Digital Audit: B&M

B&M European Value Retail S.A. - Digital Audit

Enterprise Technology Stack & Vendor Relationships

B&M Retail Limited’s confirmed technology vendor relationships, per commercial technographic database records, include Eploy for applicant tracking (onboarded 2018), Algolia for site search (2019), Intuit Mailchimp for CRM/marketing (2020), Cisco IronPort Cloud Email Security and Cisco Secure Email (both 2021), Cisco Duo Identity Security Posture Management (2024), and an evaluation of Blue Yonder Transportation Management recorded as of 30 May 2024 ¹. None of these disclosed vendors are of Israeli origin ¹. B&M is a documented client of virtualDCS, a UK-based (Leeds) cloud hosting and cyber-resilience provider, for data protection and cyber-resilience services ¹²³; virtualDCS’s own technology stack is built on Veeam, a US-headquartered, Swiss-domiciled backup and resilience platform ⁴. No Israeli-origin subcomponent has been identified anywhere in this hosting/resilience supply chain ¹²³⁴. No public evidence identified of a licensing, subscription, or integration relationship between B&M and Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty, or Palo Alto Networks. No public evidence identified of a named systems integrator (e.g., Accenture, Capgemini, Deloitte, Infosys, TCS) engaged by B&M for a major enterprise technology programme, including its core EPOS, ERP, or supply-chain systems.

Surveillance, Biometrics & Retail Technology

B&M stores use Facewatch, a cloud-based biometric facial-recognition system, to identify individuals previously flagged for suspected shoplifting as they enter stores ⁵⁶⁷⁸. Facewatch is a UK-domiciled vendor, and no evidence has been identified of Israeli origin or Israeli-origin subcomponents in this specific deployment ⁵⁸. Reporting indicates the UK Information Commissioner’s Office concluded, as of around March 2023, that Facewatch’s data processing breached UK data-protection principles including lawfulness, fairness, transparency, purpose limitation, and processing of special-category data; this finding concerns Facewatch as a vendor generally rather than a B&M-specific enforcement action ⁶⁸. A documented misidentification incident occurred at a B&M store in Cardiff Bay Retail Park, where customer Byron Long was wrongly accused of theft due to a Facewatch matching error, an outcome attributed by both B&M and Facewatch to “human error” ⁷. Trigo, an Israeli-origin AI loss-prevention and computer-vision company, markets CCTV-based loss-prevention technology used by other UK and European retailers including Tesco and REWE ⁹¹⁰. No public evidence identified that B&M itself has deployed Trigo, BriefCam, AnyVision/Oosto, or Trax technology. No public evidence identified of Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring, or workforce-surveillance tools in use by B&M. No public evidence identified of indirect or bundled delivery of Israeli-origin surveillance technology to B&M via managed security services or third-party platforms beyond the Facewatch relationship, which is itself not confirmed to be Israeli-origin ⁵⁶⁷⁸.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

No public evidence identified of B&M operating, leasing, or co-locating data-centre infrastructure within Israel. No public evidence identified of B&M participating in Project Nimbus or any comparable Israeli government or state-backed cloud programme. No public evidence identified of B&M providing data-sovereignty, data-residency, or infrastructure-resilience services to Israeli state institutions or military bodies; B&M’s disclosed business function is retail and technology consumption rather than technology or cloud provision, which makes this category structurally of limited applicability in the “provider” sense ¹¹¹. B&M’s FY2025 Annual Report & Accounts (52 weeks to 29 March 2025) was identified as a primary filing source, but it was not full-text searched in this audit cycle for Israel-, cloud-, or data-centre-related keyword hits, and no core cloud/hosting provider (AWS, Azure, GCP, or on-premise) or primary network security vendor could be confirmed from public sources ¹¹.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any contract, partnership, or service agreement between B&M and the Israeli Ministry of Defence, the IDF, Israeli intelligence agencies, or other Israeli state security bodies. No public evidence identified of B&M’s commercial technology being deployed for military, intelligence, or law-enforcement surveillance applications in Israel or the occupied Palestinian territories. No public evidence identified of B&M developing, selling, licensing, or maintaining offensive cyber capabilities, zero-day exploit tools, or digital weapons systems; B&M’s designed business function is discount retail rather than technology development ¹¹¹.

AI, Algorithmic & Autonomous Systems

No public evidence identified of B&M providing AI/ML, computer-vision, or autonomous decision-support systems to Israeli state, military, or security bodies. No public evidence identified that any B&M AI/ML system - including its Algolia-based search functionality or its Facewatch facial-recognition integration - has been trained on, or given access to, civilian population data, intercepted communications, or surveillance-derived datasets originating from Israel or the occupied territories ¹⁵⁸. No public evidence identified of B&M providing autonomous target-generation, automated threat-detection, or autonomous-tracking systems to any military or security force.

Technology Ecosystem & R&D Footprint

No public evidence identified of B&M operating R&D facilities, engineering offices, innovation labs, or accelerator programmes in Israel; B&M’s disclosed corporate footprint spans the UK (B&M UK), France (B&M France), and Jersey (parent domicile) ¹¹¹. No public evidence identified of B&M acquiring any Israeli-origin technology company or making strategic investments in Israeli technology startups or venture funds. No public evidence identified of patent portfolios, licensing agreements, or co-development arrangements between B&M and Israeli-domiciled entities or research institutions such as Technion, Hebrew University, or the Weizmann Institute.

Civil Society Scrutiny & Regulatory History

B&M does not appear in the OHCHR Database of Business Enterprises maintained pursuant to Human Rights Council Resolutions 31/36 and 53/25, including in its most recent September 2025 update covering 158 businesses per press reporting, based on direct name search and database/press-release review ¹²¹³¹⁴. B&M does not appear to be listed in the Who Profits company database; a direct search of the database returned only unrelated entities such as “Bank Hapoalim B.M.” ¹⁵. B&M does not appear on the Wikipedia “List of companies operating in West Bank settlements” ¹⁶. No public evidence identified that B&M appears in the Don’t Buy Into Occupation 2024 or 2025 company annex lists, though the full PDF annexes for both reports could not be retrieved or text-searched in this audit cycle, with only landing pages accessible ¹⁷¹⁸. No public evidence identified of any organised boycott, divestment, or sanctions campaign targeting B&M specifically on technology-provision grounds. No public evidence identified of any regulatory inquiry, legal challenge, export-control action, or sanctions investigation involving B&M’s technology sales or services to Israeli state entities. A secondary, unverified claim characterising B&M’s “political footprint” via the Arora family - citing Simon Arora’s role as Vice Chairman of the Conservative Party (2018–2020) and Conservative Friends of Israel connections - originated from an aggregator source of uncertain primary sourcing and could not be independently confirmed against a primary document in this audit cycle; it is noted as an unverified gap rather than an established fact.