INDEX / DIRECTORY / BERSHKA / DIGITAL

Bershka DIGITAL

DIGITAL INFRASTRUCTURE AUDIT UPDATED 2026-10-09
Digital Score 6.00 /10 C Bershka - Complicity Index 541
Digital 6.00

Evidence-only forensic audit. Scoring happens downstream - see the main dossier for the composite assessment.

Forensic audits like this are reader-funded - no sponsors, no ads. Support OpenIntel →

Request ID: 0e1e2a08-fe59-40df-95c4-d5887c22f6dd Research cut-off: 9 October 2026 Target boundary: Bershka is an Inditex brand. Parent-group technology is included where it supports Bershka or where the domain framework requires group attribution. Zara and other sister-brand evidence is labelled and is not automatically attributed to Bershka. Israeli franchise/operator conduct is likewise separated from Bershka/Inditex corporate conduct.

Bershka’s current Israeli terms identify Daniel Gottex Ltd in Or Yehuda as the entity authorised by ITX MERKEN B.V. to market, distribute and sell Bershka products through the Israeli site and as their importer.1 A 2025 employee-representative report identifies Joey Schwebel/Trimera as the Israeli franchise group.2 Aquilon’s current retail portfolio presents Bershka among its Israel brands.3 These operator/group labels are retained without assuming every named entity is legally identical.

Inditex’s FY2025 results list 15 Bershka stores in Israel at 31 January 2026.4 Aquilon’s current retail page lists 17 Bershka stores in Israel; the difference may reflect later openings or counting methodology and is not resolved by inference.3 The current Israeli terms document the online seller/importer.1 The continuing presence is also consistent with a December 2024 Bershka flagship opening in Petah Tikva and 2026 retail/e-commerce activity.5, 6

Enterprise Technology Stack & Vendor Relationships

Israeli-origin software and services

A bounded Israeli-technology relationship appears at parent/sister-brand level, not as a verified Bershka deployment. On 16 April 2026, Inditex confirmed unauthorised access to transaction databases hosted by a third party and said the incident stemmed from a security incident affecting a former technology provider.7 Have I Been Pwned records that the ShinyHunters group attributed the Zara breach to compromise of the Anodot analytics platform; HIBP reports 197,400 unique email addresses plus purchase/support-ticket related data in the leaked Zara dataset.8 Anodot describes itself as an AI-driven business-monitoring and analytics platform and lists its headquarters at Glassbox, Bazel 25, Petach Tikva, Israel.9 Glassbox announced its acquisition of Anodot on 4 November 2025 and described Anodot as a real-time anomaly-detection provider using machine-learning analytics.10

This evidence supports an Israeli-headquartered analytics-vendor lead involving Zara/Inditex data, but the Anodot attribution comes from the attacker/HIBP record rather than an Inditex identification of the vendor.7, 8 No source reviewed identifies Bershka customer data in the incident or confirms a Bershka-specific Anodot integration. Because Inditex called the affected provider “former” in April 2026, the relationship is treated as discontinued by then unless later evidence shows otherwise.7

No public evidence identified in the current Bershka privacy disclosures or Inditex technology materials reviewed of a Bershka/Inditex licensing or integration relationship with Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty or Palo Alto Networks.11, 12, 13

15 November 2023 - commercial personalisation, vendor statement. A Mastercard country-manager promotional interview names Bershka among companies recognising the value of Dynamic Yield’s personalisation technology. This is the vendor representative’s statement, not a disclosed Bershka contract or confirmation of deployment in Israel.14 Mastercard’s 4 April 2022 acquisition announcement places Dynamic Yield teams in Tel Aviv and New York.15 Contract dates, payment scale, Israeli deployment, and continued Bershka use in October 2026 are not established. No public evidence identified of this relationship providing Israeli state-security surveillance or military capability.14, 15

Scale of dependency

Inditex’s current technology organisation says its data platform continuously updates billions of data points generated daily in its supply chain and stores, and that machine-learning models are integrated into production for optimisation, decision-making, simulation, recommendations and personalisation.12 Its open-source manifesto states that Inditex is the company behind Bershka and the other listed brands and that Inditex technology teams design, build and maintain the software behind them.16 This establishes substantial parent-level digital infrastructure supporting the brand, but no public source reviewed quantifies Bershka’s dependency on any Israeli-origin vendor.12, 16

Procurement and integrators

Inditex says it works closely with major cloud providers “such as Azure, and Google Cloud,” while Python is used for cloud processes and Java for on-premises processes.12 The sources reviewed do not identify a systems integrator that deployed Israeli-origin technology specifically for Bershka. No public evidence identified of an integrator mandating or bundling Israeli-origin security/analytics products into Bershka’s estate.11, 12

Surveillance, Biometrics & Retail Technology

Facial recognition and biometrics

No public evidence identified of Bershka using Israeli-origin facial recognition, biometric identification, gait analysis or store-video analytics from Trigo, BriefCam, AnyVision/Oosto, Trax or a comparable Israeli vendor in the sources reviewed.11, 12, 16

Inditex does publicly describe retail monitoring of a different kind: a current data-science challenge uses physical-store transaction data and RFID traceability to flag suspicious transactions and support authorisation/risk-management decisions.17 The source describes transaction/RFID anomaly detection, not facial recognition or biometric identification.17

Predictive analytics and monitoring

At group level, Inditex develops predictive models, computer-vision/NLP models and recommendation/personalisation systems.12 Its anomaly-detection work targets fraud/risk patterns in store transactions.17 These are Inditex-developed general retail analytics capabilities; no public evidence identified that Bershka uses Israeli-origin predictive-policing, sentiment-analysis, social-media-monitoring or workforce-surveillance tools.12, 17

Third-party deployment

The Bershka Israel privacy policy states that customer information may be shared with Inditex/Gottex-group companies and third-party providers including financial institutions, fraud-prevention services, technology/analytics providers, logistics, customer support, marketing/advertising and social networks; some providers may be outside the EEA.11 The policy does not name those technology/analytics vendors. No public evidence identified that an Israeli surveillance or biometric product reaches Bershka through those unnamed providers.11

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Data centre operations and data exposure

For Israel-market customers, Bershka’s privacy policy places ITX MERKEN B.V. and a local Israeli seller/controller in the processing chain, states that personal data is stored in the controllers’ respective databases, and covers identity, economic/transaction, payment, device, browsing, geolocation, preference and marketing-profile information.11 The Israeli App Store listing likewise says the Bershka app may link purchases, payment information, contact information, search history and identifiers to the user, while Google Play says the app may collect personal information and app activity and may share personal information and device/other IDs with third parties.18, 19

This establishes an Israeli-jurisdiction commercial/data-controller relationship for Israeli customers, but the reviewed disclosures do not identify the physical country of the relevant servers, an Inditex/Bershka-owned Israeli data centre, or an Israeli cloud region used for Bershka data.11, 18, 19 no public evidence identified that Bershka or Inditex operates, leases or co-locates its own data-centre infrastructure in Israel.11, 12, 13

Government cloud contracts

Inditex’s technology page confirms use of major providers including Azure and Google Cloud.12 A/HRC/59/23 separately discusses Microsoft, Alphabet/Google and Amazon in relation to Israeli state/military cloud and AI infrastructure, including Project Nimbus.20 Vendor overlap alone does not establish that Inditex workloads use Nimbus or Israel-hosted government infrastructure. No public evidence identified that Bershka or Inditex participates in Project Nimbus or another Israeli government-cloud programme.12, 20

Data sovereignty and resilience services

No public evidence identified that Bershka or Inditex provides data-sovereignty, data-residency or infrastructure-resilience services to Israeli state institutions or military bodies.12, 20 Inditex’s accredited CSIRT covers the group’s worldwide technology footprint, including *.Bershka.com, but its listed host organisation and contact address are in Spain and the directory does not identify an Israeli state customer.13

Defence, Intelligence & Security Sector Technology Relationships

Military and intelligence contracts

No public evidence identified of a contract, partnership or service agreement between Bershka/Inditex and the Israeli Ministry of Defence, IDF, intelligence agencies or other Israeli security bodies in the reviewed corporate, UN and public-reporting sources.21, 20, 22

The continued Israeli retail franchise and e-commerce presence after 19 July 2024 and November 2024 is documented by the December 2024 Bershka opening, 2026 store counts and current Israeli legal notices.1, 4, 5 That evidence establishes continuing consumer retail operations; it does not establish technology provision to a military or security customer.

Dual-use technology provision

Inditex uses general-purpose data, cloud, AI, RFID and cybersecurity capabilities for its retail business.12, 17, 13, 23 no public evidence identified that Bershka/Inditex supplied those systems to Israeli military, intelligence or law-enforcement bodies, or that they were deployed for surveillance of Palestinians or in settlements.20, 22

Offensive cyber and weapons technology

No public evidence identified that Bershka or Inditex develops, sells, licenses or maintains offensive-cyber tools, zero-day exploits, digital weapons or purpose-built military software for Israeli state actors.16, 13, 20

AI, Algorithmic & Autonomous Systems

AI/ML provision to state bodies

Inditex says its internal AI process includes a large data platform, data-science/ML models and technology integration; it lists predictive models, computer vision, NLP, language models and personalisation as capabilities.12 This is parent-group, general retail technology. No public evidence identified of Bershka/Inditex providing these AI/ML capabilities to Israeli state, military or security bodies.12, 20

Training data and model development

The current Inditex description says models are built on large volumes of supply-chain/store data, while the Israel privacy policy allows customer profiling based on browsing and purchase history.11, 12 no public evidence identified that Bershka or Inditex trains models on civilian-population surveillance data, intercepted communications, or datasets originating from Israeli military/security collection in Israel or the occupied Palestinian territory.11, 12, 20

Autonomous systems and lethality

No public evidence identified of Bershka/Inditex providing autonomous target-generation, automated threat-detection for kinetic use, fire-control, kill-chain automation or autonomous tracking systems to Israeli forces.20 The retail transaction anomaly detection described by Inditex is a commercial risk-management use case and does not have a stated weapons or targeting function.17

Technology Ecosystem & R&D Footprint

Israeli R&D centres

No public evidence identified that Bershka or Inditex operates an R&D centre, engineering office, accelerator or innovation lab in Israel.21, 12, 16 The Israeli franchise/operator-side Aquilon site says Aquilon has headquarters presence in Tel Aviv, an Israeli distribution centre and investment in advanced 3D technology for its own design/product-development work.24 No reviewed source establishes those facilities as an Inditex/Bershka R&D centre or says that Aquilon’s 3D design technology is used to develop Bershka products.24

Acquisitions and investments

No public evidence identified of Bershka/Inditex acquiring an Israeli technology company or making a disclosed strategic investment in an Israeli cyber, surveillance, AI or military-tech startup/fund in the sources reviewed.21, 16 Targeted searches of the controlling-principal names and vehicles (including Amancio Ortega/Pontegadea, Marta Ortega and Óscar García Maceiras) likewise produced no verified target-specific investment in the named Israeli surveillance/cyber/AI firms. The Anodot evidence is a former vendor/data-access lead tied to Zara/Inditex, not an Inditex acquisition; Anodot was acquired by Glassbox in November 2025.10, 7, 8

Patent and intellectual-property relationships

No public evidence identified of a significant Bershka/Inditex patent licence, co-development agreement or technology research partnership with an Israeli-domiciled university or research institution such as Technion, Hebrew University or Weizmann Institute in the reviewed sources.21, 16

Civil Society Scrutiny & Regulatory History

UN, NGO and academic reporting

The latest 2026 OHCHR settlement-business database (A/HRC/63/20) was searched for Bershka, Inditex and Zara; no matching target name was identified in the machine-indexed report reviewed.22 Targeted searches of A/HRC/59/23 likewise did not identify Bershka or Inditex as named technology suppliers; its relevant technology section concerns other named cloud, AI and surveillance companies.20 no public evidence identified in the reviewed Who Profits/AFSC/UN materials of a Bershka-specific technology relationship with Israeli state/security bodies or settlement digital infrastructure.20, 22

Boycott and divestment campaigns

On 24 July 2025 the Palestinian BDS National Committee formally endorsed a boycott campaign against Zara, describing Zara as Inditex’s flagship brand; the same statement lists Bershka among Inditex brands operating in Israel and says Zara is the primary focus of that strategic boycott campaign.25 This is civil-society scrutiny of the parent group’s Israel presence and Zara, not evidence of a Bershka technology-provision campaign.25

Separately, in October 2025 Inditex’s European Works Council asked the company to end its commercial relationship with the Israel franchise led by Joey Schwebel/Trimera, according to Economía Digital; the report said the request had been passed to management and no response had then been received.2 This is a franchise/business-presence dispute, not a technology-specific regulatory finding.2

Reuters reported that Inditex notified relevant authorities after the April 2026 unauthorised access to third-party-hosted transaction databases.7 That incident is a cybersecurity/data-protection matter and was not reported as an Israeli-state sales or sanctions case. No public evidence identified of a regulatory inquiry, export-control action, sanctions investigation or legal challenge concerning Bershka/Inditex technology sales or services to Israeli state entities.7, 20, 22

Footnotes

  1. BERSHKA, “Terms and Conditions of Use - Israel” (current Hebrew PDF retrieved 9 Oct 2026). https://static.bershka.net/4/static/itxwebstandard/docs/termsandconditions/terms_and_conditions_he_IL.pdf?ts=20261009015254 ↩ ↩2 ↩3

  2. Economía Digital Galicia, “El comité de empresa europeo pide a Inditex que rompa con su franquiciado en Israel,” 9 Oct 2025. https://www.economiadigital.es/galicia/empresas/comite-empresa-europeo-pide-inditex-rompa-franquiciado-israel.html ↩ ↩2 ↩3

  3. Aquilon, “Retail Brands” (current page, accessed 9 Oct 2026). https://aquilon.com/retail/ ↩ ↩2

  4. Inditex FY2025 consolidated accounts, store table at 31 January 2026. https://www.inditex.com/itxcomweb/api/media/50ba1fc0-3862-4408-8da2-4f973f1be18e/AnnualAccountsDirectorsReportandAuditReportconsolidated.pdf?t=1773650991401 ↩ ↩2

  5. The Jerusalem Post, “Bershka and Pull&Bear open flagship stores with global designs at Ofer Grand Mall,” 5 Dec 2024. https://www.jpost.com/business-and-innovation/article-832154 ↩ ↩2

  6. Economía Digital Galicia, “El franquiciado de Inditex en Israel cierra de forma temporal sus tiendas,” 4 Mar 2026. https://www.economiadigital.es/galicia/empresas/el-franquiciado-de-inditex-en-israel-cierra-de-forma-temporal-sus-tiendas.html ↩

  7. Reuters via Zonebourse, Inditex transaction-database incident and former technology provider, 16 April 2026; French translation. https://www.zonebourse.com/actualite-bourse/inditex-proprietaire-de-zara-fait-etat-d-un-acces-non-autorise-a-ses-bases-de-donnees-de-transacti-ce7e50ddda89f320 ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  8. Have I Been Pwned, “Zara Data Breach,” added 8 May 2026. https://haveibeenpwned.com/breach/Zara ↩ ↩2 ↩3

  9. Anodot, “About Us” (current page, accessed 2026). https://www.anodot.com/about/ ↩

  10. Glassbox, “Glassbox Strengthens Anomaly Detection with Acquisition of Anodot,” 4 Nov 2025. https://www.glassbox.com/news/glassbox-anodot-acquisition/ ↩ ↩2

  11. BERSHKA, “Privacy Policy - Israel” (current Hebrew PDF retrieved 9 Oct 2026). https://static.bershka.net/4/static/itxwebstandard/docs/privacypolicy/privacy_policy_he_IL.pdf?ts=20261009015254 ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10

  12. Inditex XTEND, “Tech teams” (current page, accessed 2026). https://xtend.inditex.com/tech-teams ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12 ↩13 ↩14 ↩15 ↩16 ↩17 ↩18

  13. Trusted Introducer, “ITXCSIRT (ES),” current state updated 5 Aug 2026. https://tf-csirt.org/trusted-introducer/directory/teams/itxcsirt-es/ ↩ ↩2 ↩3 ↩4 ↩5

  14. Bloomberg Adria, Mastercard country-manager promotional interview, 15 November 2023 (Year Ahead 2024 series). https://hr.bloombergadria.com/year-ahead-2024/vijesti/45279/the-value-of-technology-lies-in-making-complex-things-simple/news ↩ ↩2

  15. Mastercard, acquisition of Dynamic Yield completed, 4 April 2022. https://investor.mastercard.com/investor-news/investor-news-details/2022/Mastercard-Strengthens-Consumer-Engagement-Services-With-Close-of-Dynamic-Yield-Acquisition/default.aspx ↩ ↩2

  16. Inditex Tech, “Open Source Manifesto” (current page, accessed 2026). https://opensource.inditex.com/en/about/ ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7

  17. Inditex XTEND, “Anomalies with Context: Discovering Patterns on Structured Data” (current page, accessed 2026). https://xtend.inditex.com/challenge/anomalies-with-context-discovering-patterns-on-structured-data ↩ ↩2 ↩3 ↩4 ↩5 ↩6

  18. Apple App Store Israel, “BERSHKA” app privacy disclosure (accessed 2026). https://apps.apple.com/il/app/bershka/id427769832 ↩ ↩2

  19. Google Play, “BERSHKA: Fashion & trends” data-safety disclosure, updated 5 Oct 2026. https://play.google.com/store/apps/details?id=com.inditex.ecommerce.bershka ↩ ↩2

  20. United Nations, A/HRC/59/23, “From economy of occupation to economy of genocide,” 2025. https://docs.un.org/A/HRC/59/23 ↩ ↩2 ↩3 ↩4 ↩5 ↩6 ↩7 ↩8 ↩9 ↩10 ↩11 ↩12

  21. Inditex, Annual Report 2025 Download Centre (accessed 9 Oct 2026). https://annualreport.inditex.com/anrpxxvui/en/download-centre ↩ ↩2 ↩3 ↩4

  22. OHCHR A/HRC/63/20, 25 September 2026; independently retrieved UN-authored report mirror. https://api.ilcpal.com/storage/115/a-hrc-63-20-aev.pdf ↩ ↩2 ↩3 ↩4 ↩5

  23. Google Play, Inditex “RFID Supplier Control,” updated 27 May 2026. https://play.google.com/store/apps/details?hl=en_GB&id=com.inditex.rfsupctand ↩

  24. Aquilon, “About Us” (current page, accessed 9 Oct 2026). https://aquilon.com/about-us/ ↩ ↩2

  25. Palestinian BDS National Committee, “Boycott ZARA: Dressing Up Apartheid and Genocide,” 24 Jul 2025. https://bdsmovement.net/news/boycott-zara-dressing-apartheid-and-genocide ↩ ↩2