Greggs DIGITAL

Research cutoff: 28 September 2026. Request ID: 0d70041c-8734-493d-99f9-138a94d209fd.

The target is the active UK company Greggs plc, company number 00502851, registered in Newcastle upon Tyne.¹ Its September 2026 digital-services terms identify Greggs plc as the website operator and contracting party for its consumer app, accounts, rewards and Click + Collect services.²

Evidence dates below distinguish dated deployments, current disclosures and undated supplier claims. “no public evidence identified” describes the bounded documentary review recorded in research-notes.md; it is not proof of non-use or of the absence of undisclosed relationships. The review did not inspect private contracts, production systems, app binaries or network traffic.

Enterprise Technology Stack & Vendor Relationships

Named systems, scope and continuity

Greggs’ May 2025 customer privacy notice names Adyen for app top-ups and Click + Collect payment processing, and Sky Wi-Fi for customer Wi-Fi, with aggregate usage information supplied to Greggs.¹¹

Packet-named vendors and indirect procurement

For Check Point, Wiz, SentinelOne, CyberArk, NICE, Verint, Claroty and Palo Alto Networks: no public evidence identified in the reviewed Greggs disclosures and supplier records establishing a particular Greggs licence, installation, subscription or integration. Search results were frequently off-topic, so the search exercise does not establish comprehensive vendor absence.

For an integrator mandating or deploying those products at Greggs: no public evidence identified. The disclosed SAP staffing and programme relationships do not establish an undisclosed security stack.^{6, 7} Procurement amounts, security-product inventories, subcontractor schedules and product-specific Israeli engineering involvement remain unresolved.

Surveillance, Biometrics & Retail Technology

Cameras and biometric identification

The May 2025 customer notice discloses shop CCTV and image/audio recording from body-worn cameras in selected shops. It does not name a camera-system vendor or disclose facial-recognition matching in those passages.¹¹ For Greggs use of Trigo, BriefCam, AnyVision/Oosto or Trax, including facial recognition, gait identification or biometric checkout: no public evidence identified. Camera recording alone does not establish any such system.

Behavioural analytics, loyalty and self-service

The January 2024 cookie policy describes tracking technologies and third-party software development kits in the app, and expressly names Google Analytics. It discusses interaction/device information, advertising and retargeting. The document is not a complete current inventory of SDK vendors or their processing locations.¹²

Greggs’ Android listing, updated 24 April 2026, describes loyalty, wallet and shop-finder functions. Its developer-supplied disclosure lists collection of personal and financial information, encryption in transit and deletion requests. These are declarations, not independent tests of data flows.¹³

In May 2026, franchise partner Motor Fuel Group opened the first Greggs Express self-service unit near Glasgow Airport. Greggs’ announcement describes assessment of customer behaviour and response, but specifies no biometric, computer-vision or Israeli-origin checkout supplier.¹⁴ September 2026 rewards terms expressly exclude Greggs Express purchases from reward stamps; the standard app journey must therefore not be assumed to apply identically to this trial.²

For Israeli-origin predictive policing, social-media surveillance, sentiment analysis or workforce-surveillance products used by Greggs: no public evidence identified. For their indirect delivery through a managed service, camera bundle or enterprise suite: no public evidence identified. The review did identify recruitment automation, addressed below, without establishing these surveillance applications.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Documented data pathways

For an identified Greggs data route into Israeli jurisdiction, Israeli-controlled infrastructure or Israeli engineering access: no public evidence identified. This remains a data-mapping gap, not a finding that such access is technically impossible. Consumer terms applying English law do not independently locate cloud processing or determine every provider’s legal-access obligations.²

Israeli infrastructure, Nimbus and sovereign services

For Greggs operating, leasing or co-locating a data centre in Israel: no public evidence identified. For Greggs participation in Project Nimbus, an Israeli government cloud contract, or provision of sovereignty/resilience services to Israeli institutions: no public evidence identified.

The July 2025 Special Rapporteur report discusses Google and Amazon’s Nimbus contract in paragraph 40 and broader cloud suppliers in paragraphs 39–43. The report does not identify Greggs as a participant.¹⁶ Greggs’ disclosure of Google Analytics is insufficient to identify a Google Cloud contract, let alone a Nimbus deployment.¹²

Defence, Intelligence & Security Sector Technology Relationships

Greggs provision and supplier context

For a Greggs contract or service agreement with the Israeli Ministry of Defence, IDF, intelligence agencies or other Israeli state-security bodies: no public evidence identified. For deployment of Greggs-developed commercial technology in Israeli or occupied-territory military, intelligence or police surveillance: no public evidence identified. For Greggs development, sale, licensing or maintenance of offensive cyber tools, exploits or digital weapons: no public evidence identified.

A documented supplier link merits separate treatment. Microsoft’s 15 May 2025 statement acknowledged supplying the Israeli Ministry of Defence with software, professional services, Azure cloud and Azure AI. Its August 2025 update announced further review following surveillance allegations.¹⁷ On 25 September 2025, Microsoft said it had disabled specified storage and AI services for a ministry unit after finding evidence supporting elements of the reporting, while continuing other cybersecurity work.¹⁸

Those statements establish Microsoft’s disclosed conduct. The 2022 Greggs deployment report establishes Greggs as a recipient of Microsoft identity services; it does not establish Greggs supplying, administering or sharing data with the Israeli ministry.^{3, 17, 18}

Time and geographic limits

The dated supplier statements concern events after the packet’s July and November 2024 checkpoints.^{17, 18} no public evidence identified that Greggs itself continued a relevant Israeli state or settlement technology-provision arrangement after those checkpoints. This review does not infer such an arrangement from ordinary software procurement, or infer current Azure renewal solely from the older customer story.

AI, Algorithmic & Autonomous Systems

Identified commercial and recruitment uses

In its July 2026 interim results, Greggs reports machine learning in forecasting/replenishment and AI agents used by software-engineering and service teams. It also describes planned robotic picking at Derby and automation at Kettering. The passage does not name the agentic-AI model supplier, training datasets, robotics vendor or an Israeli development location.⁴

The August 2026 recruitment notice identifies third-party AI-assisted CV screening and summarisation. It separately describes automated rejection when specified eligibility or qualification conditions are unmet. These are disclosed recruitment functions; the notice does not identify a named Israeli AI vendor.¹⁵

State customers, training data and autonomous targeting

For Greggs supplying AI, machine learning, computer vision or autonomous decision-support systems to Israeli state, military or security bodies: no public evidence identified. For Greggs models trained on, or given access to, civilian surveillance or intercepted communications originating in Israel or occupied territories: no public evidence identified.

For Greggs providing autonomous target generation, threat detection or tracking to those bodies: no public evidence identified. The commercial logistics and recruitment uses above do not establish such provision.^{15, 4} No identified Greggs product required a separate purpose-built weapons-system referral.

Technology Ecosystem & R&D Footprint

Facilities, investment and intellectual property

For Greggs-operated Israeli engineering offices, research facilities, innovation labs or accelerators: no public evidence identified. For Greggs acquisitions of Israeli-origin technology businesses, strategic Israeli startup or venture-fund investments, and technology co-development or licensing with Technion, Hebrew University or Weizmann Institute: no public evidence identified. This was a public-disclosure and indexed-search review, not an exhaustive patent-register or private-investment inspection.

Named principals and group boundary

The board page checked in September 2026 lists Matt Davies as chair; Roisin Currie and Richard Hutton as CEO and CFO; and Richard Smothers, Lynne Weedall, Nigel Mills, Tamara Rogers and Ikdeep Singh as non-executive directors. It separately identifies Sarah Dickson as company secretary and general counsel.¹⁹ The corporate history identifies John Gregg as the founder [pre-2020 historical evidence]; historical family identity alone does not establish present control.²⁰

For the named current principals’ documented directorships, personal equity interests or family-office investments in Israeli surveillance, cyber, AI or military-technology businesses: no public evidence identified in the bounded principal review. Private interests, the complete below-board executive roster, a current beneficial-ownership register, and any shareholder crossing 10% by the cutoff remain insufficiently verified. No definitive “no controlling shareholder” statement is made.

The July 2026 interim results identify a Lagardère Travel Retail partnership at Tenerife South Airport, opened in late May.⁴ Greggs directly identifies MFG for the Express trial.¹⁴ EG On The Move’s 1 May 2026 announcement lists Greggs among its strategic brand partnerships.²¹ These establish specific commercial relationships; they do not make all of each partner’s technology contracts Greggs contracts.

For relevant Israeli technology provision through those identified franchise arrangements: no public evidence identified. A complete subsidiary/franchisee technology inventory and current group-structure reconciliation remain evidence gaps. No unrelated partner, investment-manager portfolio company or same-name business is treated as a Greggs subsidiary without evidence.

Civil Society Scrutiny & Regulatory History

Named-document checks

The retrieved A/HRC/59/23 report of 2 July 2025 contains no “Greggs” text match. Its paragraphs 36–43 address other named technology businesses, including Microsoft. Supplier-specific allegations have been cross-checked against Microsoft’s own statements above rather than attributed to Greggs from the report alone.^{16, 17, 18}

The November 2024 DBIO report lists 58 selected companies on page 3; Greggs is not in that list. Its scope is financial relationships with selected settlement-involved companies.²² A full-text check of the November 2025 DBIO report also found no Greggs match; its methodology and profiles remain a selected-company study, not an exhaustive clearance register.²³

Campaigns, legal actions and limits

The BDS Movement’s technology-campaign page checked in September 2026 identifies Microsoft, Google, Amazon and other named technology businesses; it contains no Greggs text match.²⁴ For an organised boycott/divestment campaign specifically alleging Greggs technology provision to Israeli bodies, and for a documented Greggs response: no public evidence identified.

For Greggs-specific regulatory inquiries, legal challenges, export-control proceedings or sanctions-related investigations concerning such technology sales or services: no public evidence identified. Searches also covered Who Profits, AFSC, Amnesty, Human Rights Watch, Citizen Lab, Access Now, B’Tselem, Al-Haq, SOMO, PAX and BankTrack. Their search non-results are recorded as limited coverage, not findings by those organisations that Greggs has no relevant relationships.