Extract to table

and subject to financial-incentive disclosure rules All data access must comply with the documented data-retention and disposal schedule No documented data-retention schedule existed prior to this program — one is now in place [slide 9] Module 4: Data Subject Requests (DSRs) — Overview Consumer rights include: Right to Know/Access, Right to Delete, Right to Correct, Right to Opt-Out of Sale/Sharing, Right to Limit Use of Sensitive PI Additional state-specific rights: Right to Appeal (required by Virginia, Colorado, Connecticut, and other states) FY2024 volume: ~38,400 total DSRs received (Access: ~12,800; Deletion: ~19,100; Opt-Out: ~6,500) Prior average response time: 27 calendar days — new target: 15 business days or less Universal opt-out mechanism (Global Privacy Control) must now be honored — this was a prior gap [slide 10] Module 4 (cont

72 hours to regulators under some statutes) All incidents are logged and investigated under the internal privacy policy procedures [slide 12] Module 6: Vendor & Third-Party Management Cascade shares consumer data with 47 third-party advertising and analytics partners 23 of these 47 partners previously lacked executed Data Processing Agreements (DPAs) — a critical gap now being remediated Under CCPA/CPRA, each vendor must be classified as a Service Provider, Contractor, or Third Party All vendors must have an executed DPA before receiving any personal information Key vendors: OnPoint Data Solutions (CMP, $480K/yr); Thornbridge Media Corp