1038-00010 · Cascade Retail Holdings · Policies & Notices

marketplace-seller-privacy-notice.docx DOCUMENT Finance & Banking

36 / 38 ← → ✕

THIRD-PARTY MARKETPLACE SELLER PRIVACY NOTICE

Cascade Digital Marketplace LLC A Delaware Limited Liability Company and Wholly Owned Subsidiary of Cascade Retail Holdings Inc.

Effective Date: September 12, 2025

Right-click to update Table of Contents

Section 1: Introduction and Scope

Cascade Digital Marketplace LLC ("CDM," "we," "us," or "our"), EIN 85-4107638, is a Delaware limited liability company and wholly owned subsidiary of Cascade Retail Holdings Inc. (Nasdaq: CSRD), a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119. CDM operates the third-party seller marketplace located at cascade.com/marketplace (the "Marketplace" or "Platform"), which currently hosts approximately 3,800 third-party sellers.

This Third-Party Marketplace Seller Privacy Notice (this "Notice") describes how CDM collects, uses, discloses, retains, and otherwise processes the personal information of third-party sellers ("Sellers" or "You") in connection with the Marketplace. For purposes of this Notice, "personal information" (or "PI") means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined by applicable law.

This Notice applies to the personal information of individual sellers, sole proprietors, authorized representatives of seller entities, and other natural persons whose personal information CDM collects and processes in connection with the Marketplace. If You operate on the Marketplace as a business entity (e.g., a corporation, limited liability company, or partnership), this Notice applies to the personal information of the natural persons associated with that entity—including authorized representatives, owners, officers, directors, and other individuals whose information is submitted to or collected by CDM in connection with Your seller account.

This Notice Is Separate from Cascade's Consumer-Facing Privacy Policy. This Notice is separate from and supplementary to the Cascade Omnibus Privacy Policy (also dated September 12, 2025), which governs Cascade's processing of end-consumer personal information in connection with its retail operations, e-commerce platform, and related consumer-facing services. This Notice addresses only the personal information of Sellers and their associated natural persons as described above. Sellers who also make purchases from Cascade as consumers should review the Omnibus Privacy Policy for information about how Cascade handles consumer personal information.

Applicable Law. This Notice is designed to comply with nineteen (19) applicable United States state privacy statutes, including, without limitation, the following:

1. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100–1798.199.100;

2. The Virginia Consumer Data Protection Act ("VCDPA"), Va. Code §§ 59.1-575 through 59.1-585;

3. The Colorado Privacy Act ("CPA"), Colo. Rev. Stat. §§ 6-1-1301 through 6-1-1313;

4. The Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 through 42-525;

5. The Utah Consumer Privacy Act ("UCPA"), Utah Code §§ 13-61-101 through 13-61-404;

6. The Iowa Consumer Data Protection Act ("ICDPA"), Iowa Code ch. 715D;

7. The Indiana Consumer Data Protection Act ("INCDPA"), Ind. Code §§ 24-15-1-1 through 24-15-9-1;

8. The Tennessee Information Protection Act ("TIPA"), Tenn. Code §§ 47-18-3601 through 47-18-3614;

9. The Montana Consumer Data Privacy Act ("MCDPA"), Mont. Code §§ 30-14-2801 through 30-14-2817;

10. The Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code ch. 541;

11. The Oregon Consumer Privacy Act ("OCPA"), Or. Rev. Stat. §§ 646A.570 through 646A.604;

12. The Delaware Personal Data Privacy Act ("DPDPA"), Del. Code tit. 6, ch. 12D;

13. The New Jersey Data Privacy Act ("NJDPA"), N.J. Stat. §§ 56:8-166 through 56:8-189;

14. The New Hampshire Data Privacy Act ("NHDPA"), N.H. Rev. Stat. ch. 507-H;

15. The Nebraska Data Privacy Act ("NDPA"), Neb. Rev. Stat. §§ 87-1101 through 87-1116;

16. The Minnesota Consumer Data Privacy Act, Minn. Stat. ch. 325O;

17. The Maryland Online Data Privacy Act ("MODPA"), Md. Code Com. Law §§ 14-4601 through 14-4614;

18. The Kentucky Data Privacy Act ("KYDPA"), Ky. Rev. Stat. ch. 367; and

19. Additional state statutes effective or enacted through 2025–2026 that impose obligations on CDM with respect to the processing of seller personal information.

Cascade operates 186 retail locations across 31 states and ships e-commerce orders to all 50 states and the District of Columbia. Because Sellers may be located in any state across the country, and because Cascade's operations touch numerous jurisdictions, multiple state privacy regimes may apply to CDM's collection and processing of seller personal information. This Notice is intended to provide comprehensive disclosure satisfying the requirements of all applicable state privacy laws.

Section 2: Personal Information We Collect About Sellers

2.1 Categories of Personal Information

CDM collects the following categories of personal information from or about Sellers in connection with the operation of the Marketplace. The specific pieces of information collected may vary depending on the nature of the seller's business, the products or services offered, and the seller's interactions with the Platform.

Account Registration Data. When You create a seller account on the Marketplace, we collect the following information:

• Full legal name of the individual seller or the authorized representative of the seller entity;

• Business name and any "doing business as" (DBA) names;

• Email address;

• Phone number (including mobile phone number, if provided);

• Mailing address (business or personal, as applicable);

• Username selected for the seller portal; and

• Password and account credentials (stored in encrypted form).

Identity Verification Data. As part of the seller onboarding process and, in certain circumstances, on an ongoing basis, CDM collects the following identity-verification information:

• Government-issued identification numbers, including driver's license numbers and state identification card numbers;

• Date of birth; and

• Photographs or scans of identification documents submitted during the seller onboarding process (e.g., copies of a driver's license, state ID, or passport).

Tax and Financial Information. In order to process payments, comply with tax-reporting obligations, and facilitate financial transactions on the Marketplace, CDM collects the following:

• Taxpayer identification numbers, including Social Security Numbers ("SSNs") for individual sellers and sole proprietors, and Employer Identification Numbers ("EINs") for business entities;

• Data submitted through IRS Form W-9 (Request for Taxpayer Identification Number and Certification);

• Bank account numbers and routing numbers used for payment disbursement;

• Payment history, including records of all payments disbursed to the seller;

• Commission and fee records reflecting marketplace fees, referral fees, and other charges assessed; and

• IRS Form 1099-K reporting data, including gross payment amounts and transaction counts.

Transaction and Commercial Data. CDM collects information related to the seller's commercial activities on the Marketplace, including:

• Sales transaction records, including itemized details of each transaction processed through the Platform;

• Product listing information, including product descriptions, images, pricing, inventory levels, and categorization data;

• Order fulfillment data, including shipping confirmations, tracking numbers, and delivery status;

• Shipping and return records, including records of returned items, return reasons, and refund processing;

• Seller performance metrics, including order defect rates, on-time delivery rates, cancellation rates, and overall seller health scores; and

• Customer reviews and ratings associated with the seller's products and storefront.

Communications Data. CDM collects records of communications exchanged on the Platform, including:

• Messages exchanged between sellers and CDM support teams through the seller portal and marketplace messaging system;

• Messages exchanged between sellers and buyers through the Platform's buyer-seller messaging system; and

• Records of seller inquiries, support tickets, and any related correspondence.

Technical and Access Data. When sellers access the seller portal or interact with the Marketplace, CDM automatically collects certain technical and access information, including:

• Internet Protocol (IP) addresses;

• Device identifiers, including unique device IDs and hardware model information;

• Browser type, version, and settings;

• Login timestamps and session duration;

• Access logs reflecting the pages, features, and tools accessed within the seller portal; and

• Platform usage data, including clickstream data and navigation patterns within the seller portal.

Geolocation Data. CDM collects approximate geolocation data inferred from the seller's IP address when accessing the Platform. CDM does not collect precise geolocation data (e.g., GPS coordinates) from sellers.

Professional or Employment-Related Information. Depending on the nature of the seller's business and the products or services offered, CDM may collect:

• Business licenses and permits required to sell certain categories of products;

• Professional certifications and credentials (e.g., certifications required for the sale of regulated goods); and

• Other professional qualifications submitted as part of the seller qualification and onboarding process.

2.2 Sources of Personal Information

CDM collects personal information about Sellers from the following sources:

Directly from Sellers. The majority of seller personal information is collected directly from You during the account registration and onboarding process, as well as through Your ongoing use of and interaction with the Marketplace Platform. This includes information You provide when creating Your seller account, submitting tax and identity-verification documents, listing products, communicating through the Platform, and updating Your account settings or profile.

From Seller-Initiated Transactions and Interactions. CDM collects transaction and commercial data as a result of the sales transactions You initiate and complete on the Marketplace, as well as from Your interactions with buyers and with CDM support through the Platform.

From Third-Party Identity-Verification Services. During the seller onboarding process, CDM uses third-party identity-verification service providers to verify the identity of individual sellers and authorized representatives. These services may provide CDM with identity-verification results and related data.

From Payment Processors and Financial Institutions. CDM receives information from third-party payment processors and financial institutions in connection with the processing of seller payment disbursements, including payment confirmation data, chargeback notifications, and other transaction-related information.

Automatically Through Cookies and Tracking Technologies. When sellers access the seller portal at cascade.com/marketplace, CDM and its service providers automatically collect certain technical and access data through the use of cookies, web beacons, pixels, and other tracking technologies. CDM utilizes twelve (12) categories of cookies and tracking technologies on cascade.com. For detailed information about the specific cookies and trackers used, their purposes, and how to manage Your preferences, please refer to CDM's separate Cookie & Tracking-Technology Notice, available at cascade.com/cookie-notice.

2.3 Sensitive Personal Information

CDM collects and processes certain categories of personal information that are classified as "sensitive personal information" under applicable state privacy laws, including the CCPA/CPRA. The following categories of sensitive personal information are collected from sellers:

• Government-issued identification numbers, including Social Security Numbers and driver's license or state identification card numbers;

• Financial account information, including bank account numbers and routing numbers used for payment disbursement; and

• Account login credentials, including username and password combinations used to access the seller portal.

CDM limits the use and disclosure of sensitive personal information to those purposes that are strictly necessary to provide the Marketplace services, to fulfill CDM's legal obligations, and to support the following specific functions:

• Tax reporting and compliance (e.g., IRS Form 1099-K reporting and state tax obligations);

• Fraud prevention and detection;

• Identity verification during seller onboarding and on an ongoing basis; and

• Processing of seller payment disbursements.

Under the CCPA/CPRA, sellers who are California residents have the right to limit CDM's use and disclosure of their sensitive personal information to those uses that are necessary to perform the services reasonably expected by the seller. For more information on how to exercise this right, please see Section 6 below.

Section 3: Purposes of Processing

CDM processes seller personal information for the following specific business and commercial purposes:

Marketplace Platform Operation. CDM uses seller personal information to create and maintain seller accounts on the Marketplace, to enable the listing of products and services, to process and facilitate transactions between sellers and buyers, and to manage seller storefronts. This includes authenticating seller access to the seller portal, displaying seller profiles and product listings, and enabling the full range of marketplace functionality available to sellers.

Payment Processing and Disbursement. CDM uses seller financial information to process sales proceeds, calculate and disburse commissions, manage chargebacks, refunds, and payment adjustments, and maintain records of all financial transactions between CDM and sellers. Payment processing is facilitated through third-party payment processors and financial institutions, as described in Section 4 below.

Tax Compliance and Reporting. CDM collects and retains seller tax information in order to comply with federal and state tax-reporting requirements. This includes the collection of IRS Form W-9 data and the preparation and filing of IRS Form 1099-K for sellers whose gross payment amounts exceed applicable reporting thresholds, as well as compliance with applicable state tax-reporting obligations.

Identity Verification and Fraud Prevention. CDM uses identity-verification data to verify the identity of individual sellers and authorized representatives during the onboarding process and, as necessary, on an ongoing basis. CDM also processes seller personal information to detect and prevent fraudulent activity, platform abuse, unauthorized access, and violations of CDM's marketplace policies and terms of service.

Seller Performance and Quality Assurance. CDM monitors seller performance metrics—including order defect rates, on-time delivery rates, cancellation rates, and customer reviews and ratings—to maintain the quality and integrity of the Marketplace. Seller performance data is used to enforce marketplace policies and standards, to identify sellers who may require additional support or remediation, and to make decisions about seller account standing.

Communications. CDM uses seller contact information to respond to seller inquiries and support requests, to provide Platform updates and announcements, and to send transactional notifications, including order confirmations, payment notices, policy change notifications, and other communications related to the operation of the seller's account and participation in the Marketplace.

Legal Compliance. CDM processes seller personal information as necessary to comply with applicable laws, regulations, and legal processes. This includes responding to lawfully issued subpoenas, court orders, and requests from law enforcement or regulatory agencies, as well as exercising and defending legal claims related to the Marketplace.

Platform Improvement and Analytics. CDM analyzes aggregated and de-identified seller data to improve Marketplace functionality, enhance the seller experience, and inform business decisions related to the Platform. Peakview Analytics Inc., a Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc., may process de-identified and aggregated marketplace data for analytics purposes. When data is used for analytics, CDM takes reasonable steps to ensure that such data is de-identified or aggregated so that it cannot reasonably be used to identify any individual seller.

Security. CDM processes seller personal information as necessary to protect the security and integrity of the Marketplace Platform, to detect and respond to security incidents, unauthorized access, and other threats, and to maintain the confidentiality, integrity, and availability of seller data and Platform systems.

Section 4: How We Share Seller Personal Information

4.1 Categories of Recipients

CDM may disclose seller personal information to the following categories of recipients for the purposes described in this Notice:

Cascade Affiliates. CDM may share seller personal information with its parent company, Cascade Retail Holdings Inc., and with the following Cascade subsidiaries and affiliates, as necessary to support the Marketplace operations and the purposes described in this Notice:

• Ridgeline Fulfillment Services Inc., a Washington corporation and Cascade subsidiary, for fulfillment coordination and logistics support in connection with marketplace orders;

• Peakview Analytics Inc., a Delaware corporation and Cascade subsidiary, for analytics purposes based on aggregated and de-identified marketplace data; and

• Cascade Rewards Corp., a Delaware corporation and Cascade subsidiary, to the extent that a seller's participation in loyalty-program promotions or cross-promotional activities involves the sharing of seller personal information.

Cascade affiliates that receive seller personal information are bound by internal data-handling policies and are required to use such information only for the purposes described in this Notice.

Payment Processors and Financial Institutions. CDM shares seller financial information with third-party payment processors and banking institutions that facilitate the processing and disbursement of seller payments, including the deposit of sales proceeds into seller-designated bank accounts. These entities receive only the information necessary to complete payment transactions and are contractually required to maintain the confidentiality and security of seller data.

Identity-Verification Service Providers. CDM shares seller identity-verification data with third-party identity-verification service providers used during the seller onboarding process. These providers receive identification documents and related data solely for the purpose of verifying seller identity and are contractually obligated to process such data in accordance with applicable privacy laws.

Tax Authorities. CDM discloses seller tax information, including taxpayer identification numbers and gross payment data, to the Internal Revenue Service ("IRS") and applicable state tax authorities as required by federal and state tax-reporting laws and regulations, including IRS Form 1099-K reporting obligations.

Law Enforcement and Regulators. CDM may disclose seller personal information to government agencies, law enforcement authorities, courts, or regulatory bodies when required to do so by applicable law, legal process (including subpoenas and court orders), or governmental request, or when CDM believes in good faith that such disclosure is necessary to protect the rights, property, or safety of CDM, its sellers, its customers, or the public.

Professional Advisors. CDM may share seller personal information with the following categories of professional advisors engaged by Cascade, each of which is subject to professional and contractual confidentiality obligations:

• Legal Counsel, including Calderwood & Harkness LLP, a New York limited liability partnership, and Whitfield Greaves LLP, a Delaware limited liability partnership, which provide legal advice and representation to Cascade and CDM;

• Auditors, including Lakemont Audit Partners LLP, an Illinois limited liability partnership and Cascade's independent auditor, which conducts financial and compliance audits; and

• Consultants, including Fieldhaven Consulting Group LLC, a Delaware limited liability company, which provides consulting services related to data management, compliance, and platform operations.

Buyers/Customers. Certain limited seller information is displayed publicly on the Marketplace in connection with product listings and seller storefronts. This information includes the seller's business name, general geographic location (e.g., city and state), seller ratings and reviews, and product listing information. No sensitive personal information, financial account information, or taxpayer identification numbers are disclosed to buyers or displayed publicly on the Marketplace.

4.2 Data Sharing vs. Sale Under CCPA/CPRA

CDM does not "sell" seller personal information as the term "sell" is defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ad)). CDM does not disclose seller personal information to third parties in exchange for monetary or other valuable consideration.

CDM does not "share" seller personal information for cross-context behavioral advertising purposes as the term "share" is defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ah)). CDM does not make seller personal information available to third parties for the purpose of serving targeted advertising to sellers based on their activity across different websites, applications, or online services.

For the avoidance of doubt, Cascade's advertising relationships—including those with advertising partners such as Thornbridge Media Corp.—involve the processing of consumer personal information in connection with Cascade's consumer-facing retail and e-commerce operations and are governed by the Cascade Omnibus Privacy Policy. Seller personal information is not used for, or disclosed in connection with, cross-context behavioral advertising or any advertising-related purpose.

All third-party recipients that process seller personal information on CDM's behalf are contractually bound as "service providers" (as defined under CCPA/CPRA), "processors" (as defined under the VCDPA, CPA, CTDPA, and other applicable state privacy laws), or in equivalent capacities, pursuant to written data processing agreements that restrict the use of seller personal information to the purposes specified by CDM and impose appropriate confidentiality and security obligations.

4.3 Data Segregation

CDM acknowledges the importance of maintaining appropriate data-segregation controls to protect seller personal information. CDM is in the process of implementing enhanced data-segregation controls to ensure that third-party seller data maintained on the Cascade Digital Marketplace is kept logically and, where appropriate, physically separate from first-party customer data collected through Cascade's retail and e-commerce operations. These controls include role-based access controls that govern access to each dataset, ensuring that only authorized personnel with a legitimate business need may access seller personal information.

In connection with these efforts, CDM is remediating a previously identified issue involving the commingling of marketplace seller data and consumer data within a shared data lake environment. CDM has engaged Fieldhaven Consulting Group LLC to assist with the design and implementation of an appropriate data-segregation architecture, including the establishment of distinct data environments, enhanced access controls, and audit logging to ensure that seller data is accessed and processed only for the purposes described in this Notice. This remediation is ongoing, and CDM expects to complete the implementation of these enhanced controls in accordance with the timeline established under its broader compliance program.

Section 5: Data Retention

CDM retains seller personal information for the period reasonably necessary to fulfill the purposes described in this Notice, or as otherwise required or permitted by applicable law. The applicable retention period for any particular category of personal information depends on the nature of the information, the purposes for which it was collected, and any legal, regulatory, or contractual requirements that mandate or permit its retention.

The following specific retention practices apply to the categories of seller personal information described in this Notice:

Account Registration Data. Account registration data is retained for the duration of the seller's active account on the Marketplace. Following account closure—whether initiated by the seller or by CDM—account registration data is retained for a defined period thereafter as specified in the Data Retention & Disposal Schedule being implemented by CDM, after which it is securely disposed of in accordance with CDM's disposal procedures.

Tax and Financial Information. Tax and financial information, including taxpayer identification numbers, IRS Form W-9 data, 1099-K reporting data, bank account and routing numbers, and payment records, is retained for a minimum of seven (7) years following the applicable tax year. This retention period is mandated by applicable IRS regulations and state tax laws to ensure that CDM can meet its ongoing tax-reporting and record-keeping obligations.

Transaction Data. Transaction and commercial data, including sales records, order fulfillment data, shipping and return records, and seller performance metrics, is retained for the duration of the seller's active account and for a defined period thereafter to support dispute resolution, refund processing, chargeback management, and legal compliance.

Communications Data. Records of communications exchanged on the Platform, including seller-buyer messages and seller support inquiries, are retained for the period specified in the Data Retention & Disposal Schedule.

Technical and Access Data. Technical and access data, including IP addresses, device identifiers, access logs, and platform usage data, is retained for security, auditing, and fraud-prevention purposes for a defined period as specified in the Data Retention & Disposal Schedule.

CDM is in the process of implementing a comprehensive Data Retention & Disposal Schedule that will address all categories of personal information collected from sellers. CDM acknowledges that the prior absence of a fully documented retention schedule was an identified compliance gap, and remediation is currently underway as part of CDM's broader privacy compliance program. Once finalized and approved, the Data Retention & Disposal Schedule will establish specific retention periods for each category of seller personal information, aligned with applicable legal requirements and the business purposes described in this Notice.

When the applicable retention period for any category of seller personal information expires, CDM will securely dispose of or anonymize such information using appropriate secure disposal methods. Secure disposal methods include secure deletion (including cryptographic erasure where applicable) and anonymization techniques that render the data no longer capable of identifying or being linked to any individual seller. CDM's disposal procedures are designed to prevent unauthorized access to, or recovery of, personal information following the expiration of the applicable retention period.

Section 6: Seller Rights Under Applicable State Privacy Laws

6.1 Overview of Rights

Sellers who are natural persons (including individual sellers, sole proprietors, and authorized representatives of seller entities) may have certain rights with respect to their personal information under applicable state privacy laws. Where applicable, these rights may also be exercised by an authorized agent acting on the seller's behalf, subject to CDM's verification requirements. The following is a summary of the rights that may be available to sellers, depending on the state(s) in which they reside:

Right to Know / Right of Access. You may have the right to request that CDM disclose the categories and specific pieces of personal information it has collected about You, the categories of sources from which that information was collected, the business or commercial purposes for which the information was collected, and the categories of third parties to whom the information has been disclosed. Under certain state laws, You may also have the right to receive a copy of Your personal information in a portable, readily usable format.

Right to Delete. You may have the right to request that CDM delete the personal information it has collected about You. This right is subject to certain statutory exceptions, including situations where retention is necessary to complete the transaction for which the information was collected, to comply with tax-reporting obligations (e.g., IRS Form 1099-K retention requirements), to satisfy legal-hold requirements, to detect and prevent fraud, to exercise or defend legal claims, or as otherwise permitted by applicable law.

Right to Correct. You may have the right to request that CDM correct inaccurate personal information it maintains about You. CDM will take commercially reasonable steps to correct any inaccuracies in Your personal information upon receiving a verified request.

Right to Opt Out of Sale/Sharing. Under certain state privacy laws, You may have the right to opt out of the "sale" of Your personal information or the "sharing" of Your personal information for cross-context behavioral advertising purposes. As described in Section 4.2 above, CDM does not sell seller personal information and does not share seller personal information for cross-context behavioral advertising. Nonetheless, sellers may exercise this right at any time. CDM honors the Global Privacy Control ("GPC") signal as a valid opt-out preference signal, as required under the CCPA/CPRA and other applicable state laws. If CDM detects a GPC signal from Your browser or device, CDM will treat it as a valid request to opt out of any sale or sharing of personal information associated with that browser or device.

Right to Limit Use of Sensitive Personal Information. Under the CCPA/CPRA, California residents have the right to direct CDM to limit the use and disclosure of their sensitive personal information to those purposes necessary to perform the Marketplace services reasonably expected by the seller. As described in Section 2.3 above, CDM already limits its use and disclosure of sensitive personal information to such purposes.

Right to Non-Discrimination. CDM will not discriminate against any seller for exercising their privacy rights under applicable state law. This means that CDM will not deny You access to the Marketplace, charge You different prices or fees, provide You with a different level or quality of service, or suggest that You will receive a different price, rate, or quality of service as a result of Your exercise of any privacy right.

Right to Appeal. In states that provide sellers with the right to appeal a denial of a privacy-rights request—including Virginia, Colorado, Connecticut, and other applicable states—sellers may submit an appeal of any adverse decision. CDM will review and respond to appeals within the timeframe required by applicable law. For more information on the appeal process, please see Section 7 below.

6.2 California-Specific Rights (CCPA/CPRA)

In addition to the general privacy rights described above, sellers who are California residents are entitled to the following CCPA/CPRA-specific disclosures and rights:

Categories of Personal Information Collected, Sold, or Shared. For a detailed table listing the categories of personal information CDM has collected from sellers in the preceding twelve (12) months, mapped to the CCPA/CPRA statutory categories, please see Section 12 (Additional Disclosures for California Sellers) below.

Financial Incentive Disclosure. CDM does not currently offer any marketplace programs that constitute "financial incentives" as defined under the CCPA/CPRA (Cal. Civ. Code § 1798.125(b)). In the event CDM introduces any such program in the future, CDM will provide the required financial-incentive disclosures at that time, including a description of the material terms of the program, the categories of personal information required for participation, and the good-faith estimate of the value of the seller's data.

Annual Data Subject Request Metrics. CDM's data subject request ("DSR") processing metrics are reported in aggregate with the overall DSR statistics of Cascade Retail Holdings Inc. For fiscal year 2024 ("FY2024"), Cascade Retail Holdings Inc. received approximately 38,400 total DSR requests across all business units, broken down as follows:

• Access / Right to Know requests: approximately 12,800;

• Deletion requests: approximately 19,100; and

• Opt-out of sale/sharing requests: approximately 6,500.

CDM is evaluating the feasibility of reporting seller-specific DSR metrics separately in future reporting periods. Sellers may request additional information about DSR processing metrics by contacting the Privacy Office at privacy@cascade.com.

California-Specific Privacy Disclosures Addendum. For additional detail regarding CDM's compliance with the CCPA/CPRA, including the specific categories of personal information collected, the purposes of collection, and the categories of recipients, please refer to the California-Specific Privacy Disclosures Addendum, which is incorporated by reference into this Notice and available upon request by contacting privacy@cascade.com.

6.3 State-Specific Rights Descriptions

CDM recognizes that sellers located in different states may have different privacy rights depending on the laws of their state of residence. CDM has prepared a State-Specific Consumer Rights Supplement (the "Rights Supplement"), which provides detailed descriptions of the privacy rights available to sellers under the VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), DPDPA (Delaware), NJDPA (New Jersey), NHDPA (New Hampshire), NDPA (Nebraska), ICDPA (Iowa), INCDPA (Indiana), TIPA (Tennessee), MCDPA (Montana), UCPA (Utah), the Minnesota Consumer Data Privacy Act, MODPA (Maryland), KYDPA (Kentucky), and all other applicable state privacy statutes.

Sellers located in any of the nineteen (19) states with applicable privacy statutes may exercise the rights provided by their state's law by following the procedures described in Section 7 below. CDM will process all privacy requests in accordance with the requirements of the applicable state law(s). A copy of the Rights Supplement is available upon request by contacting the Privacy Office at privacy@cascade.com.

Section 7: How to Submit a Privacy Request

Sellers who wish to exercise any of the privacy rights described in Section 6 of this Notice may submit a request using any of the following methods:

• Online DSR Portal: Submit a request through CDM's online data subject request portal at cascade.com/privacy-requests. The portal provides a guided process for submitting access, deletion, correction, and opt-out requests.

• Email: Send a request to privacy@cascade.com. Please include Your name, the email address associated with Your seller account, the nature of Your request, and any additional information necessary to verify Your identity and process Your request.

• Toll-Free Phone: Call CDM's privacy request line at the toll-free number listed on the DSR portal. A representative will assist You in submitting Your request and guide You through the identity-verification process.

Identity Verification. To protect the security of seller personal information, CDM verifies the identity of each individual submitting a privacy request before processing the request. CDM's identity-verification process is designed to meet the standards established under the CCPA/CPRA and other applicable state privacy laws. Depending on the nature of the request, CDM may require You to provide two or more data points that match information already maintained by CDM, and for requests to disclose specific pieces of personal information, CDM may require additional verification through a signed declaration under penalty of perjury. CDM has remediated a previously identified gap in which the DSR portal did not fully meet CCPA identity-verification standards; the current portal and verification process have been updated to ensure compliance with all applicable requirements.

Response Timeframe. CDM aims to respond to verifiable privacy requests within fifteen (15) business days of receipt. This target has been established as part of CDM's compliance program and represents a significant improvement over the prior average response time of twenty-seven (27) calendar days. In all cases, CDM will respond to requests within the timeframes required by applicable state law. Under the CCPA/CPRA, CDM will respond to verifiable requests within forty-five (45) calendar days of receipt, with the possibility of an extension of up to an additional forty-five (45) calendar days where reasonably necessary, provided that CDM notifies the seller of the extension and the reason for it within the initial forty-five (45) day period. Other state privacy laws may provide for different response timeframes, and CDM will comply with the requirements of each applicable statute.

Authorized Agent Requests. Sellers may designate an authorized agent to submit a privacy request on their behalf. If You wish to use an authorized agent, CDM may require the authorized agent to provide proof of written authorization from the seller (such as a power of attorney or a signed written authorization), and CDM may independently verify the identity of the seller on whose behalf the request is made. In California, if an authorized agent submits a request without providing proof of authorization through a power of attorney pursuant to California Probate Code sections 4000–4465, CDM may require the seller to verify their own identity directly with CDM and confirm that they authorized the agent to submit the request.

Appeal Process. If CDM denies a privacy request in whole or in part, sellers in states that provide an appeal right—including Virginia, Colorado, Connecticut, and other applicable states—may appeal that decision. Appeals may be submitted through the online DSR portal at cascade.com/privacy-requests or by emailing privacy@cascade.com with the subject line "Privacy Request Appeal." CDM will acknowledge receipt of the appeal and provide a substantive response within the timeframe required by applicable state law. If a seller's appeal is denied, CDM will provide the seller with information about how to file a complaint with the applicable state attorney general or other enforcement authority, as required by law.

Section 8: Data Security

CDM takes the security of seller personal information seriously and implements reasonable administrative, technical, and physical safeguards designed to protect seller personal information against unauthorized access, use, disclosure, alteration, or destruction. These safeguards are intended to be commensurate with the sensitivity of the information collected and the nature and scope of CDM's data processing activities.

The information security controls applicable to the Marketplace Platform are overseen by Gregory Farris, Chief Information Security Officer of Cascade Retail Holdings Inc. Mr. Farris is responsible for the development, implementation, and maintenance of Cascade's enterprise-wide information security program, which includes the security controls applicable to the Marketplace and to seller personal information. CDM's security program encompasses, among other things, encryption of data in transit and at rest, access controls and authentication mechanisms, network security monitoring, vulnerability management, employee training, and incident response procedures.

Cascade Retail Holdings Inc. maintains cyber and privacy liability insurance coverage designed to provide financial protection against certain risks associated with data breaches, unauthorized access to personal information, and related incidents. Specific details regarding the scope, limits, and terms of such insurance coverage are confidential and are not disclosed in this Notice.

CDM conducts periodic security assessments of the Marketplace Platform and its associated data-processing systems, including vulnerability assessments, penetration testing, and security audits. CDM engages third-party consultants and independent auditors to evaluate and enhance its security controls on a regular basis. The results of these assessments are used to identify areas for improvement and to implement appropriate remediation measures.

While CDM takes reasonable steps to protect seller personal information, no security system is impenetrable, and CDM cannot guarantee the absolute security of any information transmitted to or stored on the Platform. Sellers are encouraged to take steps to protect their own account credentials, including using strong, unique passwords and enabling any available multi-factor authentication features.

Section 9: Children's Privacy

The Cascade Digital Marketplace is a business-to-business platform intended for use by adults who are engaged in commercial activities as sellers of products and services. The Marketplace is not directed at, and is not intended for use by, children under the age of thirteen (13), or under the age of sixteen (16) where applicable under certain state privacy laws.

CDM does not knowingly collect personal information from children under the age of thirteen (13) (or sixteen (16), as applicable) in connection with seller accounts. If CDM becomes aware that it has inadvertently collected personal information from a child in connection with a seller account, CDM will take prompt steps to delete such information and, if appropriate, to deactivate the associated account. If You believe that CDM may have collected personal information from a child, please contact the Privacy Office at privacy@cascade.com.

Section 10: Changes to This Notice

CDM may update this Notice from time to time to reflect changes in CDM's data practices, changes in applicable legal requirements, or changes in CDM's business operations. When CDM makes material changes to this Notice, CDM will notify affected sellers through one or more of the following means:

• A prominent notification posted on the seller portal at cascade.com/marketplace;

• An email notification sent to the email address associated with the seller's account; or

• Other appropriate means of communication, as determined by CDM based on the nature and significance of the changes.

CDM encourages sellers to review this Notice periodically to stay informed about how CDM collects, uses, and protects their personal information. The effective date of the current version of this Notice is set forth at the top of this document.

Effective Date of Current Version: September 12, 2025.

This Notice replaces and supersedes any prior seller privacy notices, disclosures, or statements issued by CDM or Cascade Retail Holdings Inc. relating to the processing of seller personal information in connection with the Marketplace.

Section 11: Contact Information

If You have any questions, concerns, or requests regarding this Notice, CDM's privacy practices, or Your privacy rights, please contact the Privacy Office using the following information:

Privacy Inquiries:

Diana Polk Associate General Counsel (Interim Chief Privacy Officer) Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119

Email: privacy@cascade.com

Mailing Address for Written Requests:

Cascade Retail Holdings Inc.

Attn: Privacy Office

4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119

Marketplace Platform Support. For non-privacy-related inquiries regarding Your seller account, product listings, payments, or other Marketplace operational matters, please contact the Marketplace Seller Support team through the seller portal at cascade.com/marketplace/support or by emailing seller-support@cascade.com. The Marketplace Seller Support team handles operational inquiries and is separate from the Privacy Office.

Future Chief Privacy Officer. Cascade Retail Holdings Inc. intends to hire a full-time Chief Privacy Officer in the near term. Once that position is filled, the Chief Privacy Officer will serve as the designated privacy contact for all matters relating to this Notice and CDM's privacy practices. CDM will update this Notice and notify sellers when the Chief Privacy Officer position has been filled.

Section 12: Additional Disclosures for California Sellers

THIRD-PARTY MARKETPLACE SELLER PRIVACY NOTICE
Cascade Digital Marketplace LLC A Delaware Limited Liability Company and Wholly Owned Subsidiary of Cascade Retail Holdings Inc.
Effective Date: September 12, 2025
Right-click to update Table of Contents
Section 1: Introduction and Scope
Cascade Digital Marketplace LLC ("CDM," "we," "us," or "our"), EIN 85-4107638, is a Delaware limited liability company and wholly owned subsidiary of Cascade Retail Holdings Inc. (Nasdaq: CSRD), a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119. CDM operates the third-party seller marketplace located at cascade.com/marketplace (the "Marketplace" or "Platform"), which currently hosts approximately 3,800 third-party sellers.
This Third-Party Marketplace Seller Privacy Notice (this "Notice") describes how CDM collects, uses, discloses, retains, and otherwise processes the personal information of third-party sellers ("Sellers" or "You") in connection with the Marketplace. For purposes of this Notice, "personal information" (or "PI") means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, as defined by applicable law.
This Notice applies to the personal information of individual sellers, sole proprietors, authorized representatives of seller entities, and other natural persons whose personal information CDM collects and processes in connection with the Marketplace. If You operate on the Marketplace as a business entity (e.g., a corporation, limited liability company, or partnership), this Notice applies to the personal information of the natural persons associated with that entity—including authorized representatives, owners, officers, directors, and other individuals whose information is submitted to or collected by CDM in connection with Your seller account.
This Notice Is Separate from Cascade's Consumer-Facing Privacy Policy. This Notice is separate from and supplementary to the Cascade Omnibus Privacy Policy (also dated September 12, 2025), which governs Cascade's processing of end-consumer personal information in connection with its retail operations, e-commerce platform, and related consumer-facing services. This Notice addresses only the personal information of Sellers and their associated natural persons as described above. Sellers who also make purchases from Cascade as consumers should review the Omnibus Privacy Policy for information about how Cascade handles consumer personal information.
Applicable Law. This Notice is designed to comply with nineteen (19) applicable United States state privacy statutes, including, without limitation, the following:
1. The California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), Cal. Civ. Code §§ 1798.100–1798.199.100;
2. The Virginia Consumer Data Protection Act ("VCDPA"), Va. Code §§ 59.1-575 through 59.1-585;
3. The Colorado Privacy Act ("CPA"), Colo. Rev. Stat. §§ 6-1-1301 through 6-1-1313;
4. The Connecticut Data Privacy Act ("CTDPA"), Conn. Gen. Stat. §§ 42-515 through 42-525;
5. The Utah Consumer Privacy Act ("UCPA"), Utah Code §§ 13-61-101 through 13-61-404;
6. The Iowa Consumer Data Protection Act ("ICDPA"), Iowa Code ch. 715D;
7. The Indiana Consumer Data Protection Act ("INCDPA"), Ind. Code §§ 24-15-1-1 through 24-15-9-1;
8. The Tennessee Information Protection Act ("TIPA"), Tenn. Code §§ 47-18-3601 through 47-18-3614;
9. The Montana Consumer Data Privacy Act ("MCDPA"), Mont. Code §§ 30-14-2801 through 30-14-2817;
10. The Texas Data Privacy and Security Act ("TDPSA"), Tex. Bus. & Com. Code ch. 541;
11. The Oregon Consumer Privacy Act ("OCPA"), Or. Rev. Stat. §§ 646A.570 through 646A.604;
12. The Delaware Personal Data Privacy Act ("DPDPA"), Del. Code tit. 6, ch. 12D;
13. The New Jersey Data Privacy Act ("NJDPA"), N.J. Stat. §§ 56:8-166 through 56:8-189;
14. The New Hampshire Data Privacy Act ("NHDPA"), N.H. Rev. Stat. ch. 507-H;
15. The Nebraska Data Privacy Act ("NDPA"), Neb. Rev. Stat. §§ 87-1101 through 87-1116;
16. The Minnesota Consumer Data Privacy Act, Minn. Stat. ch. 325O;
17. The Maryland Online Data Privacy Act ("MODPA"), Md. Code Com. Law §§ 14-4601 through 14-4614;
18. The Kentucky Data Privacy Act ("KYDPA"), Ky. Rev. Stat. ch. 367; and
19. Additional state statutes effective or enacted through 2025–2026 that impose obligations on CDM with respect to the processing of seller personal information.
Cascade operates 186 retail locations across 31 states and ships e-commerce orders to all 50 states and the District of Columbia. Because Sellers may be located in any state across the country, and because Cascade's operations touch numerous jurisdictions, multiple state privacy regimes may apply to CDM's collection and processing of seller personal information. This Notice is intended to provide comprehensive disclosure satisfying the requirements of all applicable state privacy laws.
Section 2: Personal Information We Collect About Sellers
2.1 Categories of Personal Information
CDM collects the following categories of personal information from or about Sellers in connection with the operation of the Marketplace. The specific pieces of information collected may vary depending on the nature of the seller's business, the products or services offered, and the seller's interactions with the Platform.
Account Registration Data. When You create a seller account on the Marketplace, we collect the following information:
• Full legal name of the individual seller or the authorized representative of the seller entity;
• Business name and any "doing business as" (DBA) names;
• Email address;
• Phone number (including mobile phone number, if provided);
• Mailing address (business or personal, as applicable);
• Username selected for the seller portal; and
• Password and account credentials (stored in encrypted form).
Identity Verification Data. As part of the seller onboarding process and, in certain circumstances, on an ongoing basis, CDM collects the following identity-verification information:
• Government-issued identification numbers, including driver's license numbers and state identification card numbers;
• Date of birth; and
• Photographs or scans of identification documents submitted during the seller onboarding process (e.g., copies of a driver's license, state ID, or passport).
Tax and Financial Information. In order to process payments, comply with tax-reporting obligations, and facilitate financial transactions on the Marketplace, CDM collects the following:
• Taxpayer identification numbers, including Social Security Numbers ("SSNs") for individual sellers and sole proprietors, and Employer Identification Numbers ("EINs") for business entities;
• Data submitted through IRS Form W-9 (Request for Taxpayer Identification Number and Certification);
• Bank account numbers and routing numbers used for payment disbursement;
• Payment history, including records of all payments disbursed to the seller;
• Commission and fee records reflecting marketplace fees, referral fees, and other charges assessed; and
• IRS Form 1099-K reporting data, including gross payment amounts and transaction counts.
Transaction and Commercial Data. CDM collects information related to the seller's commercial activities on the Marketplace, including:
• Sales transaction records, including itemized details of each transaction processed through the Platform;
• Product listing information, including product descriptions, images, pricing, inventory levels, and categorization data;
• Order fulfillment data, including shipping confirmations, tracking numbers, and delivery status;
• Shipping and return records, including records of returned items, return reasons, and refund processing;
• Seller performance metrics, including order defect rates, on-time delivery rates, cancellation rates, and overall seller health scores; and
• Customer reviews and ratings associated with the seller's products and storefront.
Communications Data. CDM collects records of communications exchanged on the Platform, including:
• Messages exchanged between sellers and CDM support teams through the seller portal and marketplace messaging system;
• Messages exchanged between sellers and buyers through the Platform's buyer-seller messaging system; and
• Records of seller inquiries, support tickets, and any related correspondence.
Technical and Access Data. When sellers access the seller portal or interact with the Marketplace, CDM automatically collects certain technical and access information, including:
• Internet Protocol (IP) addresses;
• Device identifiers, including unique device IDs and hardware model information;
• Browser type, version, and settings;
• Login timestamps and session duration;
• Access logs reflecting the pages, features, and tools accessed within the seller portal; and
• Platform usage data, including clickstream data and navigation patterns within the seller portal.
Geolocation Data. CDM collects approximate geolocation data inferred from the seller's IP address when accessing the Platform. CDM does not collect precise geolocation data (e.g., GPS coordinates) from sellers.
Professional or Employment-Related Information. Depending on the nature of the seller's business and the products or services offered, CDM may collect:
• Business licenses and permits required to sell certain categories of products;
• Professional certifications and credentials (e.g., certifications required for the sale of regulated goods); and
• Other professional qualifications submitted as part of the seller qualification and onboarding process.
2.2 Sources of Personal Information
CDM collects personal information about Sellers from the following sources:
Directly from Sellers. The majority of seller personal information is collected directly from You during the account registration and onboarding process, as well as through Your ongoing use of and interaction with the Marketplace Platform. This includes information You provide when creating Your seller account, submitting tax and identity-verification documents, listing products, communicating through the Platform, and updating Your account settings or profile.
From Seller-Initiated Transactions and Interactions. CDM collects transaction and commercial data as a result of the sales transactions You initiate and complete on the Marketplace, as well as from Your interactions with buyers and with CDM support through the Platform.
From Third-Party Identity-Verification Services. During the seller onboarding process, CDM uses third-party identity-verification service providers to verify the identity of individual sellers and authorized representatives. These services may provide CDM with identity-verification results and related data.
From Payment Processors and Financial Institutions. CDM receives information from third-party payment processors and financial institutions in connection with the processing of seller payment disbursements, including payment confirmation data, chargeback notifications, and other transaction-related information.
Automatically Through Cookies and Tracking Technologies. When sellers access the seller portal at cascade.com/marketplace, CDM and its service providers automatically collect certain technical and access data through the use of cookies, web beacons, pixels, and other tracking technologies. CDM utilizes twelve (12) categories of cookies and tracking technologies on cascade.com. For detailed information about the specific cookies and trackers used, their purposes, and how to manage Your preferences, please refer to CDM's separate Cookie & Tracking-Technology Notice, available at cascade.com/cookie-notice.
2.3 Sensitive Personal Information
CDM collects and processes certain categories of personal information that are classified as "sensitive personal information" under applicable state privacy laws, including the CCPA/CPRA. The following categories of sensitive personal information are collected from sellers:
• Government-issued identification numbers, including Social Security Numbers and driver's license or state identification card numbers;
• Financial account information, including bank account numbers and routing numbers used for payment disbursement; and
• Account login credentials, including username and password combinations used to access the seller portal.
CDM limits the use and disclosure of sensitive personal information to those purposes that are strictly necessary to provide the Marketplace services, to fulfill CDM's legal obligations, and to support the following specific functions:
• Tax reporting and compliance (e.g., IRS Form 1099-K reporting and state tax obligations);
• Fraud prevention and detection;
• Identity verification during seller onboarding and on an ongoing basis; and
• Processing of seller payment disbursements.
Under the CCPA/CPRA, sellers who are California residents have the right to limit CDM's use and disclosure of their sensitive personal information to those uses that are necessary to perform the services reasonably expected by the seller. For more information on how to exercise this right, please see Section 6 below.
Section 3: Purposes of Processing
CDM processes seller personal information for the following specific business and commercial purposes:
Marketplace Platform Operation. CDM uses seller personal information to create and maintain seller accounts on the Marketplace, to enable the listing of products and services, to process and facilitate transactions between sellers and buyers, and to manage seller storefronts. This includes authenticating seller access to the seller portal, displaying seller profiles and product listings, and enabling the full range of marketplace functionality available to sellers.
Payment Processing and Disbursement. CDM uses seller financial information to process sales proceeds, calculate and disburse commissions, manage chargebacks, refunds, and payment adjustments, and maintain records of all financial transactions between CDM and sellers. Payment processing is facilitated through third-party payment processors and financial institutions, as described in Section 4 below.
Tax Compliance and Reporting. CDM collects and retains seller tax information in order to comply with federal and state tax-reporting requirements. This includes the collection of IRS Form W-9 data and the preparation and filing of IRS Form 1099-K for sellers whose gross payment amounts exceed applicable reporting thresholds, as well as compliance with applicable state tax-reporting obligations.
Identity Verification and Fraud Prevention. CDM uses identity-verification data to verify the identity of individual sellers and authorized representatives during the onboarding process and, as necessary, on an ongoing basis. CDM also processes seller personal information to detect and prevent fraudulent activity, platform abuse, unauthorized access, and violations of CDM's marketplace policies and terms of service.
Seller Performance and Quality Assurance. CDM monitors seller performance metrics—including order defect rates, on-time delivery rates, cancellation rates, and customer reviews and ratings—to maintain the quality and integrity of the Marketplace. Seller performance data is used to enforce marketplace policies and standards, to identify sellers who may require additional support or remediation, and to make decisions about seller account standing.
Communications. CDM uses seller contact information to respond to seller inquiries and support requests, to provide Platform updates and announcements, and to send transactional notifications, including order confirmations, payment notices, policy change notifications, and other communications related to the operation of the seller's account and participation in the Marketplace.
Legal Compliance. CDM processes seller personal information as necessary to comply with applicable laws, regulations, and legal processes. This includes responding to lawfully issued subpoenas, court orders, and requests from law enforcement or regulatory agencies, as well as exercising and defending legal claims related to the Marketplace.
Platform Improvement and Analytics. CDM analyzes aggregated and de-identified seller data to improve Marketplace functionality, enhance the seller experience, and inform business decisions related to the Platform. Peakview Analytics Inc., a Delaware corporation and wholly owned subsidiary of Cascade Retail Holdings Inc., may process de-identified and aggregated marketplace data for analytics purposes. When data is used for analytics, CDM takes reasonable steps to ensure that such data is de-identified or aggregated so that it cannot reasonably be used to identify any individual seller.
Security. CDM processes seller personal information as necessary to protect the security and integrity of the Marketplace Platform, to detect and respond to security incidents, unauthorized access, and other threats, and to maintain the confidentiality, integrity, and availability of seller data and Platform systems.
Section 4: How We Share Seller Personal Information
4.1 Categories of Recipients
CDM may disclose seller personal information to the following categories of recipients for the purposes described in this Notice:
Cascade Affiliates. CDM may share seller personal information with its parent company, Cascade Retail Holdings Inc., and with the following Cascade subsidiaries and affiliates, as necessary to support the Marketplace operations and the purposes described in this Notice:
• Ridgeline Fulfillment Services Inc., a Washington corporation and Cascade subsidiary, for fulfillment coordination and logistics support in connection with marketplace orders;
• Peakview Analytics Inc., a Delaware corporation and Cascade subsidiary, for analytics purposes based on aggregated and de-identified marketplace data; and
• Cascade Rewards Corp., a Delaware corporation and Cascade subsidiary, to the extent that a seller's participation in loyalty-program promotions or cross-promotional activities involves the sharing of seller personal information.
Cascade affiliates that receive seller personal information are bound by internal data-handling policies and are required to use such information only for the purposes described in this Notice.
Payment Processors and Financial Institutions. CDM shares seller financial information with third-party payment processors and banking institutions that facilitate the processing and disbursement of seller payments, including the deposit of sales proceeds into seller-designated bank accounts. These entities receive only the information necessary to complete payment transactions and are contractually required to maintain the confidentiality and security of seller data.
Identity-Verification Service Providers. CDM shares seller identity-verification data with third-party identity-verification service providers used during the seller onboarding process. These providers receive identification documents and related data solely for the purpose of verifying seller identity and are contractually obligated to process such data in accordance with applicable privacy laws.
Tax Authorities. CDM discloses seller tax information, including taxpayer identification numbers and gross payment data, to the Internal Revenue Service ("IRS") and applicable state tax authorities as required by federal and state tax-reporting laws and regulations, including IRS Form 1099-K reporting obligations.
Law Enforcement and Regulators. CDM may disclose seller personal information to government agencies, law enforcement authorities, courts, or regulatory bodies when required to do so by applicable law, legal process (including subpoenas and court orders), or governmental request, or when CDM believes in good faith that such disclosure is necessary to protect the rights, property, or safety of CDM, its sellers, its customers, or the public.
Professional Advisors. CDM may share seller personal information with the following categories of professional advisors engaged by Cascade, each of which is subject to professional and contractual confidentiality obligations:
• Legal Counsel, including Calderwood & Harkness LLP, a New York limited liability partnership, and Whitfield Greaves LLP, a Delaware limited liability partnership, which provide legal advice and representation to Cascade and CDM;
• Auditors, including Lakemont Audit Partners LLP, an Illinois limited liability partnership and Cascade's independent auditor, which conducts financial and compliance audits; and
• Consultants, including Fieldhaven Consulting Group LLC, a Delaware limited liability company, which provides consulting services related to data management, compliance, and platform operations.
Buyers/Customers. Certain limited seller information is displayed publicly on the Marketplace in connection with product listings and seller storefronts. This information includes the seller's business name, general geographic location (e.g., city and state), seller ratings and reviews, and product listing information. No sensitive personal information, financial account information, or taxpayer identification numbers are disclosed to buyers or displayed publicly on the Marketplace.
4.2 Data Sharing vs. Sale Under CCPA/CPRA
CDM does not "sell" seller personal information as the term "sell" is defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ad)). CDM does not disclose seller personal information to third parties in exchange for monetary or other valuable consideration.
CDM does not "share" seller personal information for cross-context behavioral advertising purposes as the term "share" is defined under the CCPA/CPRA (Cal. Civ. Code § 1798.140(ah)). CDM does not make seller personal information available to third parties for the purpose of serving targeted advertising to sellers based on their activity across different websites, applications, or online services.
For the avoidance of doubt, Cascade's advertising relationships—including those with advertising partners such as Thornbridge Media Corp.—involve the processing of consumer personal information in connection with Cascade's consumer-facing retail and e-commerce operations and are governed by the Cascade Omnibus Privacy Policy. Seller personal information is not used for, or disclosed in connection with, cross-context behavioral advertising or any advertising-related purpose.
All third-party recipients that process seller personal information on CDM's behalf are contractually bound as "service providers" (as defined under CCPA/CPRA), "processors" (as defined under the VCDPA, CPA, CTDPA, and other applicable state privacy laws), or in equivalent capacities, pursuant to written data processing agreements that restrict the use of seller personal information to the purposes specified by CDM and impose appropriate confidentiality and security obligations.
4.3 Data Segregation
CDM acknowledges the importance of maintaining appropriate data-segregation controls to protect seller personal information. CDM is in the process of implementing enhanced data-segregation controls to ensure that third-party seller data maintained on the Cascade Digital Marketplace is kept logically and, where appropriate, physically separate from first-party customer data collected through Cascade's retail and e-commerce operations. These controls include role-based access controls that govern access to each dataset, ensuring that only authorized personnel with a legitimate business need may access seller personal information.
In connection with these efforts, CDM is remediating a previously identified issue involving the commingling of marketplace seller data and consumer data within a shared data lake environment. CDM has engaged Fieldhaven Consulting Group LLC to assist with the design and implementation of an appropriate data-segregation architecture, including the establishment of distinct data environments, enhanced access controls, and audit logging to ensure that seller data is accessed and processed only for the purposes described in this Notice. This remediation is ongoing, and CDM expects to complete the implementation of these enhanced controls in accordance with the timeline established under its broader compliance program.
Section 5: Data Retention
CDM retains seller personal information for the period reasonably necessary to fulfill the purposes described in this Notice, or as otherwise required or permitted by applicable law. The applicable retention period for any particular category of personal information depends on the nature of the information, the purposes for which it was collected, and any legal, regulatory, or contractual requirements that mandate or permit its retention.
The following specific retention practices apply to the categories of seller personal information described in this Notice:
Account Registration Data. Account registration data is retained for the duration of the seller's active account on the Marketplace. Following account closure—whether initiated by the seller or by CDM—account registration data is retained for a defined period thereafter as specified in the Data Retention & Disposal Schedule being implemented by CDM, after which it is securely disposed of in accordance with CDM's disposal procedures.
Tax and Financial Information. Tax and financial information, including taxpayer identification numbers, IRS Form W-9 data, 1099-K reporting data, bank account and routing numbers, and payment records, is retained for a minimum of seven (7) years following the applicable tax year. This retention period is mandated by applicable IRS regulations and state tax laws to ensure that CDM can meet its ongoing tax-reporting and record-keeping obligations.
Transaction Data. Transaction and commercial data, including sales records, order fulfillment data, shipping and return records, and seller performance metrics, is retained for the duration of the seller's active account and for a defined period thereafter to support dispute resolution, refund processing, chargeback management, and legal compliance.
Communications Data. Records of communications exchanged on the Platform, including seller-buyer messages and seller support inquiries, are retained for the period specified in the Data Retention & Disposal Schedule.
Technical and Access Data. Technical and access data, including IP addresses, device identifiers, access logs, and platform usage data, is retained for security, auditing, and fraud-prevention purposes for a defined period as specified in the Data Retention & Disposal Schedule.
CDM is in the process of implementing a comprehensive Data Retention & Disposal Schedule that will address all categories of personal information collected from sellers. CDM acknowledges that the prior absence of a fully documented retention schedule was an identified compliance gap, and remediation is currently underway as part of CDM's broader privacy compliance program. Once finalized and approved, the Data Retention & Disposal Schedule will establish specific retention periods for each category of seller personal information, aligned with applicable legal requirements and the business purposes described in this Notice.
When the applicable retention period for any category of seller personal information expires, CDM will securely dispose of or anonymize such information using appropriate secure disposal methods. Secure disposal methods include secure deletion (including cryptographic erasure where applicable) and anonymization techniques that render the data no longer capable of identifying or being linked to any individual seller. CDM's disposal procedures are designed to prevent unauthorized access to, or recovery of, personal information following the expiration of the applicable retention period.
Section 6: Seller Rights Under Applicable State Privacy Laws
6.1 Overview of Rights
Sellers who are natural persons (including individual sellers, sole proprietors, and authorized representatives of seller entities) may have certain rights with respect to their personal information under applicable state privacy laws. Where applicable, these rights may also be exercised by an authorized agent acting on the seller's behalf, subject to CDM's verification requirements. The following is a summary of the rights that may be available to sellers, depending on the state(s) in which they reside:
Right to Know / Right of Access. You may have the right to request that CDM disclose the categories and specific pieces of personal information it has collected about You, the categories of sources from which that information was collected, the business or commercial purposes for which the information was collected, and the categories of third parties to whom the information has been disclosed. Under certain state laws, You may also have the right to receive a copy of Your personal information in a portable, readily usable format.
Right to Delete. You may have the right to request that CDM delete the personal information it has collected about You. This right is subject to certain statutory exceptions, including situations where retention is necessary to complete the transaction for which the information was collected, to comply with tax-reporting obligations (e.g., IRS Form 1099-K retention requirements), to satisfy legal-hold requirements, to detect and prevent fraud, to exercise or defend legal claims, or as otherwise permitted by applicable law.
Right to Correct. You may have the right to request that CDM correct inaccurate personal information it maintains about You. CDM will take commercially reasonable steps to correct any inaccuracies in Your personal information upon receiving a verified request.
Right to Opt Out of Sale/Sharing. Under certain state privacy laws, You may have the right to opt out of the "sale" of Your personal information or the "sharing" of Your personal information for cross-context behavioral advertising purposes. As described in Section 4.2 above, CDM does not sell seller personal information and does not share seller personal information for cross-context behavioral advertising. Nonetheless, sellers may exercise this right at any time. CDM honors the Global Privacy Control ("GPC") signal as a valid opt-out preference signal, as required under the CCPA/CPRA and other applicable state laws. If CDM detects a GPC signal from Your browser or device, CDM will treat it as a valid request to opt out of any sale or sharing of personal information associated with that browser or device.
Right to Limit Use of Sensitive Personal Information. Under the CCPA/CPRA, California residents have the right to direct CDM to limit the use and disclosure of their sensitive personal information to those purposes necessary to perform the Marketplace services reasonably expected by the seller. As described in Section 2.3 above, CDM already limits its use and disclosure of sensitive personal information to such purposes.
Right to Non-Discrimination. CDM will not discriminate against any seller for exercising their privacy rights under applicable state law. This means that CDM will not deny You access to the Marketplace, charge You different prices or fees, provide You with a different level or quality of service, or suggest that You will receive a different price, rate, or quality of service as a result of Your exercise of any privacy right.
Right to Appeal. In states that provide sellers with the right to appeal a denial of a privacy-rights request—including Virginia, Colorado, Connecticut, and other applicable states—sellers may submit an appeal of any adverse decision. CDM will review and respond to appeals within the timeframe required by applicable law. For more information on the appeal process, please see Section 7 below.
6.2 California-Specific Rights (CCPA/CPRA)
In addition to the general privacy rights described above, sellers who are California residents are entitled to the following CCPA/CPRA-specific disclosures and rights:
Categories of Personal Information Collected, Sold, or Shared. For a detailed table listing the categories of personal information CDM has collected from sellers in the preceding twelve (12) months, mapped to the CCPA/CPRA statutory categories, please see Section 12 (Additional Disclosures for California Sellers) below.
Financial Incentive Disclosure. CDM does not currently offer any marketplace programs that constitute "financial incentives" as defined under the CCPA/CPRA (Cal. Civ. Code § 1798.125(b)). In the event CDM introduces any such program in the future, CDM will provide the required financial-incentive disclosures at that time, including a description of the material terms of the program, the categories of personal information required for participation, and the good-faith estimate of the value of the seller's data.
Annual Data Subject Request Metrics. CDM's data subject request ("DSR") processing metrics are reported in aggregate with the overall DSR statistics of Cascade Retail Holdings Inc. For fiscal year 2024 ("FY2024"), Cascade Retail Holdings Inc. received approximately 38,400 total DSR requests across all business units, broken down as follows:
• Access / Right to Know requests: approximately 12,800;
• Deletion requests: approximately 19,100; and
• Opt-out of sale/sharing requests: approximately 6,500.
CDM is evaluating the feasibility of reporting seller-specific DSR metrics separately in future reporting periods. Sellers may request additional information about DSR processing metrics by contacting the Privacy Office at privacy@cascade.com.
California-Specific Privacy Disclosures Addendum. For additional detail regarding CDM's compliance with the CCPA/CPRA, including the specific categories of personal information collected, the purposes of collection, and the categories of recipients, please refer to the California-Specific Privacy Disclosures Addendum, which is incorporated by reference into this Notice and available upon request by contacting privacy@cascade.com.
6.3 State-Specific Rights Descriptions
CDM recognizes that sellers located in different states may have different privacy rights depending on the laws of their state of residence. CDM has prepared a State-Specific Consumer Rights Supplement (the "Rights Supplement"), which provides detailed descriptions of the privacy rights available to sellers under the VCDPA (Virginia), CPA (Colorado), CTDPA (Connecticut), TDPSA (Texas), OCPA (Oregon), DPDPA (Delaware), NJDPA (New Jersey), NHDPA (New Hampshire), NDPA (Nebraska), ICDPA (Iowa), INCDPA (Indiana), TIPA (Tennessee), MCDPA (Montana), UCPA (Utah), the Minnesota Consumer Data Privacy Act, MODPA (Maryland), KYDPA (Kentucky), and all other applicable state privacy statutes.
Sellers located in any of the nineteen (19) states with applicable privacy statutes may exercise the rights provided by their state's law by following the procedures described in Section 7 below. CDM will process all privacy requests in accordance with the requirements of the applicable state law(s). A copy of the Rights Supplement is available upon request by contacting the Privacy Office at privacy@cascade.com.
Section 7: How to Submit a Privacy Request
Sellers who wish to exercise any of the privacy rights described in Section 6 of this Notice may submit a request using any of the following methods:
• Online DSR Portal: Submit a request through CDM's online data subject request portal at cascade.com/privacy-requests. The portal provides a guided process for submitting access, deletion, correction, and opt-out requests.
• Email: Send a request to privacy@cascade.com. Please include Your name, the email address associated with Your seller account, the nature of Your request, and any additional information necessary to verify Your identity and process Your request.
• Toll-Free Phone: Call CDM's privacy request line at the toll-free number listed on the DSR portal. A representative will assist You in submitting Your request and guide You through the identity-verification process.
Identity Verification. To protect the security of seller personal information, CDM verifies the identity of each individual submitting a privacy request before processing the request. CDM's identity-verification process is designed to meet the standards established under the CCPA/CPRA and other applicable state privacy laws. Depending on the nature of the request, CDM may require You to provide two or more data points that match information already maintained by CDM, and for requests to disclose specific pieces of personal information, CDM may require additional verification through a signed declaration under penalty of perjury. CDM has remediated a previously identified gap in which the DSR portal did not fully meet CCPA identity-verification standards; the current portal and verification process have been updated to ensure compliance with all applicable requirements.
Response Timeframe. CDM aims to respond to verifiable privacy requests within fifteen (15) business days of receipt. This target has been established as part of CDM's compliance program and represents a significant improvement over the prior average response time of twenty-seven (27) calendar days. In all cases, CDM will respond to requests within the timeframes required by applicable state law. Under the CCPA/CPRA, CDM will respond to verifiable requests within forty-five (45) calendar days of receipt, with the possibility of an extension of up to an additional forty-five (45) calendar days where reasonably necessary, provided that CDM notifies the seller of the extension and the reason for it within the initial forty-five (45) day period. Other state privacy laws may provide for different response timeframes, and CDM will comply with the requirements of each applicable statute.
Authorized Agent Requests. Sellers may designate an authorized agent to submit a privacy request on their behalf. If You wish to use an authorized agent, CDM may require the authorized agent to provide proof of written authorization from the seller (such as a power of attorney or a signed written authorization), and CDM may independently verify the identity of the seller on whose behalf the request is made. In California, if an authorized agent submits a request without providing proof of authorization through a power of attorney pursuant to California Probate Code sections 4000–4465, CDM may require the seller to verify their own identity directly with CDM and confirm that they authorized the agent to submit the request.
Appeal Process. If CDM denies a privacy request in whole or in part, sellers in states that provide an appeal right—including Virginia, Colorado, Connecticut, and other applicable states—may appeal that decision. Appeals may be submitted through the online DSR portal at cascade.com/privacy-requests or by emailing privacy@cascade.com with the subject line "Privacy Request Appeal." CDM will acknowledge receipt of the appeal and provide a substantive response within the timeframe required by applicable state law. If a seller's appeal is denied, CDM will provide the seller with information about how to file a complaint with the applicable state attorney general or other enforcement authority, as required by law.
Section 8: Data Security
CDM takes the security of seller personal information seriously and implements reasonable administrative, technical, and physical safeguards designed to protect seller personal information against unauthorized access, use, disclosure, alteration, or destruction. These safeguards are intended to be commensurate with the sensitivity of the information collected and the nature and scope of CDM's data processing activities.
The information security controls applicable to the Marketplace Platform are overseen by Gregory Farris, Chief Information Security Officer of Cascade Retail Holdings Inc. Mr. Farris is responsible for the development, implementation, and maintenance of Cascade's enterprise-wide information security program, which includes the security controls applicable to the Marketplace and to seller personal information. CDM's security program encompasses, among other things, encryption of data in transit and at rest, access controls and authentication mechanisms, network security monitoring, vulnerability management, employee training, and incident response procedures.
Cascade Retail Holdings Inc. maintains cyber and privacy liability insurance coverage designed to provide financial protection against certain risks associated with data breaches, unauthorized access to personal information, and related incidents. Specific details regarding the scope, limits, and terms of such insurance coverage are confidential and are not disclosed in this Notice.
CDM conducts periodic security assessments of the Marketplace Platform and its associated data-processing systems, including vulnerability assessments, penetration testing, and security audits. CDM engages third-party consultants and independent auditors to evaluate and enhance its security controls on a regular basis. The results of these assessments are used to identify areas for improvement and to implement appropriate remediation measures.
While CDM takes reasonable steps to protect seller personal information, no security system is impenetrable, and CDM cannot guarantee the absolute security of any information transmitted to or stored on the Platform. Sellers are encouraged to take steps to protect their own account credentials, including using strong, unique passwords and enabling any available multi-factor authentication features.
Section 9: Children's Privacy
The Cascade Digital Marketplace is a business-to-business platform intended for use by adults who are engaged in commercial activities as sellers of products and services. The Marketplace is not directed at, and is not intended for use by, children under the age of thirteen (13), or under the age of sixteen (16) where applicable under certain state privacy laws.
CDM does not knowingly collect personal information from children under the age of thirteen (13) (or sixteen (16), as applicable) in connection with seller accounts. If CDM becomes aware that it has inadvertently collected personal information from a child in connection with a seller account, CDM will take prompt steps to delete such information and, if appropriate, to deactivate the associated account. If You believe that CDM may have collected personal information from a child, please contact the Privacy Office at privacy@cascade.com.
Section 10: Changes to This Notice
CDM may update this Notice from time to time to reflect changes in CDM's data practices, changes in applicable legal requirements, or changes in CDM's business operations. When CDM makes material changes to this Notice, CDM will notify affected sellers through one or more of the following means:
• A prominent notification posted on the seller portal at cascade.com/marketplace;
• An email notification sent to the email address associated with the seller's account; or
• Other appropriate means of communication, as determined by CDM based on the nature and significance of the changes.
CDM encourages sellers to review this Notice periodically to stay informed about how CDM collects, uses, and protects their personal information. The effective date of the current version of this Notice is set forth at the top of this document.
Effective Date of Current Version: September 12, 2025.
This Notice replaces and supersedes any prior seller privacy notices, disclosures, or statements issued by CDM or Cascade Retail Holdings Inc. relating to the processing of seller personal information in connection with the Marketplace.
Section 11: Contact Information
If You have any questions, concerns, or requests regarding this Notice, CDM's privacy practices, or Your privacy rights, please contact the Privacy Office using the following information:
Privacy Inquiries:
Diana Polk Associate General Counsel (Interim Chief Privacy Officer) Cascade Retail Holdings Inc. 4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Email: privacy@cascade.com
Mailing Address for Written Requests:
Cascade Retail Holdings Inc.
Attn: Privacy Office
4100 Elliott Avenue West, Suite 1200 Seattle, WA 98119
Marketplace Platform Support. For non-privacy-related inquiries regarding Your seller account, product listings, payments, or other Marketplace operational matters, please contact the Marketplace Seller Support team through the seller portal at cascade.com/marketplace/support or by emailing seller-support@cascade.com. The Marketplace Seller Support team handles operational inquiries and is separate from the Privacy Office.
Future Chief Privacy Officer. Cascade Retail Holdings Inc. intends to hire a full-time Chief Privacy Officer in the near term. Once that position is filled, the Chief Privacy Officer will serve as the designated privacy contact for all matters relating to this Notice and CDM's privacy practices. CDM will update this Notice and notify sellers when the Chief Privacy Officer position has been filled.
Section 12: Additional Disclosures for California Sellers
Pursuant to the requirements of the CCPA/CPRA, this Section 12 provides additional disclosures for sellers who are California residents. The following table sets forth the categories of personal information CDM has collected from sellers in the preceding twelve (12) months, mapped to the CCPA/CPRA statutory categories, along with the business or commercial purposes for collection and the categories of third parties to whom each category of information has been disclosed.
Business and Commercial Purposes for Collection. The business and commercial purposes for which CDM collects each category of seller personal information are described in detail in Section 3 of this Notice. In summary, CDM collects seller personal information for the following overarching purposes: (i) operating and maintaining the Marketplace Platform; (ii) processing payments and disbursements; (iii) complying with federal and state tax-reporting requirements; (iv) verifying seller identity and preventing fraud; (v) monitoring seller performance and enforcing marketplace standards; (vi) communicating with sellers regarding their accounts and transactions; (vii) complying with applicable legal obligations; (viii) improving the Marketplace through analytics on aggregated and de-identified data; and (ix) protecting the security and integrity of the Platform.
No Sale or Sharing for Cross-Context Behavioral Advertising. CDM confirms that it has not "sold" (as defined in Cal. Civ. Code § 1798.140(ad)) any seller personal information in the preceding twelve (12) months. CDM further confirms that it has not "shared" (as defined in Cal. Civ. Code § 1798.140(ah)) any seller personal information for cross-context behavioral advertising purposes in the preceding twelve (12) months.
Retention Periods. The retention periods applicable to each category of seller personal information are set forth in Section 5 of this Notice. As noted in Section 5, CDM is in the process of finalizing a comprehensive Data Retention & Disposal Schedule that will establish specific, documented retention periods for each category of seller personal information. Once finalized, the Data Retention & Disposal Schedule will be made available to California sellers upon request by contacting the Privacy Office at privacy@cascade.com.
Annual DSR Processing Metrics. California sellers may request CDM's annual data subject request processing metrics, which are reported in aggregate with Cascade Retail Holdings Inc.'s overall DSR statistics. The FY2024 metrics are set forth in Section 6.2 of this Notice. To request additional information or to obtain the most current metrics, please contact the Privacy Office at privacy@cascade.com.
This Third-Party Marketplace Seller Privacy Notice is effective as of September 12, 2025 and replaces all prior versions.
© 2025 Cascade Retail Holdings Inc. All rights reserved. Cascade Digital Marketplace LLC is a wholly owned subsidiary of Cascade Retail Holdings Inc. Cascade Retail Holdings Inc. is publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD. This Notice was prepared by Calderwood & Harkness LLP on behalf of Cascade Digital Marketplace LLC. All inquiries regarding this Notice should be directed to the Privacy Office at the contact information provided in Section 11.
Effective Date: September 12, 2025
CCPA/CPRA Statutory Category | Specific Types of PI Collected from Sellers | Business/Commercial Purpose(s) for Collection | Categories of Third-Party Recipients
A. Identifiers (Cal. Civ. Code § 1798.140(v)(1)(A)) | Full legal name, business name/DBA, email address, phone number, mailing address, username, IP address, driver's license/state ID number, SSN, EIN | Marketplace operations, account management, identity verification, tax compliance, communications, fraud prevention, security | Cascade affiliates, payment processors, identity-verification providers, tax authorities, law enforcement (as required), professional advisors
B. Personal Information Categories Listed in Cal. Civ. Code § 1798.80(e) | Name, address, SSN, telephone number, driver's license number, bank account number, financial information | Marketplace operations, payment processing, tax compliance, identity verification | Cascade affiliates, payment processors, identity-verification providers, tax authorities, professional advisors
C. Protected Classification Characteristics | Date of birth (collected for identity verification purposes only) | Identity verification | Identity-verification providers
D. Commercial Information | Sales transaction records, product listing information, order fulfillment data, shipping and return records, commission and fee records, payment history | Marketplace operations, payment processing, seller performance management, dispute resolution, tax compliance | Cascade affiliates (including Ridgeline Fulfillment Services Inc.), payment processors, tax authorities, professional advisors
F. Internet or Other Electronic Network Activity Information | IP addresses, device identifiers, browser type and settings, login timestamps, access logs, platform usage data, cookie data | Security, fraud prevention, platform improvement, analytics | Cascade affiliates (including Peakview Analytics Inc., for de-identified/aggregated data)
G. Geolocation Data | Approximate geolocation inferred from IP address | Security, fraud prevention, platform operations | Cascade affiliates
I. Professional or Employment-Related Information | Business licenses, permits, certifications, professional credentials | Seller qualification, marketplace operations, compliance | Cascade affiliates, professional advisors
S. Sensitive Personal Information | SSN, driver's license/state ID number, bank account and routing numbers, account login credentials | Tax compliance, identity verification, payment processing, fraud prevention, account security | Payment processors, identity-verification providers, tax authorities

THIRD-PARTY MARKETPLACE SELLER PRIVACY NOTICE

Record

Parties

Dates

Amounts