omnibus-privacy-policy-draft.docx

1038-00010 · Cascade Retail Holdings · Policies & Notices

omnibus-privacy-policy-draft.docx DOCUMENT Finance & Banking

37 / 38 ← → ✕

DRAFT — Prepared by Calderwood & Harkness LLP (Sara Hendricks, Associate; reviewed by Alan Burke, Senior Associate, and Kevin Ostrowski, Partner, Privacy & Data Security) — Attorney-Client Privileged Work Product — Draft for Client Review — Matter No. 1038-00010

CASCADE RETAIL HOLDINGS INC.

PRIVACY POLICY

Effective Date: September 12, 2025

This Privacy Policy replaces our prior privacy policy, last updated March 2022.

Applicability. This Privacy Policy applies to personal information collected through cascade.com, the Cascade mobile application (available on iOS and Android), in-store interactions at all 186 Cascade retail locations across 31 U.S. states, and the Cascade Digital Marketplace located at cascade.com/marketplace. This Privacy Policy is intended to provide a comprehensive description of Cascade's data-collection and data-use practices across all of these consumer-facing channels and touchpoints.

Right-click to update Table of Contents

1. Introduction and Scope

Cascade Retail Holdings Inc. ("Cascade," "we," "us," or "our") is a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD. Cascade is the data controller responsible for the personal information described in this Privacy Policy. The executive sponsor of Cascade's privacy program is Chief Executive Officer Thomas R. Cavanaugh.

This Privacy Policy describes how Cascade and its subsidiaries collect, use, disclose, retain, and protect personal information ("PI") about consumers who interact with us through our website at cascade.com, our mobile application, our 186 physical retail locations across 31 U.S. states, and the Cascade Digital Marketplace at cascade.com/marketplace. For purposes of this Privacy Policy, "personal information" has the broadest meaning given to that term (or to substantially similar terms such as "personal data") under applicable U.S. state privacy statutes.

This Privacy Policy covers the data practices of Cascade and each of its wholly-owned subsidiaries, which include:

• Cascade Digital Marketplace LLC ("CDM") — the operator of Cascade's third-party seller marketplace at cascade.com/marketplace, which hosts approximately 3,800 independent sellers;

• Ridgeline Fulfillment Services Inc. — Cascade's warehousing, logistics, and order-fulfillment subsidiary;

• Peakview Analytics Inc. — Cascade's advertising-technology and customer-analytics subsidiary, which processes consumer data in connection with targeted advertising, personalization, and measurement; and

• Cascade Rewards Corp. — the operator of the Cascade Rewards loyalty program and stored-value card programs.

References to "Cascade" throughout this Privacy Policy include all of the above subsidiaries unless otherwise specified.

This Privacy Policy applies to all U.S. consumers who interact with Cascade through any of the channels identified above. We have designed this Privacy Policy to comply with the requirements of nineteen (19) applicable U.S. state privacy statutes, including but not limited to the following:

In addition to this Privacy Policy, certain supplemental notices may apply to specific products, services, or categories of consumers. These supplemental notices are incorporated by reference and should be read in conjunction with this Privacy Policy:

• California-Specific Privacy Disclosures Addendum — additional disclosures required under the CCPA/CPRA for California residents;

• State-Specific Consumer Rights Supplement — a detailed, state-by-state description of consumer privacy rights under each of the 19 applicable state statutes;

• Cookie & Tracking-Technology Notice — a comprehensive description of the cookies and tracking technologies deployed on cascade.com and the Cascade mobile app, including opt-out and opt-in mechanisms; and

• Cascade Rewards Loyalty-Program Privacy Notice — a notice describing the data practices specific to the Cascade Rewards loyalty program, including financial-incentive disclosures required under the CCPA/CPRA.

We encourage all consumers to read this Privacy Policy in its entirety. If you have questions about our privacy practices or your rights under applicable law, please contact us using the methods described in Section 16 below.

2. Categories of Personal Information We Collect

Cascade collects personal information from and about consumers in connection with our website, mobile application, physical retail locations, and the Cascade Digital Marketplace. The categories of personal information we collect are described below.

2.1 Identifiers. We collect personal identifiers that allow us to identify, contact, or communicate with consumers. These identifiers include:

• Full name (first and last);

• Email address;

• Postal address (including billing and shipping addresses);

• Phone number (including mobile and landline);

• Account username;

• Cascade Rewards membership ID;

• Internet Protocol (IP) address;

• Device identifiers (including mobile advertising identifiers, hardware identifiers, and unique device tokens);

• Cookie identifiers; and

• Advertising identifiers (including identifiers assigned by advertising networks and demand-side platforms).

These identifiers are collected when consumers create accounts, make purchases, enroll in the Cascade Rewards loyalty program, contact customer service, or interact with our website and mobile application.

2.2 Commercial Information

We collect records of commercial transactions and related activity, including:

• Purchase and transaction history, encompassing both online and in-store transactions (Cascade processes approximately 94 million online transactions annually across cascade.com and the Cascade Digital Marketplace);

• Products or services purchased, returned, exchanged, or considered;

• Return and exchange records, including reason codes and refund amounts;

• Shopping-cart contents and saved items;

• Wishlist contents and product-interest data;

• Cascade Rewards loyalty-program activity, including points earned, points redeemed, tier status, and stored-value card balances (the Cascade Rewards program currently has approximately 41.2 million registered members); and

• Payment method information associated with transactions (see also Section 2.5 regarding sensitive payment-card data).

2.3 Internet and Electronic Network Activity

We collect information about consumers' interactions with our website, mobile application, and digital advertisements, including:

• Browsing history on cascade.com and the Cascade mobile application;

• Search history and search queries entered on cascade.com;

• Interaction with advertisements served by or on behalf of Cascade, including impressions, clicks, and conversions;

• Clickstream data, including the sequence of pages visited and actions taken during a browsing session;

• Referral URLs (i.e., the website or application from which a consumer navigated to cascade.com);

• Session duration, page-view counts, and time spent on individual pages;

• Information about the consumer's browser type, operating system, screen resolution, and language preferences; and

• Data processed by Peakview Analytics Inc. in connection with advertising targeting, personalization, and campaign measurement — Peakview Analytics processes approximately 2.1 billion consumer-event data records per month for these purposes.

Cascade deploys twelve (12) categories of cookies and tracking technologies on cascade.com and within the Cascade mobile application. These categories are described in detail in our separate Cookie & Tracking-Technology Notice, which is available at cascade.com/cookie-notice. A summary of our cookie practices is provided in Section 9 of this Privacy Policy.

2.4 Geolocation Data

We collect the following categories of geolocation data:

• Precise geolocation data collected through the Cascade mobile application, derived from GPS-based latitude and longitude coordinates. Precise geolocation data is collected only when the consumer has enabled location services for the Cascade mobile application on their device. This data is used to provide location-based services, such as store-locator functionality, local product availability, and location-based promotions; and

• Approximate geolocation data inferred from the consumer's IP address, which may be used to identify the consumer's general geographic region (e.g., city, state, or ZIP code) for purposes of content localization, fraud prevention, and analytics.

As described in Section 2.5, precise geolocation data is classified as sensitive personal information under the CCPA/CPRA and certain other state privacy statutes.

2.5 Sensitive Personal Information

Cascade collects categories of personal information that are classified as "sensitive personal information" or "sensitive data" under the CCPA/CPRA and other applicable state privacy statutes. These categories include:

• Payment-card data: Credit-card and debit-card numbers, expiration dates, and security codes (CVV/CVC), collected in connection with purchases on cascade.com, in the Cascade mobile application, and at physical retail locations. Payment-card data is processed in accordance with the Payment Card Industry Data Security Standard (PCI DSS);

• Precise geolocation data: GPS-derived latitude and longitude coordinates collected through the Cascade mobile application, as described in Section 2.4 above; and

• Account login credentials: The combination of a consumer's account username or email address with the consumer's password or answers to security questions, used to authenticate the consumer's identity and provide access to the consumer's Cascade account.

Cascade processes sensitive personal information solely for the purposes of providing the services requested by the consumer. Consumers have the right to limit the use and disclosure of their sensitive personal information, as described in Section 7.7 of this Privacy Policy.

2.6 Inferences. Cascade draws inferences from the personal information described in this Privacy Policy to create consumer profiles. These inferences may reflect a consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. Inferences are derived from information across multiple categories, including identifiers, commercial information, internet and network activity data, geolocation data, and other information collected by Cascade and its subsidiaries, including Peakview Analytics Inc. Inferences are used for purposes including advertising targeting, personalization, product recommendations, and customer segmentation.

2.7 Audio, Electronic, Visual, or Similar Information

Cascade collects the following types of audio, electronic, visual, or similar information:

• Call recordings: Customer-service calls may be recorded for quality-assurance, training, dispute-resolution, and compliance purposes. At the beginning of each call, consumers are informed that the call may be recorded; and

• In-store security camera footage: Cascade operates security cameras at its 186 physical retail locations for the purposes of loss prevention, safety, and security. Security camera footage may capture images of consumers who visit our stores.

2.8 Professional or Employment-Related Information

In limited circumstances, Cascade collects professional or employment-related information from individuals who operate third-party seller accounts on the Cascade Digital Marketplace LLC. This information may include the individual's business name, business address, business tax identification number, and related professional information necessary for the operation of a marketplace seller account. Approximately 3,800 third-party sellers currently operate on the Cascade Digital Marketplace. A separate Third-Party Marketplace Seller Privacy Notice applies to marketplace sellers and provides additional detail regarding the collection and use of seller information.

Note: Personal information of Cascade employees and job applicants is not covered by this Privacy Policy. Employee and job-applicant data are governed by a separate Employee & Job-Applicant Privacy Notice, which is provided to employees and applicants directly.

3. Sources of Personal Information

Cascade collects personal information from the following categories of sources:

3.1 Directly from Consumers

We collect personal information directly from consumers when they interact with us, including through the following activities:

• Creating a Cascade account on cascade.com or the Cascade mobile application;

• Making purchases online through cascade.com, the Cascade Digital Marketplace, or the Cascade mobile application, or in-store at any of our 186 physical retail locations;

• Enrolling in the Cascade Rewards loyalty program;

• Contacting Cascade's customer-service team by phone, email, live chat, or in person;

• Entering contests, sweepstakes, or promotions offered by or on behalf of Cascade;

• Submitting product reviews or ratings on cascade.com;

• Responding to surveys or feedback requests; and

• Submitting inquiries or requests through cascade.com or the Cascade mobile application, including consumer-rights requests as described in Section 8.

3.2 Automatically via Technology

We collect personal information automatically when consumers interact with our website, mobile application, and digital services. The technologies we use for automatic data collection include:

• Cookies: Cascade deploys twelve (12) categories of cookies on cascade.com, ranging from strictly necessary cookies to advertising and targeting cookies. Our cookie practices are described in detail in our Cookie & Tracking-Technology Notice;

• Pixels and web beacons: Small graphic files or code snippets embedded in web pages and emails that track page views, email opens, and other consumer interactions;

• Software development kits (SDKs): Third-party and proprietary SDKs integrated into the Cascade mobile application that collect data regarding app usage, device characteristics, and other technical information;

• Server logs: Cascade's web and application servers automatically record information about each request, including IP address, browser type, referring URL, date and time of access, and pages viewed; and

• Consent-management platform: Cascade's cookie consent-management platform, which is operated by OnPoint Data Solutions Inc., collects and records consumer cookie preferences and consent choices.

3.3 From Third Parties

We receive personal information about consumers from third-party sources, including:

• Advertising and analytics partners: Cascade receives consumer data from forty-seven (47) third-party advertising and analytics partners, as identified in the data-mapping report prepared by Fieldhaven Consulting Group LLC and dated May 19, 2025. These partners provide data used for advertising targeting, campaign measurement, audience modeling, and analytics;

• Third-party marketplace sellers: Sellers on the Cascade Digital Marketplace LLC may provide data about consumers in connection with order processing, fulfillment, and customer-service interactions;

• Data brokers and aggregators: Cascade receives data from third-party data brokers and aggregators for purposes of identity verification, fraud prevention, and risk assessment;

• Social media platforms: When consumers connect their social media accounts (such as Kestrel Services Inc., Northpoint Services Inc., or Severin Industries) to their Cascade accounts or use social login functionality, Cascade may receive profile information from the applicable social media platform in accordance with the consumer's privacy settings on that platform; and

• Payment processors and financial institutions: Cascade receives transaction-related data from payment processors and financial institutions in connection with payment authorization, settlement, and fraud prevention.

4. Purposes of Processing / Use of Personal Information

Cascade collects, uses, and processes personal information for the purposes described below. We will not collect additional categories of personal information or use the personal information we have collected for materially different, unrelated, or incompatible purposes without providing consumers with notice.

4.1 Business and Operational Purposes

Cascade uses personal information for the following business and operational purposes:

• Order processing and fulfillment: Processing, fulfilling, and managing consumer orders placed on cascade.com, the Cascade Digital Marketplace, the Cascade mobile application, and at our 186 physical retail locations, including processing payments, shipping products, and facilitating returns and exchanges;

• Cascade Rewards loyalty program: Managing and operating the Cascade Rewards loyalty program, including enrollment, points accrual, points redemption, tier-status management, stored-value card issuance and management, and program communications. The Cascade Rewards program constitutes a "financial incentive" program under CCPA § 1798.125. Additional details regarding the program's data practices are provided in the separate Cascade Rewards Loyalty-Program Privacy Notice;

• Website, application, and retail operations: Operating, maintaining, and improving cascade.com, the Cascade mobile application, and our physical retail locations, including product display, inventory management, and customer experience optimization;

• Cascade Digital Marketplace operations: Operating and administering the Cascade Digital Marketplace (CDM), including managing seller accounts, facilitating transactions between consumers and third-party sellers, and resolving disputes;

• Warehousing, shipping, and fulfillment: Providing warehousing, logistics, and fulfillment services through Ridgeline Fulfillment Services Inc., including order picking, packing, shipping, delivery tracking, and returns processing;

• Customer service and support: Providing customer-service and technical-support assistance, including responding to inquiries, resolving complaints, processing refunds and credits, and managing consumer accounts; and

• Fraud prevention, security, and legal compliance: Detecting, preventing, and investigating fraud, unauthorized transactions, and other illegal or suspicious activities; protecting the security and integrity of our systems and networks; and complying with applicable laws, regulations, and legal obligations.

4.2 Advertising, Marketing, and Personalization

Cascade uses personal information for the following advertising, marketing, and personalization purposes:

• Targeted and programmatic advertising: Delivering targeted and programmatic advertisements to consumers across digital channels, including display advertising, search advertising, social media advertising, and connected-television advertising. Targeted advertising activities are conducted in part by and through Peakview Analytics Inc., Cascade's advertising-technology subsidiary;

• Cross-context behavioral advertising: Using personal information collected across different websites, applications, and services to deliver advertisements that are targeted based on the consumer's behavior across multiple contexts. Certain of these activities may constitute the "sharing" of personal information for cross-context behavioral advertising under the CCPA/CPRA and analogous state statutes;

• Email, SMS, and push-notification marketing: Sending marketing communications to consumers via email, short message service (SMS) text messages, and push notifications through the Cascade mobile application, in accordance with applicable laws regarding electronic marketing communications;

• Personalization: Personalizing the content, product recommendations, promotions, and offers presented to consumers on cascade.com, the Cascade mobile application, and in marketing communications, based on the consumer's purchase history, browsing behavior, preferences, and inferred interests; and

• Measurement and attribution: Measuring the effectiveness of advertising campaigns and marketing activities, including impression and click-through tracking, conversion attribution, audience reach analysis, and return-on-advertising-spend calculations.

4.3 Analytics and Research

Cascade uses personal information for the following analytics and research purposes:

• Data analytics and business intelligence: Performing data analytics to understand consumer behavior, identify trends, and generate business intelligence used to inform strategic and operational decisions;

• Consumer trend analysis: Analyzing consumer purchasing patterns, browsing behavior, and demographic information to identify market trends and consumer preferences; and

• Product development research: Using consumer feedback, product-review data, purchase data, and behavioral data to inform product development, merchandising decisions, and service improvements.

4.4 Legal, Compliance, and Safety

Cascade uses personal information for the following legal, compliance, and safety purposes:

• Compliance with applicable laws: Complying with applicable federal, state, and local laws, regulations, and ordinances, including the nineteen (19) U.S. state privacy statutes identified in Section 1 of this Privacy Policy, as well as consumer-protection laws, tax laws, and other regulatory requirements;

• Responding to legal process and governmental inquiries: Responding to subpoenas, court orders, search warrants, regulatory inquiries, and other lawful requests from courts, law-enforcement agencies, and governmental authorities;

• Protecting rights, safety, and property: Protecting the rights, safety, and property of Cascade, its customers, employees, third-party sellers, and other third parties, including enforcing our terms of service, acceptable-use policies, and contractual obligations; and

• Establishing, exercising, or defending legal claims: Using personal information as necessary to establish, exercise, or defend legal claims, including in connection with litigation, arbitration, and regulatory proceedings.

5. Disclosure and Sharing of Personal Information

Cascade discloses and shares personal information with the categories of recipients described below, for the purposes identified in Section 4 of this Privacy Policy.

5.1 Categories of Recipients

Service Providers. Cascade discloses personal information to vendors and service providers that process personal information on Cascade's behalf, under written contractual agreements that restrict the vendor's use, retention, and disclosure of the information. These vendors are classified as "service providers" under the CCPA/CPRA and as "processors" under other applicable state privacy statutes. All service-provider relationships are governed by Cascade's Master Data Processing Agreement template, which includes provisions addressing data-use limitations, confidentiality, data security, subprocessor management, audit rights, and data-deletion or -return obligations upon termination. Service providers perform functions such as payment processing, cloud hosting, email delivery, customer-service support, and data analytics.

Contractors. Cascade discloses personal information to certain vendors that qualify as "contractors" under the CCPA (California Civil Code § 1798.140(j)). These vendors are subject to heightened contractual restrictions, including prohibitions on selling or sharing the personal information received from Cascade, prohibitions on retaining, using, or disclosing the personal information outside the direct business relationship with Cascade, and prohibitions on combining personal information received from Cascade with personal information obtained from other sources or collected from the contractor's own interactions with consumers, except as expressly permitted by the CCPA/CPRA.

Third Parties — Advertising and Analytics Partners. Cascade shares consumer personal information with forty-seven (47) third-party advertising and analytics partners for purposes of targeted advertising, cross-context behavioral advertising, campaign measurement, audience modeling, and analytics. As of the date of this Privacy Policy, twenty-three (23) of these forty-seven partners are in the process of executing data-processing agreements with Cascade that are designed to comply with applicable state privacy statutes; the remaining twenty-four (24) partners have already executed such agreements or are subject to existing contractual arrangements that are being reviewed for compliance.

Cascade specifically identifies the following partner: Thornbridge Media Corp., which serves as Cascade's primary programmatic-advertising and audience-targeting partner. Cascade's fiscal year 2024 advertising spend with Thornbridge Media Corp. totaled approximately $18.4 million. The data-sharing arrangement between Cascade and Thornbridge Media Corp. is governed by a restructured Data-Sharing Agreement that was negotiated to address state privacy-law requirements, including provisions for opt-out signal processing, data-use restrictions, and data-retention limitations.

Affiliates and Subsidiaries. Cascade shares personal information among its affiliates and wholly-owned subsidiaries, including Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. Personal information shared among affiliates and subsidiaries is used for the purposes described in this Privacy Policy and is subject to the same protections.

Third-Party Marketplace Sellers. When consumers purchase products from third-party sellers on the Cascade Digital Marketplace, limited personal information — such as the consumer's name, shipping address, and order information — is shared with the applicable seller for the purpose of order fulfillment. Approximately 3,800 third-party sellers currently operate on the Cascade Digital Marketplace. Sellers' access to and use of consumer personal information is governed by the Marketplace Seller Data-Use Terms, as further described in Section 13 of this Privacy Policy.

Government and Law Enforcement. Cascade may disclose personal information to governmental authorities, law-enforcement agencies, courts, and regulatory bodies as required by law, in response to lawful legal process (such as subpoenas, court orders, or search warrants), or in connection with regulatory inquiries and investigations.

Professional Advisors. Cascade discloses personal information to its professional advisors as necessary for the provision of legal, auditing, insurance, and consulting services. Cascade's professional advisors include:

• Outside counsel: Calderwood & Harkness LLP and Whitfield Greaves LLP;

• Independent auditors: Lakemont Audit Partners LLP;

• Insurance brokers and carriers: Ridgepoint Insurance Brokers Inc. and Northcastle Indemnity Company; and

• Consultants: Fieldhaven Consulting Group LLC.

All professional advisors are subject to confidentiality obligations.

Business Transaction Counterparties. Cascade may disclose personal information to third parties in connection with a proposed or actual merger, acquisition, divestiture, restructuring, reorganization, dissolution, asset sale, or other business transaction involving all or a portion of Cascade's assets, where personal information is among the assets being transferred. In such circumstances, Cascade will require the acquiring entity to comply with the terms of this Privacy Policy or to provide consumers with notice and, where required, the opportunity to exercise their rights under applicable law.

5.2 Sale and Sharing of Personal Information

Under the CCPA/CPRA and analogous provisions of other state privacy statutes, certain disclosures of consumer personal information to third-party advertising and analytics partners may constitute a "sale" of personal information (i.e., a disclosure of personal information for monetary or other valuable consideration) or the "sharing" of personal information (i.e., a disclosure of personal information for cross-context behavioral advertising purposes), even where Cascade does not receive direct monetary payment for the information.

Cascade has determined that its data disclosures to certain advertising and analytics partners may constitute a "sale" or "sharing" under applicable state privacy statutes. The categories of personal information that may be sold or shared include the following:

• Identifiers (such as cookie IDs, device identifiers, advertising IDs, and IP addresses);

• Internet and electronic network activity information (such as browsing history, clickstream data, and advertisement interactions);

• Commercial information (such as purchase history and product interests);

• Inferences (such as consumer-profile information reflecting preferences and interests); and

• Geolocation data (such as approximate location derived from IP address).

Opt-Out Right. Consumers have the right to opt out of the sale and sharing of their personal information. For instructions on how to exercise this right, please see Section 7.5 of this Privacy Policy.

Consumers Under Age 16. Cascade does not knowingly sell or share the personal information of consumers under the age of 16. Where Cascade has actual knowledge that a consumer is between the ages of 13 and 16, Cascade will not sell or share the consumer's personal information unless the consumer has affirmatively opted in. Where Cascade has actual knowledge that a consumer is under the age of 13, Cascade will not sell or share the consumer's personal information unless the consumer's parent or guardian has affirmatively opted in.

5.3 Sensitive Personal Information

Cascade processes sensitive personal information — including precise geolocation data, payment-card data, and account login credentials — for the purposes of providing the services requested by the consumer. Specifically:

• Payment-card data is processed solely for the purpose of processing and authorizing transactions requested by the consumer;

• Precise geolocation data is processed to provide location-based features and services requested by the consumer through the Cascade mobile application, such as store-locator functionality, local product availability, and location-based promotions; and

• Account login credentials are processed solely for the purpose of authenticating the consumer's identity and providing access to the consumer's Cascade account.

Under CCPA/CPRA § 1798.121 and analogous provisions of other applicable state privacy statutes, consumers have the right to limit the use and disclosure of their sensitive personal information to uses that are necessary for Cascade to provide the services requested by the consumer. Cascade will not use sensitive personal information for purposes beyond those disclosed in this Privacy Policy without first obtaining the consumer's opt-in consent.

Cascade is currently implementing a separate opt-in consent flow for the collection of precise geolocation data via the Cascade mobile application. This consent flow will prompt consumers to affirmatively consent to the collection of precise geolocation data prior to the activation of GPS-based location services within the application.

6. Data Retention

Cascade retains personal information for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, and as required or permitted by applicable law.

Cascade is implementing a comprehensive Data Retention & Disposal Schedule, which is expected to become effective in October 2025. The Data Retention & Disposal Schedule will establish specific retention periods for each category of personal information collected by Cascade and its subsidiaries. Cascade acknowledges that, prior to the implementation of this program, no documented data-retention schedule existed for certain categories of data, including customer-transaction data and loyalty-program data. This gap has been identified and is now being remediated as part of Cascade's broader privacy-compliance program.

The following general retention principles will govern Cascade's data-retention practices:

• Customer-transaction data: Transaction records, purchase history, and related commercial information will be retained for a period to be finalized in the Data Retention & Disposal Schedule, measured from the date of the applicable transaction. This period will be established to balance operational needs, consumer expectations, and legal requirements, including applicable statutes of limitations and tax-record-retention obligations;

• Cascade Rewards loyalty data: Loyalty-program records, including points accrual and redemption history, tier-status records, and stored-value card data, will be retained for the duration of the consumer's membership in the Cascade Rewards program, plus an additional period to be specified in the Data Retention & Disposal Schedule;

• Marketing and advertising data: Data used for marketing and advertising purposes, including email-marketing records, SMS opt-in records, and advertising-targeting data, will be retained for a period to be specified in the Data Retention & Disposal Schedule, unless the consumer opts out of marketing communications or the sale or sharing of personal information, in which case the data will be promptly suppressed or deleted as applicable;

• Website analytics data and cookies: Retention periods for analytics data and cookies vary by cookie category and are described in the Cookie & Tracking-Technology Notice; and

• Employee and applicant data: Retention of employee and job-applicant data is governed by the Employee & Job-Applicant Privacy Notice and is outside the scope of this Privacy Policy.

Disposal Methods. Upon the expiration of the applicable retention period, personal information will be securely deleted or anonymized (i.e., rendered permanently unidentifiable) in accordance with Cascade's internal data-disposal policy. Disposal methods will include secure electronic deletion using industry-standard techniques and, where applicable, secure physical destruction of media containing personal information.

Legal-Hold Exceptions. Notwithstanding the foregoing retention periods, personal information that is subject to a litigation hold, regulatory-inquiry preservation obligation, or other legal-hold directive will be retained until the applicable hold is lifted, regardless of whether the standard retention period has expired.

7. Your Privacy Rights

Cascade respects and supports the privacy rights of consumers under applicable U.S. state privacy statutes. This Section 7 describes the privacy rights available to consumers and how to exercise those rights. Because Cascade operates in 31 U.S. states and is subject to 19 state privacy statutes, the specific rights available to a consumer may vary depending on the consumer's state of residence.

7.1 Overview of Consumer Rights Across Applicable States

The following table provides a high-level overview of the privacy rights available under the applicable state privacy statutes. This table is intended for general informational purposes only; consumers should consult the State-Specific Consumer Rights Supplement for a detailed, state-by-state description of rights, including any state-specific variations, exceptions, and requirements.

Note: "" indicates the right is available under the applicable state statute; "—" indicates the right is not available or not applicable under that statute; "Varies" indicates the availability depends on the specific provisions of additional statutes effective or enacted through 2025–2026. This table is a summary and may not reflect all nuances of each statute.

7.2 Right to Know / Access

Consumers have the right to request that Cascade disclose the following information about the personal information it has collected about the consumer:

• The categories of personal information collected;

• The specific pieces of personal information collected;

• The categories of sources from which the personal information was collected;

• The business or commercial purposes for which the personal information was collected, sold, or shared; and

• The categories of third parties to whom the personal information was disclosed, sold, or shared.

This right is available under the CCPA/CPRA, the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, and most of the other applicable state privacy statutes identified in this Privacy Policy. To submit a request to know or access your personal information, please follow the instructions in Section 8.

7.3 Right to Delete

Consumers have the right to request that Cascade delete the personal information it has collected about the consumer. Upon receiving a verified deletion request, Cascade will delete the consumer's personal information from its records and direct its service providers and contractors to do the same, unless an exception under applicable law applies.

Exceptions to the right to delete may include, among other circumstances, situations where retention of the personal information is necessary to: complete a transaction requested by the consumer; detect or prevent fraud or security incidents; comply with a legal obligation; exercise or defend legal claims; or for other purposes permitted under applicable law.

The right to delete is available under all nineteen (19) applicable state privacy statutes, though the specific exceptions and conditions may vary by state. To submit a request to delete your personal information, please follow the instructions in Section 8.

7.4 Right to Correct

Consumers have the right to request that Cascade correct inaccurate personal information that Cascade maintains about the consumer. Upon receiving a verified correction request, Cascade will use commercially reasonable efforts to correct the inaccurate personal information, taking into account the nature of the personal information and the purposes for which it is processed.

This right is available under the CCPA/CPRA, the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, and most other applicable state privacy statutes. To submit a request to correct your personal information, please follow the instructions in Section 8.

7.5 Right to Opt Out of Sale or Sharing of Personal Information

Consumers have the right to opt out of the "sale" or "sharing" of their personal information, as those terms are defined under the CCPA/CPRA and analogous state statutes. As described in Section 5.2, certain of Cascade's data disclosures to third-party advertising and analytics partners may constitute a sale or sharing of personal information.

Consumers may exercise their right to opt out of the sale or sharing of personal information through the following methods:

• "Do Not Sell or Share My Personal Information" link: Consumers may click the "Do Not Sell or Share My Personal Information" link, which is prominently displayed in the footer of cascade.com and in the settings menu of the Cascade mobile application;

DRAFT — Prepared by Calderwood & Harkness LLP (Sara Hendricks, Associate; reviewed by Alan Burke, Senior Associate, and Kevin Ostrowski, Partner, Privacy & Data Security) — Attorney-Client Privileged Work Product — Draft for Client Review — Matter No. 1038-00010
CASCADE RETAIL HOLDINGS INC.
PRIVACY POLICY
Effective Date: September 12, 2025
This Privacy Policy replaces our prior privacy policy, last updated March 2022.
Applicability. This Privacy Policy applies to personal information collected through cascade.com, the Cascade mobile application (available on iOS and Android), in-store interactions at all 186 Cascade retail locations across 31 U.S. states, and the Cascade Digital Marketplace located at cascade.com/marketplace. This Privacy Policy is intended to provide a comprehensive description of Cascade's data-collection and data-use practices across all of these consumer-facing channels and touchpoints.
Right-click to update Table of Contents
1. Introduction and Scope
Cascade Retail Holdings Inc. ("Cascade," "we," "us," or "our") is a Delaware corporation headquartered at 4100 Elliott Avenue West, Suite 1200, Seattle, Washington 98119, and publicly traded on the Nasdaq Stock Market under the ticker symbol CSRD. Cascade is the data controller responsible for the personal information described in this Privacy Policy. The executive sponsor of Cascade's privacy program is Chief Executive Officer Thomas R. Cavanaugh.
This Privacy Policy describes how Cascade and its subsidiaries collect, use, disclose, retain, and protect personal information ("PI") about consumers who interact with us through our website at cascade.com, our mobile application, our 186 physical retail locations across 31 U.S. states, and the Cascade Digital Marketplace at cascade.com/marketplace. For purposes of this Privacy Policy, "personal information" has the broadest meaning given to that term (or to substantially similar terms such as "personal data") under applicable U.S. state privacy statutes.
This Privacy Policy covers the data practices of Cascade and each of its wholly-owned subsidiaries, which include:
•  Cascade Digital Marketplace LLC ("CDM") — the operator of Cascade's third-party seller marketplace at cascade.com/marketplace, which hosts approximately 3,800 independent sellers;
•  Ridgeline Fulfillment Services Inc. — Cascade's warehousing, logistics, and order-fulfillment subsidiary;
•  Peakview Analytics Inc. — Cascade's advertising-technology and customer-analytics subsidiary, which processes consumer data in connection with targeted advertising, personalization, and measurement; and
•  Cascade Rewards Corp. — the operator of the Cascade Rewards loyalty program and stored-value card programs.
References to "Cascade" throughout this Privacy Policy include all of the above subsidiaries unless otherwise specified.
This Privacy Policy applies to all U.S. consumers who interact with Cascade through any of the channels identified above. We have designed this Privacy Policy to comply with the requirements of nineteen (19) applicable U.S. state privacy statutes, including but not limited to the following:
In addition to this Privacy Policy, certain supplemental notices may apply to specific products, services, or categories of consumers. These supplemental notices are incorporated by reference and should be read in conjunction with this Privacy Policy:
•  California-Specific Privacy Disclosures Addendum — additional disclosures required under the CCPA/CPRA for California residents;
•  State-Specific Consumer Rights Supplement — a detailed, state-by-state description of consumer privacy rights under each of the 19 applicable state statutes;
•  Cookie & Tracking-Technology Notice — a comprehensive description of the cookies and tracking technologies deployed on cascade.com and the Cascade mobile app, including opt-out and opt-in mechanisms; and
•  Cascade Rewards Loyalty-Program Privacy Notice — a notice describing the data practices specific to the Cascade Rewards loyalty program, including financial-incentive disclosures required under the CCPA/CPRA.
We encourage all consumers to read this Privacy Policy in its entirety. If you have questions about our privacy practices or your rights under applicable law, please contact us using the methods described in Section 16 below.
2. Categories of Personal Information We Collect
Cascade collects personal information from and about consumers in connection with our website, mobile application, physical retail locations, and the Cascade Digital Marketplace. The categories of personal information we collect are described below.
2.1 Identifiers.  We collect personal identifiers that allow us to identify, contact, or communicate with consumers. These identifiers include:
•  Full name (first and last);
•  Email address;
•  Postal address (including billing and shipping addresses);
•  Phone number (including mobile and landline);
•  Account username;
•  Cascade Rewards membership ID;
•  Internet Protocol (IP) address;
•  Device identifiers (including mobile advertising identifiers, hardware identifiers, and unique device tokens);
•  Cookie identifiers; and
•  Advertising identifiers (including identifiers assigned by advertising networks and demand-side platforms).
These identifiers are collected when consumers create accounts, make purchases, enroll in the Cascade Rewards loyalty program, contact customer service, or interact with our website and mobile application.
2.2 Commercial Information
We collect records of commercial transactions and related activity, including:
•  Purchase and transaction history, encompassing both online and in-store transactions (Cascade processes approximately 94 million online transactions annually across cascade.com and the Cascade Digital Marketplace);
•  Products or services purchased, returned, exchanged, or considered;
•  Return and exchange records, including reason codes and refund amounts;
•  Shopping-cart contents and saved items;
•  Wishlist contents and product-interest data;
•  Cascade Rewards loyalty-program activity, including points earned, points redeemed, tier status, and stored-value card balances (the Cascade Rewards program currently has approximately 41.2 million registered members); and
•  Payment method information associated with transactions (see also Section 2.5 regarding sensitive payment-card data).
2.3 Internet and Electronic Network Activity
We collect information about consumers' interactions with our website, mobile application, and digital advertisements, including:
•  Browsing history on cascade.com and the Cascade mobile application;
•  Search history and search queries entered on cascade.com;
•  Interaction with advertisements served by or on behalf of Cascade, including impressions, clicks, and conversions;
•  Clickstream data, including the sequence of pages visited and actions taken during a browsing session;
•  Referral URLs (i.e., the website or application from which a consumer navigated to cascade.com);
•  Session duration, page-view counts, and time spent on individual pages;
•  Information about the consumer's browser type, operating system, screen resolution, and language preferences; and
•  Data processed by Peakview Analytics Inc. in connection with advertising targeting, personalization, and campaign measurement — Peakview Analytics processes approximately 2.1 billion consumer-event data records per month for these purposes.
Cascade deploys twelve (12) categories of cookies and tracking technologies on cascade.com and within the Cascade mobile application. These categories are described in detail in our separate Cookie & Tracking-Technology Notice, which is available at cascade.com/cookie-notice. A summary of our cookie practices is provided in Section 9 of this Privacy Policy.
2.4 Geolocation Data
We collect the following categories of geolocation data:
•  Precise geolocation data collected through the Cascade mobile application, derived from GPS-based latitude and longitude coordinates. Precise geolocation data is collected only when the consumer has enabled location services for the Cascade mobile application on their device. This data is used to provide location-based services, such as store-locator functionality, local product availability, and location-based promotions; and
•  Approximate geolocation data inferred from the consumer's IP address, which may be used to identify the consumer's general geographic region (e.g., city, state, or ZIP code) for purposes of content localization, fraud prevention, and analytics.
As described in Section 2.5, precise geolocation data is classified as sensitive personal information under the CCPA/CPRA and certain other state privacy statutes.
2.5 Sensitive Personal Information
Cascade collects categories of personal information that are classified as "sensitive personal information" or "sensitive data" under the CCPA/CPRA and other applicable state privacy statutes. These categories include:
•  Payment-card data: Credit-card and debit-card numbers, expiration dates, and security codes (CVV/CVC), collected in connection with purchases on cascade.com, in the Cascade mobile application, and at physical retail locations. Payment-card data is processed in accordance with the Payment Card Industry Data Security Standard (PCI DSS);
•  Precise geolocation data: GPS-derived latitude and longitude coordinates collected through the Cascade mobile application, as described in Section 2.4 above; and
•  Account login credentials: The combination of a consumer's account username or email address with the consumer's password or answers to security questions, used to authenticate the consumer's identity and provide access to the consumer's Cascade account.
Cascade processes sensitive personal information solely for the purposes of providing the services requested by the consumer. Consumers have the right to limit the use and disclosure of their sensitive personal information, as described in Section 7.7 of this Privacy Policy.
2.6 Inferences.  Cascade draws inferences from the personal information described in this Privacy Policy to create consumer profiles. These inferences may reflect a consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. Inferences are derived from information across multiple categories, including identifiers, commercial information, internet and network activity data, geolocation data, and other information collected by Cascade and its subsidiaries, including Peakview Analytics Inc. Inferences are used for purposes including advertising targeting, personalization, product recommendations, and customer segmentation.
2.7 Audio, Electronic, Visual, or Similar Information
Cascade collects the following types of audio, electronic, visual, or similar information:
•  Call recordings: Customer-service calls may be recorded for quality-assurance, training, dispute-resolution, and compliance purposes. At the beginning of each call, consumers are informed that the call may be recorded; and
•  In-store security camera footage: Cascade operates security cameras at its 186 physical retail locations for the purposes of loss prevention, safety, and security. Security camera footage may capture images of consumers who visit our stores.
2.8 Professional or Employment-Related Information
In limited circumstances, Cascade collects professional or employment-related information from individuals who operate third-party seller accounts on the Cascade Digital Marketplace LLC. This information may include the individual's business name, business address, business tax identification number, and related professional information necessary for the operation of a marketplace seller account. Approximately 3,800 third-party sellers currently operate on the Cascade Digital Marketplace. A separate Third-Party Marketplace Seller Privacy Notice applies to marketplace sellers and provides additional detail regarding the collection and use of seller information.
Note: Personal information of Cascade employees and job applicants is not covered by this Privacy Policy. Employee and job-applicant data are governed by a separate Employee & Job-Applicant Privacy Notice, which is provided to employees and applicants directly.
3. Sources of Personal Information
Cascade collects personal information from the following categories of sources:
3.1 Directly from Consumers
We collect personal information directly from consumers when they interact with us, including through the following activities:
•  Creating a Cascade account on cascade.com or the Cascade mobile application;
•  Making purchases online through cascade.com, the Cascade Digital Marketplace, or the Cascade mobile application, or in-store at any of our 186 physical retail locations;
•  Enrolling in the Cascade Rewards loyalty program;
•  Contacting Cascade's customer-service team by phone, email, live chat, or in person;
•  Entering contests, sweepstakes, or promotions offered by or on behalf of Cascade;
•  Submitting product reviews or ratings on cascade.com;
•  Responding to surveys or feedback requests; and
•  Submitting inquiries or requests through cascade.com or the Cascade mobile application, including consumer-rights requests as described in Section 8.
3.2 Automatically via Technology
We collect personal information automatically when consumers interact with our website, mobile application, and digital services. The technologies we use for automatic data collection include:
•  Cookies: Cascade deploys twelve (12) categories of cookies on cascade.com, ranging from strictly necessary cookies to advertising and targeting cookies. Our cookie practices are described in detail in our Cookie & Tracking-Technology Notice;
•  Pixels and web beacons: Small graphic files or code snippets embedded in web pages and emails that track page views, email opens, and other consumer interactions;
•  Software development kits (SDKs): Third-party and proprietary SDKs integrated into the Cascade mobile application that collect data regarding app usage, device characteristics, and other technical information;
•  Server logs: Cascade's web and application servers automatically record information about each request, including IP address, browser type, referring URL, date and time of access, and pages viewed; and
•  Consent-management platform: Cascade's cookie consent-management platform, which is operated by OnPoint Data Solutions Inc., collects and records consumer cookie preferences and consent choices.
3.3 From Third Parties
We receive personal information about consumers from third-party sources, including:
•  Advertising and analytics partners: Cascade receives consumer data from forty-seven (47) third-party advertising and analytics partners, as identified in the data-mapping report prepared by Fieldhaven Consulting Group LLC and dated May 19, 2025. These partners provide data used for advertising targeting, campaign measurement, audience modeling, and analytics;
•  Third-party marketplace sellers: Sellers on the Cascade Digital Marketplace LLC may provide data about consumers in connection with order processing, fulfillment, and customer-service interactions;
•  Data brokers and aggregators: Cascade receives data from third-party data brokers and aggregators for purposes of identity verification, fraud prevention, and risk assessment;
•  Social media platforms: When consumers connect their social media accounts (such as Kestrel Services Inc., Northpoint Services Inc., or Severin Industries) to their Cascade accounts or use social login functionality, Cascade may receive profile information from the applicable social media platform in accordance with the consumer's privacy settings on that platform; and
•  Payment processors and financial institutions: Cascade receives transaction-related data from payment processors and financial institutions in connection with payment authorization, settlement, and fraud prevention.
4. Purposes of Processing / Use of Personal Information
Cascade collects, uses, and processes personal information for the purposes described below. We will not collect additional categories of personal information or use the personal information we have collected for materially different, unrelated, or incompatible purposes without providing consumers with notice.
4.1 Business and Operational Purposes
Cascade uses personal information for the following business and operational purposes:
•  Order processing and fulfillment: Processing, fulfilling, and managing consumer orders placed on cascade.com, the Cascade Digital Marketplace, the Cascade mobile application, and at our 186 physical retail locations, including processing payments, shipping products, and facilitating returns and exchanges;
•  Cascade Rewards loyalty program: Managing and operating the Cascade Rewards loyalty program, including enrollment, points accrual, points redemption, tier-status management, stored-value card issuance and management, and program communications. The Cascade Rewards program constitutes a "financial incentive" program under CCPA § 1798.125. Additional details regarding the program's data practices are provided in the separate Cascade Rewards Loyalty-Program Privacy Notice;
•  Website, application, and retail operations: Operating, maintaining, and improving cascade.com, the Cascade mobile application, and our physical retail locations, including product display, inventory management, and customer experience optimization;
•  Cascade Digital Marketplace operations: Operating and administering the Cascade Digital Marketplace (CDM), including managing seller accounts, facilitating transactions between consumers and third-party sellers, and resolving disputes;
•  Warehousing, shipping, and fulfillment: Providing warehousing, logistics, and fulfillment services through Ridgeline Fulfillment Services Inc., including order picking, packing, shipping, delivery tracking, and returns processing;
•  Customer service and support: Providing customer-service and technical-support assistance, including responding to inquiries, resolving complaints, processing refunds and credits, and managing consumer accounts; and
•  Fraud prevention, security, and legal compliance: Detecting, preventing, and investigating fraud, unauthorized transactions, and other illegal or suspicious activities; protecting the security and integrity of our systems and networks; and complying with applicable laws, regulations, and legal obligations.
4.2 Advertising, Marketing, and Personalization
Cascade uses personal information for the following advertising, marketing, and personalization purposes:
•  Targeted and programmatic advertising: Delivering targeted and programmatic advertisements to consumers across digital channels, including display advertising, search advertising, social media advertising, and connected-television advertising. Targeted advertising activities are conducted in part by and through Peakview Analytics Inc., Cascade's advertising-technology subsidiary;
•  Cross-context behavioral advertising: Using personal information collected across different websites, applications, and services to deliver advertisements that are targeted based on the consumer's behavior across multiple contexts. Certain of these activities may constitute the "sharing" of personal information for cross-context behavioral advertising under the CCPA/CPRA and analogous state statutes;
•  Email, SMS, and push-notification marketing: Sending marketing communications to consumers via email, short message service (SMS) text messages, and push notifications through the Cascade mobile application, in accordance with applicable laws regarding electronic marketing communications;
•  Personalization: Personalizing the content, product recommendations, promotions, and offers presented to consumers on cascade.com, the Cascade mobile application, and in marketing communications, based on the consumer's purchase history, browsing behavior, preferences, and inferred interests; and
•  Measurement and attribution: Measuring the effectiveness of advertising campaigns and marketing activities, including impression and click-through tracking, conversion attribution, audience reach analysis, and return-on-advertising-spend calculations.
4.3 Analytics and Research
Cascade uses personal information for the following analytics and research purposes:
•  Data analytics and business intelligence: Performing data analytics to understand consumer behavior, identify trends, and generate business intelligence used to inform strategic and operational decisions;
•  Consumer trend analysis: Analyzing consumer purchasing patterns, browsing behavior, and demographic information to identify market trends and consumer preferences; and
•  Product development research: Using consumer feedback, product-review data, purchase data, and behavioral data to inform product development, merchandising decisions, and service improvements.
4.4 Legal, Compliance, and Safety
Cascade uses personal information for the following legal, compliance, and safety purposes:
•  Compliance with applicable laws: Complying with applicable federal, state, and local laws, regulations, and ordinances, including the nineteen (19) U.S. state privacy statutes identified in Section 1 of this Privacy Policy, as well as consumer-protection laws, tax laws, and other regulatory requirements;
•  Responding to legal process and governmental inquiries: Responding to subpoenas, court orders, search warrants, regulatory inquiries, and other lawful requests from courts, law-enforcement agencies, and governmental authorities;
•  Protecting rights, safety, and property: Protecting the rights, safety, and property of Cascade, its customers, employees, third-party sellers, and other third parties, including enforcing our terms of service, acceptable-use policies, and contractual obligations; and
•  Establishing, exercising, or defending legal claims: Using personal information as necessary to establish, exercise, or defend legal claims, including in connection with litigation, arbitration, and regulatory proceedings.
5. Disclosure and Sharing of Personal Information
Cascade discloses and shares personal information with the categories of recipients described below, for the purposes identified in Section 4 of this Privacy Policy.
5.1 Categories of Recipients
Service Providers. Cascade discloses personal information to vendors and service providers that process personal information on Cascade's behalf, under written contractual agreements that restrict the vendor's use, retention, and disclosure of the information. These vendors are classified as "service providers" under the CCPA/CPRA and as "processors" under other applicable state privacy statutes. All service-provider relationships are governed by Cascade's Master Data Processing Agreement template, which includes provisions addressing data-use limitations, confidentiality, data security, subprocessor management, audit rights, and data-deletion or -return obligations upon termination. Service providers perform functions such as payment processing, cloud hosting, email delivery, customer-service support, and data analytics.
Contractors. Cascade discloses personal information to certain vendors that qualify as "contractors" under the CCPA (California Civil Code § 1798.140(j)). These vendors are subject to heightened contractual restrictions, including prohibitions on selling or sharing the personal information received from Cascade, prohibitions on retaining, using, or disclosing the personal information outside the direct business relationship with Cascade, and prohibitions on combining personal information received from Cascade with personal information obtained from other sources or collected from the contractor's own interactions with consumers, except as expressly permitted by the CCPA/CPRA.
Third Parties — Advertising and Analytics Partners. Cascade shares consumer personal information with forty-seven (47) third-party advertising and analytics partners for purposes of targeted advertising, cross-context behavioral advertising, campaign measurement, audience modeling, and analytics. As of the date of this Privacy Policy, twenty-three (23) of these forty-seven partners are in the process of executing data-processing agreements with Cascade that are designed to comply with applicable state privacy statutes; the remaining twenty-four (24) partners have already executed such agreements or are subject to existing contractual arrangements that are being reviewed for compliance.
Cascade specifically identifies the following partner: Thornbridge Media Corp., which serves as Cascade's primary programmatic-advertising and audience-targeting partner. Cascade's fiscal year 2024 advertising spend with Thornbridge Media Corp. totaled approximately $18.4 million. The data-sharing arrangement between Cascade and Thornbridge Media Corp. is governed by a restructured Data-Sharing Agreement that was negotiated to address state privacy-law requirements, including provisions for opt-out signal processing, data-use restrictions, and data-retention limitations.
Affiliates and Subsidiaries. Cascade shares personal information among its affiliates and wholly-owned subsidiaries, including Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. Personal information shared among affiliates and subsidiaries is used for the purposes described in this Privacy Policy and is subject to the same protections.
Third-Party Marketplace Sellers. When consumers purchase products from third-party sellers on the Cascade Digital Marketplace, limited personal information — such as the consumer's name, shipping address, and order information — is shared with the applicable seller for the purpose of order fulfillment. Approximately 3,800 third-party sellers currently operate on the Cascade Digital Marketplace. Sellers' access to and use of consumer personal information is governed by the Marketplace Seller Data-Use Terms, as further described in Section 13 of this Privacy Policy.
Government and Law Enforcement. Cascade may disclose personal information to governmental authorities, law-enforcement agencies, courts, and regulatory bodies as required by law, in response to lawful legal process (such as subpoenas, court orders, or search warrants), or in connection with regulatory inquiries and investigations.
Professional Advisors. Cascade discloses personal information to its professional advisors as necessary for the provision of legal, auditing, insurance, and consulting services. Cascade's professional advisors include:
•  Outside counsel: Calderwood & Harkness LLP and Whitfield Greaves LLP;
•  Independent auditors: Lakemont Audit Partners LLP;
•  Insurance brokers and carriers: Ridgepoint Insurance Brokers Inc. and Northcastle Indemnity Company; and
•  Consultants: Fieldhaven Consulting Group LLC.
All professional advisors are subject to confidentiality obligations.
Business Transaction Counterparties. Cascade may disclose personal information to third parties in connection with a proposed or actual merger, acquisition, divestiture, restructuring, reorganization, dissolution, asset sale, or other business transaction involving all or a portion of Cascade's assets, where personal information is among the assets being transferred. In such circumstances, Cascade will require the acquiring entity to comply with the terms of this Privacy Policy or to provide consumers with notice and, where required, the opportunity to exercise their rights under applicable law.
5.2 Sale and Sharing of Personal Information
Under the CCPA/CPRA and analogous provisions of other state privacy statutes, certain disclosures of consumer personal information to third-party advertising and analytics partners may constitute a "sale" of personal information (i.e., a disclosure of personal information for monetary or other valuable consideration) or the "sharing" of personal information (i.e., a disclosure of personal information for cross-context behavioral advertising purposes), even where Cascade does not receive direct monetary payment for the information.
Cascade has determined that its data disclosures to certain advertising and analytics partners may constitute a "sale" or "sharing" under applicable state privacy statutes. The categories of personal information that may be sold or shared include the following:
•  Identifiers (such as cookie IDs, device identifiers, advertising IDs, and IP addresses);
•  Internet and electronic network activity information (such as browsing history, clickstream data, and advertisement interactions);
•  Commercial information (such as purchase history and product interests);
•  Inferences (such as consumer-profile information reflecting preferences and interests); and
•  Geolocation data (such as approximate location derived from IP address).
Opt-Out Right. Consumers have the right to opt out of the sale and sharing of their personal information. For instructions on how to exercise this right, please see Section 7.5 of this Privacy Policy.
Consumers Under Age 16. Cascade does not knowingly sell or share the personal information of consumers under the age of 16. Where Cascade has actual knowledge that a consumer is between the ages of 13 and 16, Cascade will not sell or share the consumer's personal information unless the consumer has affirmatively opted in. Where Cascade has actual knowledge that a consumer is under the age of 13, Cascade will not sell or share the consumer's personal information unless the consumer's parent or guardian has affirmatively opted in.
5.3 Sensitive Personal Information
Cascade processes sensitive personal information — including precise geolocation data, payment-card data, and account login credentials — for the purposes of providing the services requested by the consumer. Specifically:
•  Payment-card data is processed solely for the purpose of processing and authorizing transactions requested by the consumer;
•  Precise geolocation data is processed to provide location-based features and services requested by the consumer through the Cascade mobile application, such as store-locator functionality, local product availability, and location-based promotions; and
•  Account login credentials are processed solely for the purpose of authenticating the consumer's identity and providing access to the consumer's Cascade account.
Under CCPA/CPRA § 1798.121 and analogous provisions of other applicable state privacy statutes, consumers have the right to limit the use and disclosure of their sensitive personal information to uses that are necessary for Cascade to provide the services requested by the consumer. Cascade will not use sensitive personal information for purposes beyond those disclosed in this Privacy Policy without first obtaining the consumer's opt-in consent.
Cascade is currently implementing a separate opt-in consent flow for the collection of precise geolocation data via the Cascade mobile application. This consent flow will prompt consumers to affirmatively consent to the collection of precise geolocation data prior to the activation of GPS-based location services within the application.
6. Data Retention
Cascade retains personal information for as long as necessary to fulfill the purposes for which it was collected, as described in this Privacy Policy, and as required or permitted by applicable law.
Cascade is implementing a comprehensive Data Retention & Disposal Schedule, which is expected to become effective in October 2025. The Data Retention & Disposal Schedule will establish specific retention periods for each category of personal information collected by Cascade and its subsidiaries. Cascade acknowledges that, prior to the implementation of this program, no documented data-retention schedule existed for certain categories of data, including customer-transaction data and loyalty-program data. This gap has been identified and is now being remediated as part of Cascade's broader privacy-compliance program.
The following general retention principles will govern Cascade's data-retention practices:
•  Customer-transaction data: Transaction records, purchase history, and related commercial information will be retained for a period to be finalized in the Data Retention & Disposal Schedule, measured from the date of the applicable transaction. This period will be established to balance operational needs, consumer expectations, and legal requirements, including applicable statutes of limitations and tax-record-retention obligations;
•  Cascade Rewards loyalty data: Loyalty-program records, including points accrual and redemption history, tier-status records, and stored-value card data, will be retained for the duration of the consumer's membership in the Cascade Rewards program, plus an additional period to be specified in the Data Retention & Disposal Schedule;
•  Marketing and advertising data: Data used for marketing and advertising purposes, including email-marketing records, SMS opt-in records, and advertising-targeting data, will be retained for a period to be specified in the Data Retention & Disposal Schedule, unless the consumer opts out of marketing communications or the sale or sharing of personal information, in which case the data will be promptly suppressed or deleted as applicable;
•  Website analytics data and cookies: Retention periods for analytics data and cookies vary by cookie category and are described in the Cookie & Tracking-Technology Notice; and
•  Employee and applicant data: Retention of employee and job-applicant data is governed by the Employee & Job-Applicant Privacy Notice and is outside the scope of this Privacy Policy.
Disposal Methods. Upon the expiration of the applicable retention period, personal information will be securely deleted or anonymized (i.e., rendered permanently unidentifiable) in accordance with Cascade's internal data-disposal policy. Disposal methods will include secure electronic deletion using industry-standard techniques and, where applicable, secure physical destruction of media containing personal information.
Legal-Hold Exceptions. Notwithstanding the foregoing retention periods, personal information that is subject to a litigation hold, regulatory-inquiry preservation obligation, or other legal-hold directive will be retained until the applicable hold is lifted, regardless of whether the standard retention period has expired.
7. Your Privacy Rights
Cascade respects and supports the privacy rights of consumers under applicable U.S. state privacy statutes. This Section 7 describes the privacy rights available to consumers and how to exercise those rights. Because Cascade operates in 31 U.S. states and is subject to 19 state privacy statutes, the specific rights available to a consumer may vary depending on the consumer's state of residence.
7.1 Overview of Consumer Rights Across Applicable States
The following table provides a high-level overview of the privacy rights available under the applicable state privacy statutes. This table is intended for general informational purposes only; consumers should consult the State-Specific Consumer Rights Supplement for a detailed, state-by-state description of rights, including any state-specific variations, exceptions, and requirements.
Note: "" indicates the right is available under the applicable state statute; "—" indicates the right is not available or not applicable under that statute; "Varies" indicates the availability depends on the specific provisions of additional statutes effective or enacted through 2025–2026. This table is a summary and may not reflect all nuances of each statute.
7.2 Right to Know / Access
Consumers have the right to request that Cascade disclose the following information about the personal information it has collected about the consumer:
•  The categories of personal information collected;
•  The specific pieces of personal information collected;
•  The categories of sources from which the personal information was collected;
•  The business or commercial purposes for which the personal information was collected, sold, or shared; and
•  The categories of third parties to whom the personal information was disclosed, sold, or shared.
This right is available under the CCPA/CPRA, the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, and most of the other applicable state privacy statutes identified in this Privacy Policy. To submit a request to know or access your personal information, please follow the instructions in Section 8.
7.3 Right to Delete
Consumers have the right to request that Cascade delete the personal information it has collected about the consumer. Upon receiving a verified deletion request, Cascade will delete the consumer's personal information from its records and direct its service providers and contractors to do the same, unless an exception under applicable law applies.
Exceptions to the right to delete may include, among other circumstances, situations where retention of the personal information is necessary to: complete a transaction requested by the consumer; detect or prevent fraud or security incidents; comply with a legal obligation; exercise or defend legal claims; or for other purposes permitted under applicable law.
The right to delete is available under all nineteen (19) applicable state privacy statutes, though the specific exceptions and conditions may vary by state. To submit a request to delete your personal information, please follow the instructions in Section 8.
7.4 Right to Correct
Consumers have the right to request that Cascade correct inaccurate personal information that Cascade maintains about the consumer. Upon receiving a verified correction request, Cascade will use commercially reasonable efforts to correct the inaccurate personal information, taking into account the nature of the personal information and the purposes for which it is processed.
This right is available under the CCPA/CPRA, the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, and most other applicable state privacy statutes. To submit a request to correct your personal information, please follow the instructions in Section 8.
7.5 Right to Opt Out of Sale or Sharing of Personal Information
Consumers have the right to opt out of the "sale" or "sharing" of their personal information, as those terms are defined under the CCPA/CPRA and analogous state statutes. As described in Section 5.2, certain of Cascade's data disclosures to third-party advertising and analytics partners may constitute a sale or sharing of personal information.
Consumers may exercise their right to opt out of the sale or sharing of personal information through the following methods:
•  "Do Not Sell or Share My Personal Information" link: Consumers may click the "Do Not Sell or Share My Personal Information" link, which is prominently displayed in the footer of cascade.com and in the settings menu of the Cascade mobile application;
•  Global Privacy Control (GPC): Cascade honors the Global Privacy Control (GPC) browser signal as a valid opt-out-of-sale/sharing request. When Cascade detects a GPC signal from a consumer's browser, Cascade will treat the signal as a request to opt out of the sale and sharing of the consumer's personal information associated with that browser. This mechanism addresses a prior gap in Cascade's privacy program, where no universal opt-out mechanism was recognized; and
•  Consumer-rights request portal: Consumers may submit an opt-out request through the consumer-rights request portal at cascade.com/privacy-rights.
This right is available under the CCPA/CPRA and analogous opt-out provisions in other state statutes, including the Colorado CPA, the Connecticut CTDPA, the Texas TDPSA, the Oregon OCPA, and others.
7.6 Right to Opt Out of Targeted Advertising and Profiling
In addition to the right to opt out of the sale or sharing of personal information, consumers in certain states have the right to opt out of the processing of their personal information for purposes of targeted advertising and profiling that produces legal or similarly significant effects concerning the consumer.
•  Targeted advertising refers to the display of advertisements to a consumer based on personal information obtained from the consumer's activities across non-affiliated websites, applications, and online services;
•  Profiling refers to any form of automated processing of personal information to evaluate, analyze, or predict personal aspects of a consumer, including the consumer's economic situation, personal preferences, interests, reliability, behavior, location, or movements.
This right is available under the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, and a number of other applicable state statutes. Consumers may exercise these rights through the consumer-rights request portal at cascade.com/privacy-rights, by using the "Do Not Sell or Share My Personal Information" link on cascade.com (which Cascade treats as encompassing opt-out-of-targeted-advertising requests where applicable), or by enabling the GPC browser signal.
7.7 Right to Limit Use and Disclosure of Sensitive Personal Information
Under CCPA/CPRA § 1798.121, California consumers have the right to direct Cascade to limit its use and disclosure of their sensitive personal information to uses that are necessary for Cascade to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
The categories of sensitive personal information collected by Cascade include precise geolocation data, payment-card data, and account login credentials, as described in Section 2.5. Cascade will limit its use of sensitive personal information to purposes that are necessary for providing services and will not use sensitive personal information for purposes beyond those disclosed in this Privacy Policy without first obtaining the consumer's opt-in consent.
Consumers may exercise their right to limit the use and disclosure of sensitive personal information by clicking the "Limit the Use of My Sensitive Personal Information" link, which is available in the footer of cascade.com and in the settings menu of the Cascade mobile application.
7.8 Right to Non-Discrimination
Cascade will not discriminate against any consumer for exercising their privacy rights under this Privacy Policy or under applicable law. Cascade will not deny goods or services to a consumer, charge a consumer different prices or rates for goods or services, provide a consumer with a different level or quality of goods or services, or suggest that a consumer will receive a different price or rate for goods or services or a different level or quality of goods or services, as a result of the consumer's exercise of their privacy rights.
Nothing in this section prohibits Cascade from offering financial incentives, including payments to consumers as compensation, for the collection, sale, sharing, or deletion of personal information, provided that such financial incentives are offered in compliance with applicable law, including CCPA § 1798.125. The Cascade Rewards loyalty program is a financial-incentive program, as further described in Section 12 and in the Cascade Rewards Loyalty-Program Privacy Notice.
7.9 Right to Appeal
Certain state privacy statutes provide consumers with the right to appeal a denial of a consumer-rights request. If Cascade declines to take action on a consumer's request to know, delete, correct, or opt out, Cascade will inform the consumer of the reasons for the denial and provide instructions on how to submit an appeal.
Appeal Process. A consumer may submit an appeal through the consumer-rights request portal at cascade.com/privacy-rights. Upon receipt of an appeal, Cascade will review the appeal and respond within the timeframe required by applicable law (for example, 60 days under the Virginia VCDPA and 45 days under the Colorado CPA). If the appeal is denied, Cascade will provide the consumer with a written explanation of the reasons for the denial, along with instructions on how to contact the applicable state attorney general to submit a complaint.
This right is available under the Virginia VCDPA, the Colorado CPA, the Connecticut CTDPA, and other state statutes that require an appeal process.
7.10 State-Specific Rights
Because the specific privacy rights, exemptions, and procedural requirements vary across the nineteen (19) applicable state privacy statutes, Cascade has prepared a separate State-Specific Consumer Rights Supplement, which provides a detailed, state-by-state description of the privacy rights available to consumers under each statute. The State-Specific Consumer Rights Supplement is available at cascade.com/state-privacy-rights.
Consumers who reside in a specific state are encouraged to consult the State-Specific Consumer Rights Supplement for additional detail regarding the rights available to them, including any state-specific variations in the scope of rights, exemptions, response timeframes, and enforcement mechanisms.
8. How to Exercise Your Rights (Data Subject Requests)
8.1 Submitting a Request
Consumers may submit requests to exercise their privacy rights using any of the following methods:
•  Online: Submit a request through the consumer-rights request portal at cascade.com/privacy-rights;
•  Phone: Call Cascade's toll-free privacy-rights line at the number posted on cascade.com/privacy-rights (toll-free number to be inserted prior to publication);
•  In-Store: Submit a request in person at any of Cascade's 186 retail locations by speaking with a store manager or visiting the customer-service desk; or
•  Email: Send a request to privacy@cascade.com.
When submitting a request, consumers should include sufficient information to allow Cascade to verify the consumer's identity and process the request, including the consumer's full name, email address associated with their Cascade account (if applicable), and a description of the right being exercised.
8.2 Identity Verification
To protect consumers' personal information from unauthorized access, Cascade will verify the identity of consumers who submit requests to know, delete, or correct their personal information. Cascade's identity-verification procedures are designed to comply with the CCPA/CPRA regulations and comparable requirements under other applicable state statutes.
•  Requests to know (categories): Cascade will verify the consumer's identity to a "reasonable degree of certainty" by matching at least two data points provided by the consumer with data points maintained by Cascade;
•  Requests to know (specific pieces) and requests to delete: Cascade will verify the consumer's identity to a "reasonably high degree of certainty" by matching at least three data points provided by the consumer with data points maintained by Cascade, and may require a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request;
•  Requests to correct: Cascade will verify the consumer's identity using the same procedures applicable to requests to know (specific pieces);
•  Requests to opt out: Cascade will not require identity verification for opt-out requests but will use reasonable methods to determine that the request is legitimate.
Authorized Agent Requests. Consumers may designate an authorized agent to submit a request on their behalf. If a request is submitted by an authorized agent, Cascade may require the consumer to verify their own identity directly with Cascade and to confirm that they have authorized the agent to submit the request on their behalf. An authorized agent may also submit proof of a valid power of attorney or other written authorization signed by the consumer.
8.3 Response Time
Cascade will respond to consumer-rights requests within the timeframes required by applicable law. Cascade's target response time for all consumer-rights requests is fifteen (15) business days or less, representing a significant improvement from the prior average response time of twenty-seven (27) calendar days in fiscal year 2024.
Under the CCPA/CPRA, Cascade will confirm receipt of a consumer's request within ten (10) business days and will provide a substantive response within forty-five (45) calendar days of receipt. If Cascade requires additional time to respond, it may extend the response period by an additional forty-five (45) calendar days (for a total of ninety calendar days), provided that Cascade notifies the consumer of the extension within the initial forty-five-day period and explains the reason for the extension.
Other applicable state privacy statutes have their own response timeframes, which are described in the State-Specific Consumer Rights Supplement.
Cascade's consumer-rights requests are processed through Cascade's data-subject-request (DSR) automation workflow. This workflow is being implemented in partnership with Fieldhaven Consulting Group LLC, with a go-live date targeted for December 1, 2025. The DSR automation workflow is designed to improve the accuracy, efficiency, and timeliness of Cascade's response process.
8.4 FY2024 DSR Metrics (CCPA Disclosure)
In accordance with the CCPA/CPRA's transparency requirements, Cascade provides the following metrics regarding data-subject requests received during fiscal year 2024 (FY2024):
Additional detail regarding FY2024 DSR metrics, including the number of requests complied with, denied, and pending, is available in the California-Specific Privacy Disclosures Addendum.
9. Cookies and Tracking Technologies
Cascade uses cookies and other tracking technologies on cascade.com and in the Cascade mobile application to collect information about consumers' interactions with our digital services, to enable certain features and functionality, and to support advertising, analytics, and personalization.
Cascade deploys twelve (12) categories of cookies and tracking technologies across its digital properties. A comprehensive description of each category, including the specific cookies and technologies deployed, their purposes, the data they collect, their retention periods, and the mechanisms available for consumers to manage their preferences (including opt-in and opt-out mechanisms), is provided in the separate Cookie & Tracking-Technology Notice, available at cascade.com/cookie-notice.
Cascade's consent-management platform, provided by OnPoint Data Solutions Inc., allows consumers to view and manage their cookie preferences when they visit cascade.com. The consent-management platform presents consumers with the option to accept or decline non-essential cookies by category and records the consumer's cookie-preference selections.
As described in Section 7.5, Cascade honors the Global Privacy Control (GPC) browser signal as a valid opt-out-of-sale/sharing request. When Cascade detects a GPC signal from a consumer's browser, Cascade will treat the signal as a request to opt out of the sale and sharing of personal information collected through cookies and tracking technologies on that browser.
The major categories of cookies deployed by Cascade include:
•  Strictly Necessary Cookies: Cookies that are essential for the operation of cascade.com and the Cascade mobile application, including session-management cookies, authentication cookies, and security cookies. These cookies cannot be disabled without impairing the functionality of the website or application;
•  Functional / Performance Cookies: Cookies that enhance the functionality and performance of cascade.com, including cookies that remember the consumer's preferences, language settings, and recently viewed products;
•  Analytics Cookies: Cookies that collect information about how consumers use cascade.com, including page views, session duration, and navigation paths. Analytics cookies are used to improve the design and content of Cascade's digital properties; and
•  Advertising / Targeting Cookies: Cookies that are used to deliver targeted advertisements to consumers, to measure the effectiveness of advertising campaigns, and to build consumer profiles for advertising-personalization purposes. These cookies may be placed by Cascade or by third-party advertising partners, and the data collected through these cookies may be shared with third parties, as described in Section 5.
For full details, consumers should review the Cookie & Tracking-Technology Notice at cascade.com/cookie-notice.
10. Children's Privacy
Cascade's website, mobile application, and services are not directed to children under the age of thirteen (13). Cascade does not knowingly collect personal information from children under the age of 13. If Cascade becomes aware that it has collected personal information from a child under the age of 13 without verifiable parental consent, Cascade will take prompt steps to delete that information from its records.
As stated in Section 5.2, Cascade does not knowingly sell or share the personal information of consumers under the age of 16. Where Cascade has actual knowledge that a consumer is between the ages of 13 and 16, Cascade will not sell or share the consumer's personal information unless the consumer has affirmatively authorized the sale or sharing. Where Cascade has actual knowledge that a consumer is under the age of 13, Cascade will not sell or share the consumer's personal information unless the consumer's parent or guardian has provided affirmative authorization.
Cascade is implementing age-gate mechanisms on its e-commerce platform (cascade.com) and the Cascade mobile application. These mechanisms are designed to help Cascade identify users who may be under the age of 16 or 18, as applicable, and to provide age-appropriate experiences and protections in compliance with California's Age-Appropriate Design Code Act (California Civil Code § 1798.99.28 et seq.) and emerging requirements under other state statutes that impose obligations with respect to consumers under the age of 16 or 18.
Parents or guardians who believe that a child's personal information has been collected by Cascade may contact Cascade at privacy@cascade.com to request the deletion of that information.
11. Security of Personal Information
Cascade maintains reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, loss, or destruction. These safeguards include, but are not limited to, encryption of data in transit and at rest, network-security controls, access-control measures, vulnerability-management and penetration-testing programs, and employee training on data-security and privacy practices.
Cascade's information-security program is overseen by Chief Information Security Officer Gregory Farris, who reports to Cascade's senior leadership and works in coordination with the Privacy Office. The security program is designed to align with industry-standard frameworks and best practices for the protection of personal information.
Cascade maintains cyber-liability and privacy-liability insurance coverage underwritten by Northcastle Indemnity Company and brokered by Ridgepoint Insurance Brokers Inc. This coverage is intended to provide financial protection in the event of a data breach or other security incident.
In the event of a security incident involving the unauthorized access, acquisition, or disclosure of personal information, Cascade will comply with all applicable federal and state breach-notification requirements, including providing timely notice to affected consumers and, where required, to state attorneys general, regulatory agencies, and other authorities.
While Cascade takes the security of personal information seriously, no method of transmission over the Internet or method of electronic storage is completely secure. Cascade cannot guarantee the absolute security of personal information transmitted to or stored by Cascade.
12. Financial Incentive / Loyalty Program Notice
Cascade operates the Cascade Rewards loyalty program through its subsidiary Cascade Rewards Corp. The Cascade Rewards program currently has approximately 41.2 million registered members and offers consumers the opportunity to earn points on qualifying purchases, redeem points for discounts and rewards, and receive exclusive promotions and offers.
Under CCPA § 1798.125, the Cascade Rewards program constitutes a "financial incentive" program because it provides consumers with discounts, rewards, and other benefits in exchange for the collection, retention, and use of their personal information.
The material terms of the Cascade Rewards program, including a description of the personal information collected in connection with the program, the purposes for which the information is used, the method by which Cascade calculates the value of the consumer's personal information (or the value of the discount or other benefit provided to the consumer), and the consumer's right to withdraw from the program at any time without penalty, are set forth in the separate Cascade Rewards Loyalty-Program Privacy Notice, available at cascade.com/rewards-privacy.
Consumers may opt in to the Cascade Rewards program by enrolling on cascade.com, the Cascade mobile application, or at any of Cascade's 186 retail locations. Consumers may withdraw from the program at any time by contacting Cascade's customer-service team, by managing their account settings on cascade.com, or by visiting the consumer-rights request portal at cascade.com/privacy-rights.
13. Third-Party Marketplace
Cascade Digital Marketplace LLC ("CDM") operates an online marketplace at cascade.com/marketplace that enables approximately 3,800 third-party sellers to list and sell products to consumers through the Cascade platform.
When a consumer purchases a product from a third-party seller on the Cascade Digital Marketplace, Cascade shares limited personal information with the applicable seller as necessary for order fulfillment. This information may include the consumer's name, shipping address, email address, phone number, and order information (such as the product purchased, quantity, and order number). Cascade does not share payment-card data with third-party sellers; all payment processing is handled by Cascade and its payment-processing service providers.
Third-party sellers on the Cascade Digital Marketplace are governed by the Marketplace Seller Data-Use Terms, which impose the following obligations on sellers with respect to consumer personal information:
•  Data-segregation requirements: Sellers must maintain consumer personal information received from Cascade separately from data collected through other channels or sources;
•  Purpose limitations: Sellers may use consumer personal information received from Cascade only for the purpose of fulfilling orders placed through the Cascade Digital Marketplace and for related customer-service purposes, and may not use the information for their own marketing purposes or share it with other third parties;
•  Security obligations: Sellers must maintain reasonable security measures to protect consumer personal information; and
•  Compliance with applicable law: Sellers must comply with all applicable privacy laws with respect to consumer personal information received from Cascade.
Cascade is currently implementing role-based access controls to ensure that marketplace seller data is no longer commingled with first-party customer data in Cascade's enterprise data lake. This remediation addresses a previously identified compliance gap in which seller-originated transaction data and first-party customer data were stored in the same data e

CASCADE RETAIL HOLDINGS INC.

PRIVACY POLICY

Record

Parties

Dates

Amounts