STATE-SPECIFIC CONSUMER RIGHTS SUPPLEMENT
to the Cascade Retail Holdings Inc. Omnibus Privacy Policy
Effective Date: September 12, 2025
Prepared by: Sara Hendricks, Associate Privacy & Data Security Calderwood & Harkness LLP
Alan Burke, Senior Associate Privacy & Data Security Calderwood & Harkness LLP
Reviewed by: Kevin Ostrowski, Partner Privacy & Data Security Calderwood & Harkness LLP
Client: Cascade Retail Holdings Inc., 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119
Matter Number: 1038-00010
This document is a supplement to the Cascade Retail Holdings Inc. Omnibus Privacy Policy and is intended for public consumer-facing disclosure on cascade.com, the Cascade mobile application, and in-store locations. It does not contain information subject to any confidentiality restriction and is designed for unrestricted distribution to consumers upon publication.
Cross-Reference Notice: This Supplement should be read together with the Cascade Retail Holdings Inc. Omnibus Privacy Policy (effective September 12, 2025) and the California-Specific Privacy Disclosures Addendum (effective September 12, 2025). California consumer rights are addressed exclusively in the California-Specific Privacy Disclosures Addendum and are not duplicated in this Supplement. To the extent any provision of this Supplement conflicts with the Omnibus Privacy Policy, the more consumer-protective provision shall control.
Right-click to update Table of Contents
Section 1: Introduction and Purpose
Cascade Retail Holdings Inc. and its subsidiaries — Cascade Digital Marketplace LLC, Ridgeline Fulfillment Services Inc., Peakview Analytics Inc., and Cascade Rewards Corp. (collectively, "Cascade," "we," "us," or "our") — are committed to protecting the privacy and personal data of consumers across every United States jurisdiction in which we operate. We believe that transparency about our data practices and meaningful respect for consumer rights are essential to maintaining the trust our customers place in us every day.
In addition to the California Consumer Privacy Act, as amended by the California Privacy Rights Act (the "CCPA/CPRA"), which is addressed in a separate California-Specific Privacy Disclosures Addendum, multiple other U.S. states have enacted comprehensive consumer privacy statutes that grant their residents specific rights regarding the collection, use, sale, sharing, and deletion of their personal data. These statutes reflect a growing national consensus that consumers should have meaningful control over their personal information, and Cascade embraces that principle across the entirety of its operations.
This Supplement describes the consumer rights provided under each of the eighteen (18) non-California state privacy statutes that are currently applicable to Cascade's operations, for a total of nineteen (19) applicable comprehensive state privacy statutes when California is included. The rights, obligations, and procedures described in this Supplement are organized on a state-by-state basis so that consumers can easily locate the rights and protections specific to their state of residence.
Cascade currently operates one hundred eighty-six (186) retail locations in thirty-one (31) U.S. states and ships e-commerce orders to all fifty (50) states plus the District of Columbia. The Cascade Rewards loyalty program has approximately 41.2 million registered members across all fifty states. Additionally, cascade.com and the Cascade mobile application serve consumers nationwide, regardless of whether a physical retail location is present in the consumer's state. As a result, Cascade's data-processing activities frequently implicate the privacy statutes of multiple states simultaneously, and we have designed our compliance program to address each statute's requirements comprehensively.
Where state law provides for an appeal process for denied consumer-rights requests, Cascade has established a uniform appeal mechanism that satisfies the requirements of each applicable state statute. The appeal mechanism is described in each applicable state section below and is further detailed in Section 22 of this Supplement. The technical implementation of the appeal process is governed by Cascade's internal Data Subject Request Standard Operating Procedures, which have been updated as of the effective date of this Supplement to reflect the requirements of all applicable state statutes.
Consumers may exercise any right described in this Supplement by visiting cascade.com/privacy-rights, by calling Cascade's toll-free privacy line, or by visiting any Cascade retail location during normal business hours. We encourage consumers to review this Supplement in conjunction with the Omnibus Privacy Policy to obtain a complete understanding of our data practices and the rights available to them under applicable law.
Section 2: How to Exercise Your Rights and Verification
2.1 Methods for Submitting Consumer-Rights Requests
Cascade provides multiple convenient methods for consumers to submit consumer-rights requests (also referred to as "data subject requests" or "DSRs"). These methods are designed to be accessible to all consumers, regardless of their preferred mode of communication or their proximity to a Cascade retail location.
Online Portal. Consumers may submit a request through our dedicated privacy-rights portal at cascade.com/privacy-rights. The portal provides a guided, step-by-step process for submitting access, deletion, correction, opt-out, and portability requests. The portal is available 24 hours a day, 7 days a week, and is accessible on both desktop and mobile devices.
Toll-Free Telephone Number. Consumers may call Cascade's toll-free privacy line to submit a request by telephone. Our trained privacy-team representatives are available during normal business hours (Monday through Friday, 8:00 AM to 6:00 PM Pacific Time, excluding federal holidays) to assist consumers with their requests and answer questions about this Supplement.
In-Store Submission. Consumers may visit any of Cascade's one hundred eighty-six (186) retail locations to submit a consumer-rights request in person. Store associates have been trained to accept privacy-rights requests and will provide consumers with a written acknowledgment of receipt. In-store requests are forwarded to Cascade's central privacy team for processing within one (1) business day of receipt.
2.2 Identity Verification
To protect the security of consumer personal data and to prevent unauthorized access, deletion, or modification of personal information, Cascade will verify the identity of each consumer who submits a consumer-rights request. Our verification procedures are designed to be consistent with the requirements of each applicable state statute and are calibrated to the sensitivity of the request.
Standard Verification. For standard access, portability, and deletion requests, Cascade will match at least two (2) data points provided by the consumer against information already maintained in our records. These data points may include, but are not limited to, the consumer's name, email address, mailing address, telephone number, date of birth, or Cascade Rewards loyalty-program member number. Where the consumer submits a request through a verified account on cascade.com or the Cascade mobile application, verification may be completed through the account authentication process.
Heightened Verification. For requests involving the disclosure of sensitive personal data or specific pieces of personal information, Cascade may require heightened verification, which may include matching three (3) or more data points, requiring a signed declaration under penalty of perjury, or other measures reasonably calculated to confirm the consumer's identity.
Inability to Verify. If Cascade is unable to verify the identity of a consumer submitting a request, we will notify the consumer of the inability to verify and will explain the steps the consumer may take to complete the verification process. We will not process a request if we cannot reasonably verify the requestor's identity, as processing an unverified request could compromise the privacy and security of another consumer's personal data.
2.3 Authorized Agents
Certain states permit consumers to designate an authorized agent to submit consumer-rights requests on their behalf. Cascade will honor authorized-agent requests where the agent provides satisfactory documentation of the consumer's authorization.
Authorized agents must submit a signed written authorization from the consumer, a valid power of attorney, or other documentation sufficient to establish the agent's authority under the applicable state statute. In addition, Cascade may require the consumer to verify their own identity directly with Cascade and to confirm that they authorized the agent to act on their behalf.
Authorized agents who submit requests on behalf of consumers should use the same submission methods described above (online portal, toll-free telephone number, or in-store submission) and should indicate at the time of submission that they are acting as an authorized agent.
2.4 Response Timeline
Cascade's target is to respond to all consumer-rights requests within fifteen (15) business days of receipt. In no event will Cascade's response exceed the deadline required by the applicable state statute, which is typically forty-five (45) calendar days from the date of receipt, with extensions permitted under certain statutes where reasonably necessary due to the complexity or volume of requests.
Where a state statute permits an extension of the response deadline, Cascade will notify the consumer within the initial response period of the need for an extension, the reason for the extension, and the expected date of response. Extensions are generally limited to an additional forty-five (45) calendar days, for a total response period not to exceed ninety (90) calendar days from the date of receipt, unless a specific state statute provides otherwise.
2.5 FY2024 DSR Volume and Process Improvements
Cascade received approximately 38,400 consumer-rights requests in fiscal year 2024 (FY2024). These requests were distributed across the following categories:
As consumer awareness of state privacy rights continues to grow and additional state statutes become effective, Cascade anticipates a significant increase in DSR volume in FY2025 and beyond. To address this anticipated growth and to improve the consumer experience, Cascade is implementing enhanced DSR-processing automation through the deployment of a new DSR management platform developed in partnership with Fieldhaven Consulting Group LLC. The target go-live date for this platform is December 1, 2025. Upon full deployment, the automated platform is expected to reduce Cascade's average response time from the current average of twenty-seven (27) calendar days to fifteen (15) business days or less, ensuring that Cascade consistently meets or exceeds the response deadlines required by all applicable state statutes.
Section 3: Virginia — Virginia Consumer Data Protection Act (VCDPA)
3.1 Applicability. The Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq. ("VCDPA"), became effective on January 1, 2023, making Virginia the second state in the nation to enact a comprehensive consumer privacy statute.
The VCDPA applies to persons that conduct business in the Commonwealth of Virginia or that produce products or services targeted to residents of the Commonwealth and that: (a) during a calendar year, control or process personal data of at least 100,000 Virginia consumers; or (b) control or process personal data of at least 25,000 Virginia consumers and derive over 50% of gross revenue from the sale of personal data.
Cascade meets the 100,000-consumer processing threshold based on its Cascade Rewards loyalty-program membership in Virginia, its e-commerce customer base in Virginia, and data collected through in-store transactions at its Virginia retail locations. Accordingly, Cascade is subject to the VCDPA and provides Virginia consumers with the rights described below.
3.2 Consumer Rights
Under the VCDPA, Virginia consumers have the following rights with respect to their personal data:
Right to Confirm. Virginia consumers have the right to confirm whether Cascade is processing their personal data. Consumers may submit a request to confirm processing through any of the methods described in Section 2 of this Supplement. Cascade will respond to confirmation requests by informing the consumer whether we are, in fact, processing their personal data.
Right to Access. Virginia consumers have the right to access the personal data that Cascade has collected about them. Upon verification of the consumer's identity, Cascade will provide the consumer with a copy of their personal data in a format that is reasonably accessible and usable.
Right to Correct. Virginia consumers have the right to correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing. Consumers who believe that personal data maintained by Cascade is inaccurate may submit a correction request specifying the data at issue and the correction sought.
Right to Delete. Virginia consumers have the right to delete personal data provided by or obtained about them. Cascade will honor valid deletion requests by deleting the consumer's personal data from our active records, subject to applicable legal exceptions (e.g., where retention is required by law or necessary to complete a transaction requested by the consumer).
Right to Data Portability. Virginia consumers have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance. Cascade will provide data in a commonly used, machine-readable format such as CSV or JSON.
Right to Opt Out of Targeted Advertising. Virginia consumers have the right to opt out of the processing of their personal data for purposes of targeted advertising. Targeted advertising, as defined by the VCDPA, means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from the consumer's activities over time and across nonaffiliated websites or online applications to predict the consumer's preferences or interests. Consumers may exercise this right through the online portal at cascade.com/privacy-rights or by enabling a recognized universal opt-out mechanism.
Right to Opt Out of Sale. Virginia consumers have the right to opt out of the sale of their personal data. Under the VCDPA, "sale" means the exchange of personal data for monetary consideration by the controller to a third party. Consumers who wish to opt out of the sale of their personal data may do so at any time through cascade.com/privacy-rights.
Right to Opt Out of Profiling. Virginia consumers have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Profiling means any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. Consumers may exercise this right through the methods described in Section 2.
3.3 Sensitive Data
Under the VCDPA, a controller may not process sensitive data concerning a consumer without first obtaining the consumer's consent. Sensitive data under the VCDPA includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, the processing of genetic data or biometric data for the purpose of uniquely identifying a natural person, the personal data of a known child, and precise geolocation data.
Cascade collects precise geolocation data through the Cascade mobile application to provide consumers with location-based services, including store-locator functionality, localized promotions, and delivery-tracking features. Effective as of the date of this Supplement, Cascade will obtain opt-in consent from Virginia consumers before processing precise geolocation data collected through the Cascade mobile application. Consent will be obtained through a clear, affirmative consent mechanism presented within the mobile application prior to the collection of precise geolocation data.
3.4 Appeal Process
If Cascade declines to take action on a consumer-rights request submitted by a Virginia consumer, Cascade will inform the consumer without undue delay, but no later than forty-five (45) days from the date of the request, of the reasons for declining to take action and will provide the consumer with instructions for appealing the decision.
Virginia consumers may submit an appeal by visiting cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team at 4100 Elliott Avenue West, Suite 1200, Seattle, WA 98119. Cascade will acknowledge receipt of the appeal within five (5) business days and will respond to the appeal within sixty (60) days of receipt.
If the appeal is denied, Cascade will provide the consumer with a written explanation of the basis for the denial and will include information on how to file a complaint with the Virginia Attorney General, including the contact information for the Office of the Attorney General of Virginia.
Section 4: Colorado — Colorado Privacy Act (CPA)
4.1 Applicability. The Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq. ("CPA"), became effective on July 1, 2023. The CPA applies to controllers that conduct business in the State of Colorado or that produce or deliver commercial products or services that are intentionally targeted to residents of Colorado and that satisfy one of the following thresholds: (a) during a calendar year, control or process the personal data of at least 100,000 Colorado consumers; or (b) derive revenue or receive a discount on the price of goods or services from the sale of personal data and control or process the personal data of at least 25,000 Colorado consumers.
Cascade meets the applicable thresholds based on its substantial retail presence in Colorado (including multiple Cascade retail locations), its e-commerce customer base among Colorado residents, and the participation of Colorado residents in the Cascade Rewards loyalty program. Accordingly, Cascade is subject to the CPA and provides Colorado consumers with the rights described below.
4.2 Consumer Rights
Under the CPA, Colorado consumers have the following rights:
Right to Confirm and Access. Colorado consumers have the right to confirm whether a controller is processing their personal data and to access that personal data. Cascade will respond to combined confirmation-and-access requests by providing the consumer with the categories and specific pieces of personal data collected and processed.
Right to Correct. Colorado consumers have the right to correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data. Consumers may submit correction requests specifying the inaccurate data and the proposed correction.
Right to Delete. Colorado consumers have the right to delete personal data that the consumer has provided or that has been obtained about the consumer. Cascade will process valid deletion requests in accordance with the CPA, subject to applicable exceptions.
Right to Data Portability. Colorado consumers have the right to obtain their personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance.
Right to Opt Out of Targeted Advertising. Colorado consumers have the right to opt out of the processing of personal data for purposes of targeted advertising. Consumers may exercise this right through cascade.com/privacy-rights or by enabling a recognized universal opt-out mechanism such as Global Privacy Control.
Right to Opt Out of Sale of Personal Data. Colorado consumers have the right to opt out of the sale of their personal data.
Right to Opt Out of Profiling. Colorado consumers have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
4.3 Universal Opt-Out Mechanism
The Colorado Privacy Act requires controllers to recognize and honor universal opt-out mechanisms as a means for consumers to exercise their right to opt out of targeted advertising and the sale of personal data. Global Privacy Control ("GPC") is a recognized universal opt-out mechanism under Colorado law.
Cascade will honor GPC signals transmitted by the browsers or devices of Colorado consumers as a valid opt-out of targeted advertising and the sale of personal data. Full recognition of GPC signals will be implemented upon the deployment of the OnPoint Data Solutions consent-management platform on cascade.com and the Cascade mobile application. The target deployment date for the OnPoint platform is December 15, 2025. In the interim, Colorado consumers may exercise their opt-out rights manually through the online portal at cascade.com/privacy-rights.
4.4 Sensitive Data
Under the CPA, a controller may not process sensitive data concerning a consumer without first obtaining the consumer's consent. Sensitive data under the CPA includes personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data processed for the purpose of uniquely identifying an individual, and personal data of a known child.
Precise geolocation data is also classified as sensitive data under the CPA. Cascade collects precise geolocation data through the Cascade mobile application and will implement an opt-in consent flow for Colorado consumers prior to the collection and processing of such data. The consent flow will be presented within the Cascade mobile application and will clearly describe the types of precise geolocation data collected and the purposes for which it is used.
4.5 Appeal Process
If Cascade declines to take action on a consumer-rights request submitted by a Colorado consumer, the consumer will receive written notification of the denial, including the specific reasons for the denial and instructions for submitting an appeal.
Appeals may be submitted through cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team at the address listed in Section 24 of this Supplement. Cascade will respond to appeals within forty-five (45) days of receipt.
If the appeal is denied, the consumer will be provided with information on how to file a complaint with the Colorado Attorney General, including the contact information for the Colorado Department of Law.
Section 5: Connecticut — Connecticut Data Privacy Act (CTDPA)
5.1 Applicability. The Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq. ("CTDPA"), became effective on July 1, 2023. The CTDPA applies to persons that conduct business in the State of Connecticut or that produce products or services that are targeted to residents of Connecticut and that, during the preceding calendar year: (a) controlled or processed the personal data of not less than 100,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (b) controlled or processed the personal data of not less than 25,000 consumers and derived more than twenty-five percent (25%) of their gross revenue from the sale of personal data.
Cascade meets the applicable thresholds based on its operations in Connecticut, including e-commerce sales to Connecticut residents and participation by Connecticut residents in the Cascade Rewards loyalty program. Accordingly, Cascade is subject to the CTDPA and provides Connecticut consumers with the rights described below.
5.2 Consumer Rights
Under the CTDPA, Connecticut consumers have the following rights with respect to their personal data:
Right to Confirm and Access. Connecticut consumers have the right to confirm whether a controller is processing their personal data and to access that data in a meaningful format.
Right to Correct. Connecticut consumers have the right to correct inaccuracies in their personal data.
Right to Delete. Connecticut consumers have the right to delete personal data provided by or obtained about the consumer.
Right to Data Portability. Connecticut consumers have the right to obtain a copy of the consumer's personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance.
Right to Opt Out. Connecticut consumers have the right to opt out of the processing of their personal data for the purposes of: (i) targeted advertising; (ii) the sale of personal data; and (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.
5.3 Universal Opt-Out Mechanism
Effective January 1, 2025, the CTDPA requires controllers to recognize universal opt-out mechanisms as a means for consumers to exercise their right to opt out of the sale of personal data and targeted advertising. Cascade will honor Global Privacy Control (GPC) signals transmitted by the browsers or devices of Connecticut consumers as a valid opt-out of targeted advertising and the sale of personal data. As described in Section 21 of this Supplement, full technical implementation of GPC recognition will occur upon deployment of the OnPoint Data Solutions consent-management platform.
5.4 Sensitive Data
Under the CTDPA, a controller may not process sensitive data concerning a consumer without obtaining the consumer's consent. Sensitive data includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status, as well as genetic or biometric data processed for the purpose of uniquely identifying a natural person, personal data collected from a known child, and precise geolocation data.
Cascade will obtain consent from Connecticut consumers before processing any sensitive data as defined by the CTDPA, including precise geolocation data collected through the Cascade mobile application.
5.5 Appeal Process
Cascade provides a clearly defined appeal process for Connecticut consumers whose consumer-rights requests have been denied. If Cascade declines to take action on a request, the consumer will receive a written notification explaining the reasons for the denial and providing clear instructions for submitting an appeal.
Appeals may be submitted through cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team. Cascade will acknowledge receipt of the appeal and will respond to the appeal within sixty (60) days of receipt.
If the appeal is denied, the consumer will be informed of their right to contact the Connecticut Attorney General, and Cascade will provide the relevant contact information for the Office of the Connecticut Attorney General.
Section 6: Utah — Utah Consumer Privacy Act (UCPA)
6.1 Applicability. The Utah Consumer Privacy Act, Utah Code Ann. § 13-61-101 et seq. ("UCPA"), became effective on December 31, 2023. The UCPA applies to controllers that conduct business in the State of Utah or that produce products or services that are targeted to consumers who are residents of Utah, that have annual revenue of twenty-five million dollars ($25,000,000) or more, and that satisfy at least one of the following thresholds: (a) during a calendar year, control or process personal data of 100,000 or more Utah consumers; or (b) derive over fifty percent (50%) of the entity's gross revenue from the sale of personal data and control or process personal data of 25,000 or more consumers.
Cascade meets the revenue threshold (FY2024 revenue of approximately $3.87 billion) and the 100,000-consumer processing threshold based on its operations serving Utah residents through e-commerce, its Utah retail locations, and Utah-based members of the Cascade Rewards loyalty program.
6.2 Consumer Rights
Under the UCPA, Utah consumers have the following rights:
Right to Confirm and Access. Utah consumers have the right to confirm whether a controller is processing their personal data and to access that personal data.
Right to Delete. Utah consumers have the right to delete personal data that the consumer has provided to Cascade.
Right to Data Portability. Utah consumers have the right to obtain a copy of their personal data, which the consumer previously provided to the controller, in a format that is portable and, to the extent technically feasible, readily usable, allowing the consumer to transmit the data to another controller without impediment.
Right to Opt Out of Sale of Personal Data. Utah consumers have the right to opt out of the sale of their personal data. Under the UCPA, "sale" means the exchange of personal data for monetary consideration by a controller to a third party.
Right to Opt Out of Targeted Advertising. Utah consumers have the right to opt out of the processing of their personal data for purposes of targeted advertising.
Important Note. Unlike many other state privacy statutes, the UCPA does not provide consumers with a right to correct inaccuracies in their personal data. Additionally, the UCPA does not provide a right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Notwithstanding these limitations in the UCPA, Cascade encourages Utah consumers who believe that their personal data contains inaccuracies to contact our privacy team so that we can assist in addressing any concerns.
6.3 Sensitive Data
Under the UCPA, a controller may not process sensitive data without first obtaining the consumer's consent. Sensitive data under the UCPA includes personal data that reveals racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration status, or medical history, as well as the processing of genetic or biometric data for the purpose of identifying a specific individual, and the personal data of a known child.
Cascade will obtain opt-in consent from Utah consumers before processing any sensitive data as defined by the UCPA.
6.4 Appeal Process
The UCPA does not expressly mandate that controllers establish an internal appeal process for denied consumer-rights requests. However, as a matter of best practice and to ensure a consistent consumer experience across all jurisdictions, Cascade provides an appeal mechanism for Utah consumers whose requests are denied. Utah consumers may submit an appeal through cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team. Cascade will review and respond to such appeals in a timely manner.
Section 7: Iowa — Iowa Consumer Data Protection Act (ICDPA)
7.1 Applicability. The Iowa Consumer Data Protection Act, Iowa Code § 715D.1 et seq. ("ICDPA"), became effective on January 1, 2025. The ICDPA applies to persons that conduct business in the State of Iowa or that produce products or services that are targeted to consumers who are residents of Iowa and that, during a calendar year: (a) control or process the personal data of at least 100,000 Iowa consumers; or (b) control or process the personal data of at least 25,000 Iowa consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal data.
Cascade meets the applicable thresholds based on its e-commerce operations serving Iowa residents and the participation of Iowa residents in the Cascade Rewards loyalty program.
7.2 Consumer Rights
Under the ICDPA, Iowa consumers have the following rights:
Right to Confirm and Access. Iowa consumers have the right to confirm whether a controller is processing their personal data and to access that personal data.
Right to Delete. Iowa consumers have the right to delete personal data provided by the consumer to the controller.
Right to Data Portability. Iowa consumers have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format.
Right to Opt Out of Sale of Personal Data. Iowa consumers have the right to opt out of the sale of their personal data.
Right to Opt Out of Targeted Advertising. Iowa consumers have the right to opt out of the processing of their personal data for purposes of targeted advertising.
Important Note. The ICDPA does not provide Iowa consumers with a right to correct inaccuracies in their personal data. Notwithstanding this limitation, Cascade encourages Iowa consumers who identify potential inaccuracies to contact our privacy team for assistance.
7.3 Sensitive Data
Under the ICDPA, a controller may not process sensitive data without first obtaining the consumer's consent. Sensitive data under the ICDPA includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic data, biometric data processed for the purpose of uniquely identifying an individual, the personal data of a known child, and precise geolocation data.
Cascade will obtain consent from Iowa consumers before processing sensitive data as defined by the ICDPA.
7.4 Appeal Process
The ICDPA requires controllers to establish an internal appeal process for consumers whose data-rights requests are denied. If Cascade declines to take action on a request submitted by an Iowa consumer, Cascade will provide a written notification of the denial, including the reasons for the denial and instructions for submitting an appeal.
Iowa consumers may submit an appeal through cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team. Cascade will respond to appeals within sixty (60) days of receipt. If the appeal is denied, Cascade will provide the consumer with information on how to file a complaint with the Iowa Attorney General.
Section 8: Indiana — Indiana Consumer Data Protection Act (INCDPA)
8.1 Applicability. The Indiana Consumer Data Protection Act, Ind. Code § 24-15-1-1 et seq. ("INCDPA"), becomes effective on January 1, 2026. The INCDPA applies to persons that conduct business in the State of Indiana or that produce products or services that are targeted to residents of Indiana and that, during a calendar year: (a) control or process the personal data of at least 100,000 Indiana consumers; or (b) control or process the personal data of at least 25,000 Indiana consumers and derive revenue from the sale of personal data.
Cascade anticipates meeting the applicable thresholds based on its retail locations in Indiana, its e-commerce customer base among Indiana residents, and the participation of Indiana residents in the Cascade Rewards loyalty program. Cascade is preparing its compliance program to meet the INCDPA's requirements in advance of the January 1, 2026 effective date.
8.2 Consumer Rights
Upon the effective date of the INCDPA, Indiana consumers will have the following rights with respect to their personal data:
Right to Confirm and Access. Indiana consumers will have the right to confirm whether a controller is processing their personal data and to access that data.
Right to Correct. Indiana consumers will have the right to correct inaccuracies in their personal data.
Right to Delete. Indiana consumers will have the right to delete personal data provided by or obtained about the consumer.
Right to Data Portability. Indiana consumers will have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format.
Right to Opt Out of Targeted Advertising. Indiana consumers will have the right to opt out of the processing of personal data for purposes of targeted advertising.
Right to Opt Out of Sale. Indiana consumers will have the right to opt out of the sale of their personal data.
Right to Opt Out of Profiling. Indiana consumers will have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
8.3 Sensitive Data
Under the INCDPA, a controller will be required to obtain the consumer's consent before processing sensitive data. Cascade will implement appropriate consent mechanisms for Indiana consumers in advance of the statute's effective date.
8.4 Appeal Process
The INCDPA requires controllers to establish an internal appeal process. If Cascade declines to take action on a consumer-rights request submitted by an Indiana consumer, Cascade will inform the consumer of the reasons for the denial and will provide clear instructions for submitting an appeal.
Appeals may be submitted through cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team. Cascade will respond to appeals within sixty (60) days of receipt. If the appeal is denied, the consumer will be provided with information on how to file a complaint with the Indiana Attorney General.
Section 9: Tennessee — Tennessee Information Protection Act (TIPA)
9.1 Applicability. The Tennessee Information Protection Act, Tenn. Code Ann. § 47-18-3601 et seq. ("TIPA"), became effective on July 1, 2025. TIPA applies to persons that conduct business in the State of Tennessee or that produce products or services that are targeted to residents of Tennessee and that: (a) exceed twenty-five million dollars ($25,000,000) in annual revenue; and (b) during a calendar year, control or process the personal data of at least 175,000 Tennessee consumers, or control or process personal data of at least 25,000 consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal data.
Cascade meets the revenue threshold and the consumer-data processing thresholds based on its retail and e-commerce operations serving Tennessee residents.
9.2 Consumer Rights
Under TIPA, Tennessee consumers have the following rights:
Right to Confirm and Access. Tennessee consumers have the right to confirm whether a controller is processing their personal data and to access that data.
Right to Correct. Tennessee consumers have the right to correct inaccuracies in their personal data.
Right to Delete. Tennessee consumers have the right to delete personal data provided by or obtained about the consumer.
Right to Data Portability. Tennessee consumers have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format.
Right to Opt Out of Targeted Advertising. Tennessee consumers have the right to opt out of the processing of personal data for purposes of targeted advertising.
Right to Opt Out of Sale. Tennessee consumers have the right to opt out of the sale of their personal data.
Right to Opt Out of Profiling. Tennessee consumers have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
9.3 Sensitive Data
Under TIPA, a controller may not process sensitive data without first obtaining the consumer's consent. Cascade will obtain consent from Tennessee consumers prior to processing any sensitive data as defined by TIPA.
9.4 Appeal Process
TIPA requires controllers to establish an appeal process for denied consumer-rights requests. If Cascade declines to take action on a request, Cascade will provide the consumer with a written explanation of the reasons for the denial and will include instructions for submitting an appeal.
Appeals may be submitted through cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team. Cascade will respond to appeals within sixty (60) days of receipt. If the appeal is denied, the consumer will be provided with information on how to file a complaint with the Tennessee Attorney General, including the contact information for the Tennessee Division of Consumer Affairs.
Section 10: Montana — Montana Consumer Data Privacy Act (MCDPA)
10.1 Applicability. The Montana Consumer Data Privacy Act, Mont. Code Ann. § 30-14-2801 et seq. ("MCDPA"), became effective on October 1, 2024. The MCDPA applies to persons that conduct business in the State of Montana or that produce products or services that are targeted to residents of Montana and that, during a calendar year: (a) control or process the personal data of at least 50,000 Montana consumers (notably, this is a lower threshold than many comparable state statutes); or (b) control or process the personal data of at least 25,000 Montana consumers and derive more than twenty-five percent (25%) of gross revenue from the sale of personal data.
Given the lower threshold of 50,000 consumers, Cascade meets the MCDPA's applicability requirements based on its e-commerce operations serving Montana residents and the participation of Montana residents in the Cascade Rewards loyalty program, even though Montana's overall population is smaller than that of many other states with comprehensive privacy statutes.
10.2 Consumer Rights
Under the MCDPA, Montana consumers have the following rights:
Right to Confirm and Access. Montana consumers have the right to confirm whether a controller is processing their personal data and to access that data.
Right to Correct. Montana consumers have the right to correct inaccuracies in their personal data.
Right to Delete. Montana consumers have the right to delete personal data provided by or obtained about the consumer.
Right to Data Portability. Montana consumers have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance.
Right to Opt Out of Targeted Advertising. Montana consumers have the right to opt out of the processing of personal data for purposes of targeted advertising.
Right to Opt Out of Sale. Montana consumers have the right to opt out of the sale of their personal data.
Right to Opt Out of Profiling. Montana consumers have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
10.3 Universal Opt-Out Mechanism
Effective January 1, 2025, the MCDPA requires controllers to honor universal opt-out mechanisms, including Global Privacy Control (GPC), as a valid means for consumers to exercise their right to opt out of targeted advertising and the sale of personal data. Cascade will honor GPC signals transmitted by the browsers or devices of Montana consumers. Full technical implementation of GPC recognition across cascade.com and the Cascade mobile application is scheduled for deployment with the OnPoint Data Solutions consent-management platform, as described in Section 21 of this Supplement.
10.4 Sensitive Data
Under the MCDPA, a controller may not process sensitive data without first obtaining the consumer's consent. Sensitive data under the MCDPA includes personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data, personal data of a known child, and precise geolocation data.
Cascade will obtain opt-in consent from Montana consumers before processing any sensitive data, including precise geolocation data collected through the Cascade mobile application.
10.5 Appeal Process
The MCDPA requires controllers to establish an internal appeal process for denied consumer-rights requests. If Cascade declines to take action on a request submitted by a Montana consumer, Cascade will provide the consumer with a written explanation of the denial and instructions for submitting an appeal.
Appeals may be submitted through cascade.com/privacy-rights/appeal, by calling Cascade's toll-free privacy line, or by writing to Cascade's privacy team. Cascade will respond to appeals within sixty (60) days of receipt. If the appeal is denied, the consumer will be provided with information on how to file a complaint with the Montana Attorney General.
Section 11: Texas — Texas Data Privacy and Security Act (TDPSA)
11.1 Applicability. The Texas Data Privacy and Security Act, Tex. Bus. & Com. Code § 541.001 et seq. ("TDPSA"), became effective on July 1, 2024. The TDPSA applies to persons that conduct business in the State of Texas or that produce products or services consumed by residents of Texas, that process or engage in the sale of personal data, and that are not classified as "small businesses" as defined by the U.S. Small Business Administration ("SBA").
Cascade is not a small business under the SBA's size standards. Cascade's FY2024 revenue was approximately $3.87 billion, and Cascade employs approximately 22,500 individuals. Texas is one of Cascade's largest markets, with multiple retail locations and a substantial base of e-commerce customers and Cascade Rewards loyalty-program members. Accordingly, Cascade is subject to the TDPSA and provides Texas consumers with the rights described below.
11.2 Consumer Rights
Under the TDPSA, Texas consumers have the following rights:
Right to Confirm and Access. Texas consumers have the right to confirm whether a controller is processing their personal data and to access that personal data.
Right to Correct. Texas consumers have the right to correct inaccuracies in their personal data, taking into account the nature of the personal data and the purposes for which the data is processed.
Right to Delete. Texas consumers have the right to delete personal data provided by or obtained about the consumer.
Right to Data Portability. Texas consumers have the right to obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance.
Right to Opt Out of Targeted Advertising. Texas consumers have the right to opt out of the processing of personal data for purposes of targeted advertising.
Right to Opt Out of Sale. Texas consumers have the right to opt out of the sale of their personal data.
Right to Opt Out of Profiling. Texas consumers have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.