targeting, personalization, audience segmentation, and campaign measurement across Cascade's owned and operated channels and third-party advertising platforms. Marketing communications may be delivered via email, push notification, SMS (where the member has provided a phone number and opted in to SMS communications), direct mail, and digital advertising (including display, social media, and programmatic advertising channels).

Data Sharing with Third-Party Advertising and Analytics Partners. Cascade shares Cascade Rewards member data with third-party advertising and analytics partners to facilitate targeted advertising, audience modeling, attribution measurement, and analytics. As of the most recent data-mapping exercise conducted by Fieldhaven Consulting Group LLC in May 2025, Cascade shares consumer data with forty-seven (47) third-party advertising and analytics partners. Certain sharing of Cascade Rewards member data with these partners may constitute a "sale" or "sharing" of personal information as those terms are defined under the CCPA/CPRA and other applicable state privacy laws. The details of these data-sharing relationships are further described in Section 6 of this Notice, and the consumer's right to opt out of such sale or sharing is described in Section 7.

Analytics and Business Operations. Performing aggregated and individual-level analysis of Cascade Rewards member data to improve Cascade's product offerings, merchandising strategies, store operations, supply chain efficiency, and overall customer experience. Analytics activities include sales trend analysis, customer segmentation, market research, and performance measurement of the Cascade Rewards program itself.

Fraud Prevention and Security. Detecting, investigating, and preventing fraudulent activity, unauthorized access, and other security threats affecting the Cascade Rewards program, member accounts, stored-value card balances, and Cascade's systems and infrastructure. This includes monitoring for anomalous account activity, points-manipulation schemes, and unauthorized redemption attempts.

Compliance with Legal Obligations. Using and retaining personal information as necessary to comply with applicable federal, state, and local laws, regulations, and legal processes, including responding to subpoenas, court orders, and law enforcement requests, and satisfying regulatory reporting and audit requirements.

5. Financial Incentive Disclosure Under CCPA § 1798.125(b)

5.1 Nature of the Financial Incentive

The Cascade Rewards program offers price and service differences — including member-only discounts, free or reduced-cost shipping, loyalty-points accrual and redemption, birthday and anniversary rewards, and access to personalized product recommendations and curated promotional offers — to consumers who enroll in the Program and thereby provide and permit the ongoing collection, retention, use, sale, and sharing of their personal information as described in this Notice and the Omnibus Privacy Policy.

These benefits are available exclusively to consumers who have enrolled in the Cascade Rewards program and who maintain an active Rewards account. Consumers who do not enroll in the Program, or who withdraw from the Program, do not receive these benefits. Similarly, the exercise of certain privacy rights by a member — for example, a request for the deletion of personal information that is essential to maintaining the member's Rewards account, or an opt-out of the sale or sharing of personal information that supports the personalization features of the Program — may impact the member's ability to receive certain Program benefits, as further described in Section 8 of this Notice.

Cascade does not discriminate against consumers who exercise their privacy rights under the CCPA/CPRA or other applicable state privacy laws. The relationship between the exercise of privacy rights and the availability of Program benefits is described in Section 8 below.

5.2 Good-Faith Estimate of the Value of Consumer Data

Pursuant to California Civil Code § 1798.125(b)(1) and the implementing regulations promulgated by the California Privacy Protection Agency, Cascade has calculated a good-faith estimate of the value of the personal information collected from Cascade Rewards members, using the methodology described below.

Revenue Attributable to the Loyalty Program. Cascade estimates the incremental revenue generated by the Cascade Rewards program by measuring the difference between the average per-transaction spend of Cascade Rewards members and the average per-transaction spend of non-member consumers, and then multiplying that incremental per-transaction amount by the total number of Cascade Rewards member transactions during the applicable fiscal year. This incremental revenue figure is then expressed as a percentage of Cascade's total consolidated revenue for fiscal year 2024, which was $3.87 billion. The resulting figure represents Cascade's estimate of the total incremental revenue attributable to the existence and operation of the Cascade Rewards program.

Expenses Related to the Program. Cascade accounts for the costs and expenses associated with operating the Cascade Rewards program, including:

(a) Program administration costs incurred by Cascade Rewards Corp., including personnel costs, customer-service expenses, and general administrative overhead;

(b) Technology and data infrastructure costs incurred by Peakview Analytics Inc. in connection with the data-processing, analytics, and advertising-technology platforms that support the Program;

(c) Marketing and promotional offer costs, including the cost of discounts, promotional pricing, free-shipping subsidies, birthday rewards, and other promotional benefits extended to members;

(d) Stored-value card fulfillment costs, including card production, distribution, and payment-processing fees; and

(e) Data-analytics and data-management costs, including vendor fees paid to third-party service providers such as OnPoint Data Solutions Inc. and Fieldhaven Consulting Group LLC.

Per-Member Value Calculation. The estimated value of the personal information collected from each Cascade Rewards member is calculated by dividing the net incremental revenue attributable to the Program (i.e., the incremental revenue described above, minus the expenses described above) by the total number of registered Cascade Rewards members, which is approximately 41.2 million as of the effective date of this Notice.

Result. Based on the methodology described above, Cascade has determined in good faith that the value of the financial incentive offered to each Cascade Rewards member — in the form of discounts, loyalty points, free or reduced-cost shipping, personalized offers, and other Program benefits — is reasonably related to the value of the personal information provided by that member and collected, retained, used, sold, and shared by Cascade in connection with the Program.

Cascade reserves the right to update this valuation methodology on an annual basis as part of its annual privacy-program assessment. The first annual privacy-program assessment cycle under the comprehensive compliance program is scheduled for completion by June 30, 2026.

5.3 Why the Financial Incentive is Permitted

The financial incentive offered through the Cascade Rewards program is permitted under California Civil Code § 1798.125(b)(4) because the value of the financial incentive — that is, the aggregate value of the discounts, points, free or reduced-cost shipping, and other benefits made available to each Cascade Rewards member — is reasonably related to the value of the consumer's data to Cascade, as calculated using the methodology described in Section 5.2 above.

Cascade does not offer financial incentives that are unjust, unreasonable, coercive, or usurious in nature. Enrollment in the Cascade Rewards program is entirely voluntary, requires no purchase and no membership fee, and may be discontinued by the consumer at any time without penalty, as described in Section 7.2 of this Notice.

6. Data Sharing and Third-Party Relationships

Cascade Rewards member data may be shared with the following categories of recipients in connection with the administration and operation of the Program and for the other purposes described in Section 4 of this Notice:

Cascade Affiliates and Subsidiaries. Cascade may share Rewards member personal information with its affiliated entities and wholly owned subsidiaries, including:

• Cascade Digital Marketplace LLC — operator of the Cascade Digital Marketplace, a third-party seller platform integrated with cascade.com;

• Ridgeline Fulfillment Services Inc. — provider of order fulfillment, warehousing, and logistics services for Cascade e-commerce orders;

• Peakview Analytics Inc. — operator of Cascade's advertising-technology stack, data-analytics platforms, and personalization engines; and

• Cascade Rewards Corp. — administrator of the Cascade Rewards program.

Each of these entities is a wholly owned subsidiary of Cascade Retail Holdings Inc. and processes Rewards member data in accordance with Cascade's internal data-governance policies and applicable data-processing agreements.

Third-Party Advertising and Analytics Partners. As described in Section 4, Cascade shares Rewards member data with third-party advertising and analytics partners to support targeted advertising, audience segmentation, attribution measurement, and analytics. As of the effective date of this Notice, Cascade shares data with forty-seven (47) third-party advertising and analytics partners, as identified in the data-mapping exercise completed by Fieldhaven Consulting Group LLC in May 2025. Of these forty-seven partners, twenty-three (23) are currently in the process of executing updated data processing agreements that incorporate the contractual safeguards required by the CCPA/CPRA and other applicable state privacy laws.

A key advertising partner is Thornbridge Media Corp., with which Cascade had an aggregate advertising spend of $18.4 million in fiscal year 2024. Cascade and Thornbridge Media Corp. are in the process of restructuring their data-sharing agreement to ensure full compliance with the CCPA/CPRA's requirements regarding the sale and sharing of personal information, including the implementation of adequate contractual restrictions on Thornbridge Media Corp.'s use, retention, and further disclosure of Rewards member data. The target date for execution of the restructured agreement is October 31, 2025.

Certain data-sharing arrangements between Cascade and its third-party advertising and analytics partners involving Rewards member data constitute "sharing" of personal information for "cross-context behavioral advertising" as those terms are defined under CCPA/CPRA (California Civil Code §§ 1798.140(ah) and 1798.140(k)), and consumers have the right to opt out of such sharing as described in Section 7.3 of this Notice. Certain of these arrangements may also constitute a "sale" of personal information under applicable state privacy laws.

Service Providers and Contractors. Cascade engages third-party service providers and contractors to perform services on Cascade's behalf in connection with the Cascade Rewards program and Cascade's broader business operations. These service providers process Rewards member personal information only pursuant to written agreements that restrict the use of personal information to the specific purposes for which it was provided and prohibit the service provider from selling, sharing, or otherwise using the personal information for the service provider's own commercial purposes. Key service providers include:

• OnPoint Data Solutions Inc. — provider of Cascade's consent-management platform, which manages consumer consent preferences, cookie consent, and opt-out signals (including Global Privacy Control) across Cascade's digital properties. Cascade has entered into a three-year contract with OnPoint Data Solutions Inc. with an annual license fee of $480,000, for a total contract value of $1,440,000.

• Fieldhaven Consulting Group LLC — privacy-program technical implementer engaged by Cascade (through Calderwood & Harkness LLP) to provide data-mapping, gap-assessment, compliance-remediation, and ongoing privacy-program support services.

Additional service providers and contractors engaged by Cascade in connection with the Cascade Rewards program and Cascade's broader operations are identified in the Omnibus Privacy Policy.

7. Consumer Rights Regarding the Financial Incentive

7.1 Right to Opt In / Consent

Participation in the Cascade Rewards program is entirely voluntary. By enrolling in the Program, consumers affirmatively opt in to the financial incentive offered by Cascade, thereby consenting to the collection, use, retention, sale, and sharing of their personal information as described in this Notice and the Omnibus Privacy Policy.

The act of enrolling in the Program — whether online at cascade.com/rewards, through the Cascade App, or in-store at a Cascade retail location — constitutes the consumer's informed, voluntary, and affirmative consent to participate in the financial incentive, as required by California Civil Code § 1798.125(b)(3).

Consent for the processing of sensitive personal information — specifically, precise geolocation data collected through the Cascade App and account credentials used to access the member's Rewards account — is obtained through a separate opt-in consent flow that is presented to the consumer at the point of collection, as required under CCPA/CPRA § 1798.121. The design and implementation of this separate consent flow is consistent with the requirements and recommendations set forth in the Sensitive Personal Information Analysis Memorandum prepared by Calderwood & Harkness LLP (dated July 28, 2025).

7.2 Right to Withdraw / Opt Out of the Financial Incentive

Consumers may withdraw from the Cascade Rewards program at any time, without penalty or cost, by using any of the following methods:

(a) Online: Visiting cascade.com/rewards/manage and selecting "Close My Rewards Account," then following the on-screen instructions to confirm account closure;

(b) By Phone: Calling Cascade Customer Service at the toll-free number provided in the Omnibus Privacy Policy and requesting closure of the member's Cascade Rewards account; or

Upon withdrawal from the Program, the member's accumulated Cascade Points balance and any remaining stored-value card balances will be handled in accordance with the terms and conditions set forth in the Cascade Rewards Terms and Conditions, including any applicable expiration, forfeiture, or cash-out provisions.

Following the effective date of a member's withdrawal from the Program, Cascade will cease collecting personal information from and about that consumer for loyalty-program purposes. However, Cascade may continue to retain personal information previously collected from the withdrawing member in accordance with applicable data-retention obligations, as set forth in the Cascade Retail Holdings Inc. Data Retention & Disposal Schedule (discussed in Section 9 of this Notice) and as required by applicable law.

7.3 Right to Opt Out of Sale or Sharing

Cascade Rewards members may exercise their right to opt out of the sale or sharing of their personal information without withdrawing from the Cascade Rewards program entirely. Opting out of the sale or sharing of personal information does not require the member to close their Rewards account or forfeit accumulated Cascade Points.

Cascade honors the Global Privacy Control ("GPC") signal as a valid opt-out-of-sale/sharing request, consistent with CCPA/CPRA requirements and the regulations promulgated by the California Privacy Protection Agency. When Cascade detects a GPC signal from a consumer's browser or device, Cascade will treat that signal as a request to opt out of the sale and sharing of the consumer's personal information associated with that browser or device.

Members may also opt out of the sale or sharing of their personal information by:

(a) Clicking the "Do Not Sell or Share My Personal Information" link available on cascade.com (accessible from every page of the website via the footer navigation); or

(b) Navigating to the privacy-settings section of the Cascade App and selecting the "Do Not Sell or Share My Personal Information" option.

Opting out of the sale or sharing of personal information may affect the availability of certain personalized offers, product recommendations, and curated promotional content that are generated using data shared with third-party advertising and analytics partners. However, opting out of sale or sharing will not prevent the member from earning Cascade Points on qualifying purchases, redeeming accumulated points, accessing stored-value card balances, or receiving non-personalized Program benefits such as member-only discounts and birthday rewards.

7.4 Other Consumer Rights

In addition to the rights described in Sections 7.1 through 7.3 above, Cascade Rewards members may exercise the following consumer privacy rights as described in the Omnibus Privacy Policy and the State-Specific Consumer Rights Supplement:

• Right to Know / Access: The right to request that Cascade disclose the categories and specific pieces of personal information collected about the consumer, the categories of sources from which the information was collected, the business or commercial purposes for the collection, and the categories of third parties to whom the information has been disclosed, sold, or shared.

• Right to Deletion: The right to request that Cascade delete personal information collected from the consumer, subject to applicable exceptions under the CCPA/CPRA and other state privacy laws.

• Right to Correction: The right to request that Cascade correct inaccurate personal information maintained about the consumer.

• Right to Limit Use and Disclosure of Sensitive Personal Information: The right to direct Cascade to limit the use and disclosure of sensitive personal information to purposes necessary to perform the services or provide the goods reasonably expected by an average consumer, as described in Section 10 of this Notice.

Data subject requests ("DSRs") are processed through Cascade's DSR portal, accessible at cascade.com/privacy/requests. In fiscal year 2024, Cascade received approximately 38,400 total DSRs, broken down as follows:

• Requests to access/know: approximately 12,800

• Requests for deletion: approximately 19,100

• Requests to opt out of sale/sharing: approximately 6,500

The average response time for DSRs processed during fiscal year 2024 was twenty-seven (27) calendar days. Under the comprehensive privacy compliance program currently being implemented, Cascade's target response time for all DSRs is fifteen (15) business days or less. The updated DSR workflow, including automated intake, identity verification, and fulfillment processes, is targeted for go-live on December 1, 2025.

Appeal rights are available to consumers residing in Virginia, Colorado, Connecticut, and other states whose privacy statutes require an appeal process for denied or partially denied consumer-rights requests. The procedures for exercising appeal rights are described in the State-Specific Consumer Rights Supplement, which is accessible at cascade.com/privacy.

8. Non-Discrimination

Cascade will not discriminate against any consumer who exercises their privacy rights under the CCPA/CPRA or any other applicable state privacy law. Specifically, Cascade will not engage in any of the following practices in response to a consumer's exercise of privacy rights:

(a) Denying goods or services to the consumer;

(b) Charging the consumer different prices or rates for goods or services, including through the use of discounts, other benefits, or the imposition of penalties;

(d) Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services as a result of exercising their privacy rights.

Notwithstanding the foregoing, if a consumer exercises a privacy right that would render Cascade unable to maintain the consumer's Cascade Rewards account or provide certain Program benefits — for example, a deletion request that encompasses personal information essential to account functionality, such as the consumer's name, email address, or Rewards account number — Cascade will inform the consumer of the specific impact of the request on their Rewards account and Program benefits before completing the request. The consumer will then have the opportunity to confirm, modify, or withdraw the request.

Similarly, as noted in Section 7.3, a consumer's exercise of the right to opt out of the sale or sharing of personal information may affect the availability of certain personalized features of the Program (such as personalized product recommendations and curated offers), but will not affect the consumer's ability to earn or redeem Cascade Points, access stored-value card balances, or receive non-personalized Program benefits.

Cascade's non-discrimination commitment applies equally to consumers in all jurisdictions in which Cascade operates, regardless of whether the consumer's state of residence has enacted a comprehensive privacy statute.

9. Data Retention

Personal information collected through the Cascade Rewards program is retained in accordance with the Cascade Retail Holdings Inc. Data Retention & Disposal Schedule (dated October 2025) (the "Retention Schedule"). The Retention Schedule establishes specific retention periods for each category of personal information collected through the Program and across Cascade's broader business operations, and specifies the procedures for the secure disposal or de-identification of personal information upon the expiration of the applicable retention period.

Cascade acknowledges that, prior to the comprehensive privacy compliance program initiated in June 2025, it lacked a documented data-retention schedule specifically governing customer-transaction data and loyalty-program data. This gap has been identified and remediated as part of the compliance program. The Retention Schedule referenced above represents the first enterprise-wide, documented data-retention framework applicable to Cascade Rewards member data.

Specific retention periods vary by category of personal information and are determined based on the purpose of collection, applicable legal and regulatory requirements, contractual obligations, and legitimate business needs. Members may request information about the specific retention periods applicable to their personal information by contacting Cascade's Privacy Team at the contact information provided in Section 13 of this Notice. Additional detail regarding retention periods is available in the California-Specific Privacy Disclosures Addendum (dated September 12, 2025).

Upon a member's withdrawal from the Cascade Rewards program, Cascade will retain the member's personal information only for the period specified in the Retention Schedule and as necessary to comply with applicable legal obligations, resolve disputes, and enforce Cascade's agreements. Following the expiration of the applicable retention period, the member's personal information will be securely deleted or de-identified in accordance with the procedures set forth in the Retention Schedule.

10. Sensitive Personal Information

As described in Section 3 of this Notice, the Cascade Rewards program may involve the collection and processing of the following categories of sensitive personal information, as defined under CCPA/CPRA (California Civil Code § 1798.140(ae)):

(a) Precise Geolocation Data. The Cascade App collects precise geolocation data from the member's mobile device when the member has enabled location services for the Cascade App. Precise geolocation data is used to provide location-based services, including store locator functionality, in-store navigation assistance, and location-triggered promotional offers.

(b) Account Login Credentials. The username and password used by the member to access their Cascade Rewards account through cascade.com and the Cascade App constitute sensitive personal information under the CCPA/CPRA.

(c) Payment-Card Data. To the extent that payment-card information (including card number, expiration date, and security code) is stored in connection with stored-value card transactions or saved payment methods within the member's Rewards account, such data constitutes sensitive personal information.

Under CCPA/CPRA § 1798.121, consumers have the right to direct a business to limit the use and disclosure of their sensitive personal information to those purposes that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. Cascade Rewards members may exercise this right through the mechanisms described in the Omnibus Privacy Policy and the State-Specific Consumer Rights Supplement, or by contacting Cascade's Privacy Team at the contact information provided in Section 13 of this Notice.

Cascade collects separate opt-in consent for the processing of precise geolocation data through the Cascade App. This separate consent flow is presented to the member at the time location services are first enabled within the Cascade App and may be revoked by the member at any time through the Cascade App's privacy settings or through the member's device settings. The design and implementation of this separate consent mechanism is consistent with the requirements and recommendations identified in the Sensitive Personal Information Analysis Memorandum prepared by Calderwood & Harkness LLP (dated July 28, 2025).

Cascade does not use or disclose sensitive personal information for purposes other than those permitted under CCPA/CPRA § 1798.121(a), except where the consumer has provided separate, affirmative opt-in consent for such use or disclosure.

11. Security of Rewards Member Data

Cascade implements and maintains reasonable administrative, technical, and physical security measures designed to protect the personal information of Cascade Rewards members from unauthorized access, disclosure, alteration, destruction, and other forms of unauthorized processing. These security measures are proportionate to the nature and sensitivity of the personal information collected and are regularly assessed and updated to address evolving threats and vulnerabilities.

Cascade's information-security program is overseen by Gregory Farris, Chief Information Security Officer, who reports to Cascade's executive leadership team and coordinates with the Privacy Team on matters involving the security of personal information. Cascade's security program includes, without limitation, access controls, encryption of personal information in transit and at rest, network security monitoring, vulnerability management, employee security-awareness training, and incident-detection and response capabilities.

Cascade maintains cyber and privacy-liability insurance through Northcastle Indemnity Company, with coverage limits of $25 million per occurrence and $50 million in annual aggregate, for the policy period of July 1, 2025 through June 30, 2026. The annual premium for this coverage is $1,340,000. The insurance policy was brokered by Ridgepoint Insurance Brokers Inc. This insurance coverage is intended to mitigate the financial impact of data-security incidents, including data breaches affecting Cascade Rewards member personal information.

In the event of a data breach or other security incident affecting the personal information of Cascade Rewards members, Cascade will respond in accordance with its incident-response procedures as set forth in the Cascade Retail Holdings Inc. Internal Privacy Policy & Procedures Manual. These procedures include prompt investigation of the incident, containment and remediation of the vulnerability, notification to affected individuals and regulatory authorities as required by applicable data-breach-notification laws, and post-incident review and corrective-action implementation.

12. Updates to This Notice

Cascade may update this Loyalty-Program Privacy Notice from time to time to reflect changes in the Cascade Rewards program, applicable law, regulatory guidance, Cascade's data practices, or Cascade's business operations. When Cascade makes material changes to this Notice, Cascade will provide notice to Cascade Rewards members through reasonable means, which may include posting the updated Notice on cascade.com/privacy, sending an email notification to the email address associated with the member's Rewards account, or providing an in-app notification through the Cascade App.

The date of the most recent update to this Notice will be indicated at the top of this Notice under the heading "Effective Date." Members are encouraged to review this Notice periodically to stay informed about how their personal information is collected, used, and protected in connection with the Cascade Rewards program.

Cascade's prior online privacy policy, which was last updated in March 2022, has been replaced in its entirety by the comprehensive Omnibus Privacy Policy suite dated September 12, 2025, of which this Notice is a component. The prior privacy policy is no longer in effect and does not govern the collection, use, or disclosure of personal information by Cascade or its subsidiaries.

13. Contact Information

For questions, comments, or concerns about this Notice or the privacy practices of the Cascade Rewards program, consumers may contact Cascade using the following information:

Cascade Retail Holdings Inc.

Attn: Privacy Team

4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119

Interim Chief Privacy Officer: Diana Polk, Associate General Counsel (Cascade is actively recruiting a full-time Chief Privacy Officer; hiring is targeted for Q4 2025.)

General Counsel: Meredith Tanaka

Email: privacy@cascade.com

Online: cascade.com/privacy

Consumer-rights requests — including requests to access, delete, or correct personal information; requests to opt out of the sale or sharing of personal information; and requests to limit the use of sensitive personal information — may be submitted through Cascade's DSR portal at cascade.com/privacy/requests. Requests may also be submitted by contacting Cascade Customer Service at the toll-free number provided in the Omnibus Privacy Policy.

Cascade will verify the identity of the consumer submitting a rights request in accordance with the verification procedures described in the Omnibus Privacy Policy and the State-Specific Consumer Rights Supplement.

14. Applicable State Laws

This Notice is intended to satisfy the disclosure requirements of the following state privacy statutes as they relate to loyalty programs, financial-incentive programs, and the collection, use, sale, and sharing of consumer personal information, to the extent applicable to Cascade's operations and the Cascade Rewards program:

As of the engagement opening date of June 2, 2025, Calderwood & Harkness LLP identified a total of nineteen (19) applicable state privacy statutes (including statutes enacted and effective through the 2025–2026 legislative cycles) that impose obligations relevant to the Cascade Rewards program. Additional state privacy statutes may become applicable as new legislation is enacted or existing statutes take effect. Cascade monitors the evolving state privacy landscape on an ongoing basis and will update this Notice and its broader privacy-compliance program as necessary to reflect newly applicable statutory requirements.

To the extent that any applicable state privacy law provides consumer rights or imposes business obligations that exceed those described in this Notice, Cascade will comply with such requirements as set forth in the State-Specific Consumer Rights Supplement and the Omnibus Privacy Policy.

This Cascade Rewards Loyalty-Program Privacy Notice is effective as of September 12, 2025.

Cascade Retail Holdings Inc.

Prepared in coordination with Calderwood & Harkness LLP, 600 Lexington Avenue, 28th Floor, New York, NY 10022 (Matter No. 1038-00010).

Statute	abbreviation
California Consumer Privacy Act / California Privacy Rights Act	CCPA/CPRA (specifically § 1798.125)
Virginia Consumer Data Protection Act	VCDPA
Colorado Privacy Act	CPA
Connecticut Data Privacy Act	CTDPA
Utah Consumer Privacy Act	UCPA
Iowa Consumer Data Protection Act	ICDPA
Indiana Consumer Data Protection Act	INCDPA
Tennessee Information Protection Act	TIPA
Montana Consumer Data Privacy Act	MCDPA
Texas Data Privacy and Security Act	TDPSA
Oregon Consumer Privacy Act	OCPA
Delaware Personal Data Privacy Act	DPDPA
New Jersey Data Privacy Act	NJDPA
New Hampshire Data Privacy Act	NHDPA
Nebraska Data Privacy Act	NDPA
Minnesota Consumer Data Privacy Act	MNCDPA
Maryland Online Data Privacy Act	MODPA
Kentucky Data Privacy Act	KYDPA

CASCADE REWARDS LOYALTY-PROGRAM PRIVACY NOTICE
Supplemental Privacy Notice for the Cascade Rewards Program
Financial Incentive Disclosure Pursuant to California Civil Code § 1798.125 and Applicable State Privacy Laws
Issuing Entity: Cascade Retail Holdings Inc., through its subsidiary Cascade Rewards Corp.
Effective Date: September 12, 2025
Prepared by: Cascade Rewards Corp. in coordination with Calderwood & Harkness LLP (Sara Hendricks, Associate, Privacy & Data Security)
Document Status: Final Draft for Deployment
Relationship to Other Notices. This Loyalty-Program Privacy Notice (this "Notice") supplements the Cascade Retail Holdings Inc. Omnibus Privacy Policy (effective September 12, 2025) (the "Omnibus Privacy Policy") and the California-Specific Privacy Disclosures Addendum (effective September 12, 2025) (the "California Addendum"). Together, those documents and this Notice comprise the comprehensive privacy-disclosure suite for the Cascade Rewards program. In the event of any conflict or inconsistency between this Notice and the Omnibus Privacy Policy or the California Addendum, this Notice shall govern with respect to the collection, use, retention, sale, sharing, and disclosure of personal information in connection with the Cascade Rewards program.
Capitalized terms not otherwise defined herein shall have the meanings ascribed to them in the Omnibus Privacy Policy.
Right-click to update Table of Contents
1. Introduction and Purpose
This Notice is provided to members and prospective members of the Cascade Rewards loyalty program (the "Program" or "Cascade Rewards"), which is operated by Cascade Rewards Corp., a Delaware corporation (EIN: 86-3381729) and wholly owned subsidiary of Cascade Retail Holdings Inc., a Delaware corporation (Nasdaq: CSRD; EIN: 84-3192057) ("Cascade," "we," "us," or "our").
The purpose of this Notice is to satisfy the financial-incentive disclosure requirements imposed by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the "CCPA/CPRA"), and specifically California Civil Code § 1798.125(b), which requires businesses that offer financial incentives, including loyalty programs, to notify consumers of the material terms of the financial incentive, including the categories of personal information collected and the value of the consumer's data. This Notice is also intended to satisfy analogous disclosure obligations under other applicable state privacy statutes, as identified in Section 14 below.
The Cascade Rewards program constitutes a "financial incentive" as that term is defined under California Civil Code § 1798.125(b)(1), because the Program offers price or service differences to consumers — including, without limitation, member-only discounts, loyalty-point accrual and redemption benefits, free or reduced-cost shipping, and personalized promotional offers — in exchange for the collection, retention, use, sale, and sharing of those consumers' personal information as described in this Notice and the Omnibus Privacy Policy.
Cascade Rewards currently has approximately 41.2 million registered members across all 50 U.S. states and the District of Columbia. Cascade operates 186 retail locations in 31 U.S. states and ships e-commerce orders to all 50 states and the District of Columbia. Cascade Rewards members may earn and redeem Program benefits through any available channel, including in-store purchases at Cascade retail locations, online purchases at cascade.com (including the Cascade Digital Marketplace), and purchases made through the Cascade mobile application (the "Cascade App").
This Notice should be read carefully and in conjunction with the Omnibus Privacy Policy, the California Addendum, and the Cascade Rewards Terms and Conditions. We encourage all Cascade Rewards members to review these documents to understand how their personal information is collected, used, and protected in connection with the Program.
2. Material Terms of the Cascade Rewards Program
2.1 Program Overview
Cascade Rewards is a free-to-join loyalty program available to consumers who register with a valid name and email address. Providing a phone number and mailing address is optional at the time of enrollment, though certain Program benefits (such as direct-mail promotional offers and SMS notifications) may require the provision of this additional information.
The Program is operated by Cascade Rewards Corp. (EIN: 86-3381729), a Delaware corporation organized under the laws of the State of Delaware, on behalf of Cascade Retail Holdings Inc. (Nasdaq: CSRD). Cascade Rewards Corp. serves as the entity responsible for the day-to-day administration of the Program, including points tracking, redemption processing, stored-value card management, and member communications.
Members earn loyalty points ("Cascade Points") on qualifying purchases made at any of the 186 Cascade retail locations nationwide, on cascade.com (including the Cascade Digital Marketplace operated by Cascade Digital Marketplace LLC, a wholly owned subsidiary of Cascade Retail Holdings Inc.), and through the Cascade App. Qualifying purchases include purchases of eligible merchandise and services from Cascade and from participating third-party sellers on the Cascade Digital Marketplace, subject to the terms and exclusions set forth in the Cascade Rewards Terms and Conditions.
2.2 Benefits Offered to Members
Participation in the Cascade Rewards program entitles members to the following benefits, which may be modified, expanded, or discontinued from time to time at Cascade's discretion and upon reasonable notice to members:
• Loyalty Points Accrual. Members earn Cascade Points on qualifying purchases at a base rate of one (1) point per one dollar ($1.00) spent, before applicable taxes and after the application of any discounts or promotional credits. Accelerated earning rates may apply during promotional periods or for members in higher loyalty tiers.
• Member-Only discounts, Promotions, and Early-Access Events. From time to time, Cascade offers exclusive discounts, promotional pricing, and early access to sale events that are available only to registered Cascade Rewards members. These promotions are communicated through email, push notifications (via the Cascade App), direct mail, and in-store signage.
• Birthday Rewards and Anniversary Incentives. Members who have provided a date of birth receive a personalized birthday reward, typically in the form of bonus points or a discount coupon, during their birthday month. Anniversary incentives recognize the member's enrollment anniversary with the Program.
• Free or Reduced-Cost Shipping. Cascade Rewards members may qualify for free standard shipping or reduced-cost expedited shipping on e-commerce orders that meet certain minimum purchase thresholds, as set forth in the Cascade Rewards Terms and Conditions and as communicated at the time of checkout.
• Personalized Product Recommendations and Curated Offers. Based on a member's purchase history, browsing behavior, and inferred preferences, Cascade provides personalized product recommendations and curated promotional offers through cascade.com, the Cascade App, email, and other communication channels. These personalization features are powered by Peakview Analytics Inc., a wholly owned subsidiary of Cascade Retail Holdings Inc.
• Stored-Value Card Functionality. Members may use the Cascade Rewards stored-value card to pre-load balances for use toward future purchases. The stored-value card may be used in-store, online, and through the Cascade App, subject to the terms governing stored-value card transactions.
• Points Redemption. Accumulated Cascade Points may be redeemed toward future purchases of eligible merchandise and services, Cascade gift cards, or other Program benefits as identified and made available by Cascade from time to time. Points redemption rates, minimum redemption thresholds, and expiration policies are governed by the Cascade Rewards Terms and Conditions.
2.3 Eligibility and Enrollment
The Cascade Rewards program is open to residents of the United States who are aged sixteen (16) years or older at the time of enrollment. There is no purchase requirement to enroll in the Program, and there is no membership fee or recurring charge associated with basic Program membership.
Enrollment is available through the following channels:
• Online: Consumers may enroll at cascade.com/rewards by completing the online registration form.
• Mobile App: Consumers may enroll through the Cascade App by navigating to the Rewards section and completing the in-app registration process.
• In-Store: Consumers may enroll at any of Cascade's 186 retail locations by requesting enrollment assistance from a Cascade associate or completing a registration form at a designated in-store kiosk.
Upon enrollment, members are provided with a unique Cascade Rewards account number and may create online account credentials for accessing their Rewards account through cascade.com and the Cascade App.
3. Categories of Personal Information Collected Through the Program
Cascade collects the following categories of personal information from and about Cascade Rewards members in connection with the administration and operation of the Program. These categories correspond to the categories enumerated in California Civil Code § 1798.140(v) and related statutory provisions:
Identifiers. Full legal name, email address, telephone number (if provided), mailing address (if provided), date of birth (if provided), Cascade Rewards account number, and online account credentials (username and password) used to access the member's Rewards account through cascade.com and the Cascade App.
Commercial Information. Records of products and services purchased, returned, or exchanged by the member, including transaction amounts, itemized product details, transaction dates and times, associated store or channel information, return and exchange history, stored-value card balances and transaction history, and Cascade Points earned, redeemed, expired, and currently held.
Internet or Other Electronic Network Activity Information. Browsing history on cascade.com and the Cascade App, click-stream data reflecting navigation patterns and page interactions, search queries entered on Cascade properties, interaction data from promotional emails (including open rates and click-through events) and push notifications sent through the Cascade App, and cookie and tracking-technology data. As of the effective date of this Notice, Cascade employs twelve (12) categories of cookies and tracking technologies across its digital properties, as described in the Cascade Cookie Policy (accessible at cascade.com/cookies).
Geolocation Data. Precise geolocation data collected from the Cascade App when the member has enabled location services on their mobile device. Precise geolocation data constitutes "sensitive personal information" under the CCPA/CPRA (California Civil Code § 1798.140(ae)) and is subject to the additional protections described in Section 10 of this Notice.
Inferences. Consumer preferences, predicted purchase interests, loyalty tier classifications, propensity scores (including purchase-likelihood scores and churn-risk scores), and audience segment assignments. These inferences are generated by Peakview Analytics Inc. (a Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc.) through the application of machine-learning models and statistical algorithms to the categories of personal information described above, for the purpose of personalizing the member experience and delivering targeted advertising.
Sensitive Personal Information. The following categories of personal information collected through the Program are classified as sensitive personal information under the CCPA/CPRA:
(a) Precise geolocation data collected from the Cascade App when location services are enabled;
(b) Account login credentials (username and password) used to access the member's Cascade Rewards account; and
(c) Payment-card data (including card number, expiration date, and security code) to the extent stored in connection with stored-value card transactions or saved payment methods.
The specific purposes for which each category of personal information is collected and used are set forth in Section 4 below.
4. Purposes of Collection and Use of Personal Information
Personal information collected from Cascade Rewards members is used for the following business and commercial purposes:
Program Administration. Administering the Cascade Rewards program, including tracking Cascade Points accrual and balances, processing points redemptions, managing stored-value card balances and transactions, maintaining accurate member accounts, communicating program updates and benefit changes, and ensuring the integrity of the Program. This purpose encompasses all processing activities that are reasonably necessary to operate the Program as described in Section 2 of this Notice and in the Cascade Rewards Terms and Conditions.
Personalization of the Member Experience. Providing tailored product recommendations, curated offers, and relevant promotions to members based on their purchase history, browsing behavior, and inferred preferences. Personalization is powered by Peakview Analytics Inc., which applies proprietary algorithms and machine-learning models to member data to generate individualized content and offers. Cascade believes that personalization is a core value proposition of the Cascade Rewards program and a material benefit to members.
Marketing and Advertising. Delivering targeted advertising and promotional communications to Cascade Rewards members through Cascade's advertising technology stack, which is operated by Peakview Analytics Inc. Peakview Analytics processes approximately 2.1 billion consumer-event data records per month for the purpose of advertising targeting, personalization, audience segmentation, and campaign measurement across Cascade's owned and operated channels and third-party advertising platforms. Marketing communications may be delivered via email, push notification, SMS (where the member has provided a phone number and opted in to SMS communications), direct mail, and digital advertising (including display, social media, and programmatic advertising channels).
Data Sharing with Third-Party Advertising and Analytics Partners. Cascade shares Cascade Rewards member data with third-party advertising and analytics partners to facilitate targeted advertising, audience modeling, attribution measurement, and analytics. As of the most recent data-mapping exercise conducted by Fieldhaven Consulting Group LLC in May 2025, Cascade shares consumer data with forty-seven (47) third-party advertising and analytics partners. Certain sharing of Cascade Rewards member data with these partners may constitute a "sale" or "sharing" of personal information as those terms are defined under the CCPA/CPRA and other applicable state privacy laws. The details of these data-sharing relationships are further described in Section 6 of this Notice, and the consumer's right to opt out of such sale or sharing is described in Section 7.
Analytics and Business Operations. Performing aggregated and individual-level analysis of Cascade Rewards member data to improve Cascade's product offerings, merchandising strategies, store operations, supply chain efficiency, and overall customer experience. Analytics activities include sales trend analysis, customer segmentation, market research, and performance measurement of the Cascade Rewards program itself.
Fraud Prevention and Security. Detecting, investigating, and preventing fraudulent activity, unauthorized access, and other security threats affecting the Cascade Rewards program, member accounts, stored-value card balances, and Cascade's systems and infrastructure. This includes monitoring for anomalous account activity, points-manipulation schemes, and unauthorized redemption attempts.
Compliance with Legal Obligations. Using and retaining personal information as necessary to comply with applicable federal, state, and local laws, regulations, and legal processes, including responding to subpoenas, court orders, and law enforcement requests, and satisfying regulatory reporting and audit requirements.
5. Financial Incentive Disclosure Under CCPA § 1798.125(b)
5.1 Nature of the Financial Incentive
The Cascade Rewards program offers price and service differences — including member-only discounts, free or reduced-cost shipping, loyalty-points accrual and redemption, birthday and anniversary rewards, and access to personalized product recommendations and curated promotional offers — to consumers who enroll in the Program and thereby provide and permit the ongoing collection, retention, use, sale, and sharing of their personal information as described in this Notice and the Omnibus Privacy Policy.
These benefits are available exclusively to consumers who have enrolled in the Cascade Rewards program and who maintain an active Rewards account. Consumers who do not enroll in the Program, or who withdraw from the Program, do not receive these benefits. Similarly, the exercise of certain privacy rights by a member — for example, a request for the deletion of personal information that is essential to maintaining the member's Rewards account, or an opt-out of the sale or sharing of personal information that supports the personalization features of the Program — may impact the member's ability to receive certain Program benefits, as further described in Section 8 of this Notice.
Cascade does not discriminate against consumers who exercise their privacy rights under the CCPA/CPRA or other applicable state privacy laws. The relationship between the exercise of privacy rights and the availability of Program benefits is described in Section 8 below.
5.2 Good-Faith Estimate of the Value of Consumer Data
Pursuant to California Civil Code § 1798.125(b)(1) and the implementing regulations promulgated by the California Privacy Protection Agency, Cascade has calculated a good-faith estimate of the value of the personal information collected from Cascade Rewards members, using the methodology described below.
Revenue Attributable to the Loyalty Program. Cascade estimates the incremental revenue generated by the Cascade Rewards program by measuring the difference between the average per-transaction spend of Cascade Rewards members and the average per-transaction spend of non-member consumers, and then multiplying that incremental per-transaction amount by the total number of Cascade Rewards member transactions during the applicable fiscal year. This incremental revenue figure is then expressed as a percentage of Cascade's total consolidated revenue for fiscal year 2024, which was $3.87 billion. The resulting figure represents Cascade's estimate of the total incremental revenue attributable to the existence and operation of the Cascade Rewards program.
Expenses Related to the Program. Cascade accounts for the costs and expenses associated with operating the Cascade Rewards program, including:
(a) Program administration costs incurred by Cascade Rewards Corp., including personnel costs, customer-service expenses, and general administrative overhead;
(b) Technology and data infrastructure costs incurred by Peakview Analytics Inc. in connection with the data-processing, analytics, and advertising-technology platforms that support the Program;
(c) Marketing and promotional offer costs, including the cost of discounts, promotional pricing, free-shipping subsidies, birthday rewards, and other promotional benefits extended to members;
(d) Stored-value card fulfillment costs, including card production, distribution, and payment-processing fees; and
(e) Data-analytics and data-management costs, including vendor fees paid to third-party service providers such as OnPoint Data Solutions Inc. and Fieldhaven Consulting Group LLC.
Per-Member Value Calculation. The estimated value of the personal information collected from each Cascade Rewards member is calculated by dividing the net incremental revenue attributable to the Program (i.e., the incremental revenue described above, minus the expenses described above) by the total number of registered Cascade Rewards members, which is approximately 41.2 million as of the effective date of this Notice.
Result. Based on the methodology described above, Cascade has determined in good faith that the value of the financial incentive offered to each Cascade Rewards member — in the form of discounts, loyalty points, free or reduced-cost shipping, personalized offers, and other Program benefits — is reasonably related to the value of the personal information provided by that member and collected, retained, used, sold, and shared by Cascade in connection with the Program.
Cascade reserves the right to update this valuation methodology on an annual basis as part of its annual privacy-program assessment. The first annual privacy-program assessment cycle under the comprehensive compliance program is scheduled for completion by June 30, 2026.
5.3 Why the Financial Incentive is Permitted
The financial incentive offered through the Cascade Rewards program is permitted under California Civil Code § 1798.125(b)(4) because the value of the financial incentive — that is, the aggregate value of the discounts, points, free or reduced-cost shipping, and other benefits made available to each Cascade Rewards member — is reasonably related to the value of the consumer's data to Cascade, as calculated using the methodology described in Section 5.2 above.
Cascade does not offer financial incentives that are unjust, unreasonable, coercive, or usurious in nature. Enrollment in the Cascade Rewards program is entirely voluntary, requires no purchase and no membership fee, and may be discontinued by the consumer at any time without penalty, as described in Section 7.2 of this Notice.
6. Data Sharing and Third-Party Relationships
Cascade Rewards member data may be shared with the following categories of recipients in connection with the administration and operation of the Program and for the other purposes described in Section 4 of this Notice:
Cascade Affiliates and Subsidiaries. Cascade may share Rewards member personal information with its affiliated entities and wholly owned subsidiaries, including:
• Cascade Digital Marketplace LLC — operator of the Cascade Digital Marketplace, a third-party seller platform integrated with cascade.com;
• Ridgeline Fulfillment Services Inc. — provider of order fulfillment, warehousing, and logistics services for Cascade e-commerce orders;
• Peakview Analytics Inc. — operator of Cascade's advertising-technology stack, data-analytics platforms, and personalization engines; and
• Cascade Rewards Corp. — administrator of the Cascade Rewards program.
Each of these entities is a wholly owned subsidiary of Cascade Retail Holdings Inc. and processes Rewards member data in accordance with Cascade's internal data-governance policies and applicable data-processing agreements.
Third-Party Advertising and Analytics Partners. As described in Section 4, Cascade shares Rewards member data with third-party advertising and analytics partners to support targeted advertising, audience segmentation, attribution measurement, and analytics. As of the effective date of this Notice, Cascade shares data with forty-seven (47) third-party advertising and analytics partners, as identified in the data-mapping exercise completed by Fieldhaven Consulting Group LLC in May 2025. Of these forty-seven partners, twenty-three (23) are currently in the process of executing updated data processing agreements that incorporate the contractual safeguards required by the CCPA/CPRA and other applicable state privacy laws.
A key advertising partner is Thornbridge Media Corp., with which Cascade had an aggregate advertising spend of $18.4 million in fiscal year 2024. Cascade and Thornbridge Media Corp. are in the process of restructuring their data-sharing agreement to ensure full compliance with the CCPA/CPRA's requirements regarding the sale and sharing of personal information, including the implementation of adequate contractual restrictions on Thornbridge Media Corp.'s use, retention, and further disclosure of Rewards member data. The target date for execution of the restructured agreement is October 31, 2025.
Certain data-sharing arrangements between Cascade and its third-party advertising and analytics partners involving Rewards member data constitute "sharing" of personal information for "cross-context behavioral advertising" as those terms are defined under CCPA/CPRA (California Civil Code §§ 1798.140(ah) and 1798.140(k)), and consumers have the right to opt out of such sharing as described in Section 7.3 of this Notice. Certain of these arrangements may also constitute a "sale" of personal information under applicable state privacy laws.
Service Providers and Contractors. Cascade engages third-party service providers and contractors to perform services on Cascade's behalf in connection with the Cascade Rewards program and Cascade's broader business operations. These service providers process Rewards member personal information only pursuant to written agreements that restrict the use of personal information to the specific purposes for which it was provided and prohibit the service provider from selling, sharing, or otherwise using the personal information for the service provider's own commercial purposes. Key service providers include:
• OnPoint Data Solutions Inc. — provider of Cascade's consent-management platform, which manages consumer consent preferences, cookie consent, and opt-out signals (including Global Privacy Control) across Cascade's digital properties. Cascade has entered into a three-year contract with OnPoint Data Solutions Inc. with an annual license fee of $480,000, for a total contract value of $1,440,000.
• Fieldhaven Consulting Group LLC — privacy-program technical implementer engaged by Cascade (through Calderwood & Harkness LLP) to provide data-mapping, gap-assessment, compliance-remediation, and ongoing privacy-program support services.
Additional service providers and contractors engaged by Cascade in connection with the Cascade Rewards program and Cascade's broader operations are identified in the Omnibus Privacy Policy.
7. Consumer Rights Regarding the Financial Incentive
7.1 Right to Opt In / Consent
Participation in the Cascade Rewards program is entirely voluntary. By enrolling in the Program, consumers affirmatively opt in to the financial incentive offered by Cascade, thereby consenting to the collection, use, retention, sale, and sharing of their personal information as described in this Notice and the Omnibus Privacy Policy.
The act of enrolling in the Program — whether online at cascade.com/rewards, through the Cascade App, or in-store at a Cascade retail location — constitutes the consumer's informed, voluntary, and affirmative consent to participate in the financial incentive, as required by California Civil Code § 1798.125(b)(3).
Consent for the processing of sensitive personal information — specifically, precise geolocation data collected through the Cascade App and account credentials used to access the member's Rewards account — is obtained through a separate opt-in consent flow that is presented to the consumer at the point of collection, as required under CCPA/CPRA § 1798.121. The design and implementation of this separate consent flow is consistent with the requirements and recommendations set forth in the Sensitive Personal Information Analysis Memorandum prepared by Calderwood & Harkness LLP (dated July 28, 2025).
7.2 Right to Withdraw / Opt Out of the Financial Incentive
Consumers may withdraw from the Cascade Rewards program at any time, without penalty or cost, by using any of the following methods:
(a) Online: Visiting cascade.com/rewards/manage and selecting "Close My Rewards Account," then following the on-screen instructions to confirm account closure;
(b) By Phone: Calling Cascade Customer Service at the toll-free number provided in the Omnibus Privacy Policy and requesting closure of the member's Cascade Rewards account; or
(c) In-Store: Visiting any Cascade retail location and requesting account closure from a Cascade associate.
Upon withdrawal from the Program, the member's accumulated Cascade Points balance and any remaining stored-value card balances will be handled in accordance with the terms and conditions set forth in the Cascade Rewards Terms and Conditions, including any applicable expiration, forfeiture, or cash-out provisions.
Following the effective date of a member's withdrawal from the Program, Cascade will cease collecting personal information from and about that consumer for loyalty-program purposes. However, Cascade may continue to retain personal information previously collected from the withdrawing member in accordance with applicable data-retention obligations, as set forth in the Cascade Retail Holdings Inc. Data Retention & Disposal Schedule (discussed in Section 9 of this Notice) and as required by applicable law.
7.3 Right to Opt Out of Sale or Sharing
Cascade Rewards members may exercise their right to opt out of the sale or sharing of their personal information without withdrawing from the Cascade Rewards program entirely. Opting out of the sale or sharing of personal information does not require the member to close their Rewards account or forfeit accumulated Cascade Points.
Cascade honors the Global Privacy Control ("GPC") signal as a valid opt-out-of-sale/sharing request, consistent with CCPA/CPRA requirements and the regulations promulgated by the California Privacy Protection Agency. When Cascade detects a GPC signal from a consumer's browser or device, Cascade will treat that signal as a request to opt out of the sale and sharing of the consumer's personal information associated with that browser or device.
Members may also opt out of the sale or sharing of their personal information by:
(a) Clicking the "Do Not Sell or Share My Personal Information" link available on cascade.com (accessible from every page of the website via the footer navigation); or
(b) Navigating to the privacy-settings section of the Cascade App and selecting the "Do Not Sell or Share My Personal Information" option.
Opting out of the sale or sharing of personal information may affect the availability of certain personalized offers, product recommendations, and curated promotional content that are generated using data shared with third-party advertising and analytics partners. However, opting out of sale or sharing will not prevent the member from earning Cascade Points on qualifying purchases, redeeming accumulated points, accessing stored-value card balances, or receiving non-personalized Program benefits such as member-only discounts and birthday rewards.
7.4 Other Consumer Rights
In addition to the rights described in Sections 7.1 through 7.3 above, Cascade Rewards members may exercise the following consumer privacy rights as described in the Omnibus Privacy Policy and the State-Specific Consumer Rights Supplement:
• Right to Know / Access: The right to request that Cascade disclose the categories and specific pieces of personal information collected about the consumer, the categories of sources from which the information was collected, the business or commercial purposes for the collection, and the categories of third parties to whom the information has been disclosed, sold, or shared.
• Right to Deletion: The right to request that Cascade delete personal information collected from the consumer, subject to applicable exceptions under the CCPA/CPRA and other state privacy laws.
• Right to Correction: The right to request that Cascade correct inaccurate personal information maintained about the consumer.
• Right to Limit Use and Disclosure of Sensitive Personal Information: The right to direct Cascade to limit the use and disclosure of sensitive personal information to purposes necessary to perform the services or provide the goods reasonably expected by an average consumer, as described in Section 10 of this Notice.
Data subject requests ("DSRs") are processed through Cascade's DSR portal, accessible at cascade.com/privacy/requests. In fiscal year 2024, Cascade received approximately 38,400 total DSRs, broken down as follows:
• Requests to access/know: approximately 12,800
• Requests for deletion: approximately 19,100
• Requests to opt out of sale/sharing: approximately 6,500
The average response time for DSRs processed during fiscal year 2024 was twenty-seven (27) calendar days. Under the comprehensive privacy compliance program currently being implemented, Cascade's target response time for all DSRs is fifteen (15) business days or less. The updated DSR workflow, including automated intake, identity verification, and fulfillment processes, is targeted for go-live on December 1, 2025.
Appeal rights are available to consumers residing in Virginia, Colorado, Connecticut, and other states whose privacy statutes require an appeal process for denied or partially denied consumer-rights requests. The procedures for exercising appeal rights are described in the State-Specific Consumer Rights Supplement, which is accessible at cascade.com/privacy.
8. Non-Discrimination
Cascade will not discriminate against any consumer who exercises their privacy rights under the CCPA/CPRA or any other applicable state privacy law. Specifically, Cascade will not engage in any of the following practices in response to a consumer's exercise of privacy rights:
(a) Denying goods or services to the consumer;
(b) Charging the consumer different prices or rates for goods or services, including through the use of discounts, other benefits, or the imposition of penalties;
(c) Providing a different level or quality of goods or services to the consumer; or
(d) Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services as a result of exercising their privacy rights.
Notwithstanding the foregoing, if a consumer exercises a privacy right that would render Cascade unable to maintain the consumer's Cascade Rewards account or provide certain Program benefits — for example, a deletion request that encompasses personal information essential to account functionality, such as the consumer's name, email address, or Rewards account number — Cascade will inform the consumer of the specific impact of the request on their Rewards account and Program benefits before completing the request. The consumer will then have the opportunity to confirm, modify, or withdraw the request.
Similarly, as noted in Section 7.3, a consumer's exercise of the right to opt out of the sale or sharing of personal information may affect the availability of certain personalized features of the Program (such as personalized product recommendations and curated offers), but will not affect the consumer's ability to earn or redeem Cascade Points, access stored-value card balances, or receive non-personalized Program benefits.
Cascade's non-discrimination commitment applies equally to consumers in all jurisdictions in which Cascade operates, regardless of whether the consumer's state of residence has enacted a comprehensive privacy statute.
9. Data Retention
Personal information collected through the Cascade Rewards program is retained in accordance with the Cascade Retail Holdings Inc. Data Retention & Disposal Schedule (dated October 2025) (the "Retention Schedule"). The Retention Schedule establishes specific retention periods for each category of personal information collected through the Program and across Cascade's broader business operations, and specifies the procedures for the secure disposal or de-identification of personal information upon the expiration of the applicable retention period.
Cascade acknowledges that, prior to the comprehensive privacy compliance program initiated in June 2025, it lacked a documented data-retention schedule specifically governing customer-transaction data and loyalty-program data. This gap has been identified and remediated as part of the compliance program. The Retention Schedule referenced above represents the first enterprise-wide, documented data-retention framework applicable to Cascade Rewards member data.
Specific retention periods vary by category of personal information and are determined based on the purpose of collection, applicable legal and regulatory requirements, contractual obligations, and legitimate business needs. Members may request information about the specific retention periods applicable to their personal information by contacting Cascade's Privacy Team at the contact information provided in Section 13 of this Notice. Additional detail regarding retention periods is available in the California-Specific Privacy Disclosures Addendum (dated September 12, 2025).
Upon a member's withdrawal from the Cascade Rewards program, Cascade will retain the member's personal information only for the period specified in the Retention Schedule and as necessary to comply with applicable legal obligations, resolve disputes, and enforce Cascade's agreements. Following the expiration of the applicable retention period, the member's personal information will be securely deleted or de-identified in accordance with the procedures set forth in the Retention Schedule.
10. Sensitive Personal Information
As described in Section 3 of this Notice, the Cascade Rewards program may involve the collection and processing of the following categories of sensitive personal information, as defined under CCPA/CPRA (California Civil Code § 1798.140(ae)):
(a) Precise Geolocation Data. The Cascade App collects precise geolocation data from the member's mobile device when the member has enabled location services for the Cascade App. Precise geolocation data is used to provide location-based services, including store locator functionality, in-store navigation assistance, and location-triggered promotional offers.
(b) Account Login Credentials. The username and password used by the member to access their Cascade Rewards account through cascade.com and the Cascade App constitute sensitive personal information under the CCPA/CPRA.
(c) Payment-Card Data. To the extent that payment-card information (including card number, expiration date, and security code) is stored in connection with stored-value card transactions or saved payment methods within the member's Rewards account, such data constitutes sensitive personal information.
Under CCPA/CPRA § 1798.121, consumers have the right to direct a business to limit the use and disclosure of their sensitive personal information to those purposes that are necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. Cascade Rewards members may exercise this right through the mechanisms described in the Omnibus Privacy Policy and the State-Specific Consumer Rights Supplement, or by contacting Cascade's Privacy Team at the contact information provided in Section 13 of this Notice.
Cascade collects separate opt-in consent for the processing of precise geolocation data through the Cascade App. This separate consent flow is presented to the member at the time location services are first enabled within the Cascade App and may be revoked by the member at any time through the Cascade App's privacy settings or through the member's device settings. The design and implementation of this separate consent mechanism is consistent with the requirements and recommendations identified in the Sensitive Personal Information Analysis Memorandum prepared by Calderwood & Harkness LLP (dated July 28, 2025).
Cascade does not use or disclose sensitive personal information for purposes other than those permitted under CCPA/CPRA § 1798.121(a), except where the consumer has provided separate, affirmative opt-in consent for such use or disclosure.
11. Security of Rewards Member Data
Cascade implements and maintains reasonable administrative, technical, and physical security measures designed to protect the personal information of Cascade Rewards members from unauthorized access, disclosure, alteration, destruction, and other forms of unauthorized processing. These security measures are proportionate to the nature and sensitivity of the personal information collected and are regularly assessed and updated to address evolving threats and vulnerabilities.
Cascade's information-security program is overseen by Gregory Farris, Chief Information Security Officer, who reports to Cascade's executive leadership team and coordinates with the Privacy Team on matters involving the security of personal information. Cascade's security program includes, without limitation, access controls, encryption of personal information in transit and at rest, network security monitoring, vulnerability management, employee security-awareness training, and incident-detection and response capabilities.
Cascade maintains cyber and privacy-liability insurance through Northcastle Indemnity Company, with coverage limits of $25 million per occurrence and $50 million in annual aggregate, for the policy period of July 1, 2025 through June 30, 2026. The annual premium for this coverage is $1,340,000. The insurance policy was brokered by Ridgepoint Insurance Brokers Inc. This insurance coverage is intended to mitigate the financial impact of data-security incidents, including data breaches affecting Cascade Rewards member personal information.
In the event of a data breach or other security incident affecting the personal information of Cascade Rewards members, Cascade will respond in accordance with its incident-response procedures as set forth in the Cascade Retail Holdings Inc. Internal Privacy Policy & Procedures Manual. These procedures include prompt investigation of the incident, containment and remediation of the vulnerability, notification to affected individuals and regulatory authorities as required by applicable data-breach-notification laws, and post-incident review and corrective-action implementation.
12. Updates to This Notice
Cascade may update this Loyalty-Program Privacy Notice from time to time to reflect changes in the Cascade Rewards program, applicable law, regulatory guidance, Cascade's data practices, or Cascade's business operations. When Cascade makes material changes to this Notice, Cascade will provide notice to Cascade Rewards members through reasonable means, which may include posting the updated Notice on cascade.com/privacy, sending an email notification to the email address associated with the member's Rewards account, or providing an in-app notification through the Cascade App.
The date of the most recent update to this Notice will be indicated at the top of this Notice under the heading "Effective Date." Members are encouraged to review this Notice periodically to stay informed about how their personal information is collected, used, and protected in connection with the Cascade Rewards program.
Cascade's prior online privacy policy, which was last updated in March 2022, has been replaced in its entirety by the comprehensive Omnibus Privacy Policy suite dated September 12, 2025, of which this Notice is a component. The prior privacy policy is no longer in effect and does not govern the collection, use, or disclosure of personal information by Cascade or its subsidiaries.
13. Contact Information
For questions, comments, or concerns about this Notice or the privacy practices of the Cascade Rewards program, consumers may contact Cascade using the following information:
Cascade Retail Holdings Inc.
Attn: Privacy Team
4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Interim Chief Privacy Officer: Diana Polk, Associate General Counsel (Cascade is actively recruiting a full-time Chief Privacy Officer; hiring is targeted for Q4 2025.)
General Counsel: Meredith Tanaka
Email: privacy@cascade.com
Online: cascade.com/privacy
Consumer-rights requests — including requests to access, delete, or correct personal information; requests to opt out of the sale or sharing of personal information; and requests to limit the use of sensitive personal information — may be submitted through Cascade's DSR portal at cascade.com/privacy/requests. Requests may also be submitted by contacting Cascade Customer Service at the toll-free number provided in the Omnibus Privacy Policy.
Cascade will verify the identity of the consumer submitting a rights request in accordance with the verification procedures described in the Omnibus Privacy Policy and the State-Specific Consumer Rights Supplement.
14. Applicable State Laws
This Notice is intended to satisfy the disclosure requirements of the following state privacy statutes as they relate to loyalty programs, financial-incentive programs, and the collection, use, sale, and sharing of consumer personal information, to the extent applicable to Cascade's operations and the Cascade Rewards program:
As of the engagement opening date of June 2, 2025, Calderwood & Harkness LLP identified a total of nineteen (19) applicable state privacy statutes (including statutes enacted and effective through the 2025–2026 legislative cycles) that impose obligations relevant to the Cascade Rewards program. Additional state privacy statutes may become applicable as new legislation is enacted or existing statutes take effect. Cascade monitors the evolving state privacy landscape on an ongoing basis and will update this Notice and its broader privacy-compliance program as necessary to reflect newly applicable statutory requirements.
To the extent that any applicable state privacy law provides consumer rights or imposes business obligations that exceed those described in this Notice, Cascade will comply with such requirements as set forth in the State-Specific Consumer Rights Supplement and the Omnibus Privacy Policy.
This Cascade Rewards Loyalty-Program Privacy Notice is effective as of September 12, 2025.
Cascade Retail Holdings Inc. | Nasdaq: CSRD | EIN: 84-3192057 Cascade Rewards Corp. | EIN: 86-3381729
© 2025 Cascade Retail Holdings Inc. All rights reserved.
Prepared in coordination with Calderwood & Harkness LLP, 600 Lexington Avenue, 28th Floor, New York, NY 10022 (Matter No. 1038-00010).
Statute | abbreviation
California Consumer Privacy Act / California Privacy Rights Act | CCPA/CPRA (specifically § 1798.125)
Virginia Consumer Data Protection Act | VCDPA
Colorado Privacy Act | CPA
Connecticut Data Privacy Act | CTDPA
Utah Consumer Privacy Act | UCPA
Iowa Consumer Data Protection Act | ICDPA
Indiana Consumer Data Protection Act | INCDPA
Tennessee Information Protection Act | TIPA
Montana Consumer Data Privacy Act | MCDPA
Texas Data Privacy and Security Act | TDPSA
Oregon Consumer Privacy Act | OCPA
Delaware Personal Data Privacy Act | DPDPA
New Jersey Data Privacy Act | NJDPA
New Hampshire Data Privacy Act | NHDPA
Nebraska Data Privacy Act | NDPA
Minnesota Consumer Data Privacy Act | MNCDPA
Maryland Online Data Privacy Act | MODPA
Kentucky Data Privacy Act | KYDPA

CASCADE REWARDS LOYALTY-PROGRAM PRIVACY NOTICE

Record

Parties

Dates

Amounts