Primark DIGITAL

Domain: Digital - Digital / Technology Entity scope: Primark - the fast-fashion retailer (trades as “Penneys” in Ireland), a division of Associated British Foods plc (ABF). Primark-corporate’s OWN technology is in scope; ABF-parent and sibling-business tech is attributed at parent/sibling level unless Primark-brand-specific. Vendor-domicile rule applies: only genuinely Israeli-domiciled vendors counted in scope; Israeli delivery-centre presence of a US/EU-domiciled vendor (e.g. EPAM’s Herzliya office) is flagged, not scored as a clear Israeli nexus. Compiled: 2026-06-24 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

Primark’s digital transformation accelerated from 2021, with a headless MACH-architecture e-commerce/click-and-collect platform launched in 2022. EPAM Systems (Newtown, Pennsylvania, US) served as primary design/technology systems-integrator for the website build, assembling sub-vendors Amplience (headless CMS, UK), Bloomreach (search/merchandising, US), commercetools (product/basket/checkout, Germany), Fluent Commerce (order management/click-and-collect, Australia), and Salesforce Service/Marketing Cloud (US).^{1, 2} Tata Consultancy Services (Mumbai, India) has been Primark’s strategic IT managed-services partner since 2016, with a five-year extension signed August 2024 covering platform stabilisation, cybersecurity (NIST maturity), automation, and DevOps.^{3, 4} Zebra Technologies (Illinois, US) supplies ~3,000 ET40 enterprise tablets (operational from January 2024) for in-store inventory and checklists.⁵ StoryStream (Brighton, UK) delivers shoppable UGC/“Shop the Look” experiences on primark.com.⁶ PMC Commerce advised Primark on global ePOS strategy/vendor selection (final POS supplier not publicly identified).⁷ None of these vendors carries an identified Israeli domicile.

EPAM - Israel delivery-centre flag (material). EPAM operates an office in Herzliya, Israel, and acquired the Israeli-founded cloud-migration consultancy NAYA Technologies in November 2019.^{8, 9} EPAM is the primary systems-integrator for Primark’s e-commerce platform, but no public evidence was identified that Primark’s work was specifically routed through or delivered by EPAM’s Israeli office or NAYA personnel - EPAM is a US-incorporated, globally-staffed firm and its Primark case study credits no Israeli delivery centre. This is a flag requiring further verification, not a confirmed Israeli-technology nexus.¹ No evidence was identified of Israeli technology vendors deployed by ABF’s sibling businesses in connection with Primark-brand operations.

Surveillance, Biometrics & Retail Technology

Primark deploys standard in-store security (trained guards, body-worn cameras, CCTV) and trialled “sold” stickers as a loss-prevention measure in 2024.¹⁰ Self-service checkouts rolled out from 2022 (Sheffield/Northampton pilots), expanding to 20+ stores by end-2024, with receipt-scan security doors at self-checkout lanes.^{11, 12} Primark’s CTO stated at the 2025 Retail Technology Show that the company was exploring AI to address shoplifting (e.g. adapting self-checkouts to flag un-scanned items), but no AI-CCTV-analytics deployment was confirmed.¹³ No public evidence identified of biometric surveillance (facial recognition, behavioural AI cameras) in Primark stores, nor of any Israeli-domiciled CCTV-analytics, biometrics, or retail-surveillance vendor (e.g. AnyVision/Oosto, Corsight) contracted by Primark.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Primark undertook a cloud-first transformation using Broadcom VMware Cloud Foundation, implemented via Irish partner Triangle Technology Services, consolidating four data centres into two plus a hybrid facility, with portability to Microsoft Azure via Azure VMware Solution (50+ VMs moved to public cloud).^{14, 15} Broadcom (San Jose, US) is US-domiciled with no Israeli-government sovereign-cloud relationship relevant to Primark. No public evidence identified of Primark data stored in Israeli-sovereign or Israeli government-affiliated cloud infrastructure, or of Primark participation in Israeli national cloud procurement frameworks.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any direct contractual or commercial relationship between Primark and Israeli defence, military-intelligence, or dual-use technology suppliers (e.g. NSO Group, Elbit, NICE, Verint, ELTA). TCS (Primark’s managed-services partner) has government/defence clients in various jurisdictions, but no evidence was identified of its Primark engagement involving defence-sector or Israeli defence/intelligence capabilities. EPAM’s Israeli office (Herzliya) and NAYA subsidiary operate in commercial cloud-migration/data-management; no defence or intelligence-sector work by EPAM’s Israeli operations in connection with Primark was identified.

AI, Algorithmic & Autonomous Systems

Primark’s confirmed AI/algorithmic deployments are limited and commercial: Bloomreach (US) AI search/merchandising on primark.com;¹ StoryStream (UK) AI UGC-to-shoppable layer;⁶ the Primark app (Ireland/Italy August 2025; UK 2026) with personalised notifications, stock checks, and click-and-collect (no AI personalisation vendor publicly identified);^{16, 17} Salesforce Marketing Cloud (US) for CRM/automation;¹ and exploratory-only AI for loss prevention (no vendor contracted).¹³ ABF’s group technology CapEx (~£100m in 2024–25, automation/ERP) is ABF-group-level spend, not Primark-specific, with no Israeli AI vendor identified at either level.¹⁸ No public evidence identified of Primark deploying Israeli-founded or Israeli-domiciled AI/algorithmic systems.

Technology Ecosystem & R&D Footprint

Primark has no publicly disclosed R&D function or innovation lab with Israeli institutional, academic, or start-up partnerships; its primary technology hubs are in Dublin and Reading.^{19, 20} TCS’s Primark delivery runs from its global network (India/UK/Europe) with no identified Israeli delivery-centre involvement. Primark’s Gulf expansion is via franchise (Alshaya Group, Kuwait); in January 2026, reports emerged of separate franchise talks with Israeli retail-franchise holders to bring Primark stores to Israel, but no deal was signed and no Israeli market entry confirmed as of audit date - a commercial retail-market matter, not a digital-technology one, flagged here for awareness only.^{21, 22}

Civil Society Scrutiny & Regulatory History

No ICO enforcement actions, GDPR fines, or data-breach notifications against Primark were identified in publicly searchable regulatory records for 2024–2026.²³ The site disoccupied.com lists Primark as subject to consumer boycott calls on grounds of the parent company’s general corporate profile rather than any specific digital-technology procurement from Israel; no NGO or civil-society report specifically identifying Israeli technology vendors in Primark’s digital stack was identified, and no regulatory or civil-society complaint concerning Primark’s AI/surveillance or biometric use was identified.²⁴

Additive verification - 8 September 2026

EPAM’s Primark case study confirms its role and the component vendors, but does not identify the country of the delivery centre or name NAYA ¹. EPAM’s legal-entity list confirms NAYA in Herzliya and White Hat entities in Tel Aviv; no public evidence identified attributing Primark work or data access to those entities ²⁵. The earlier vendor-domicile wording is a research convention, not proof that an international supplier’s Israeli delivery would be irrelevant. Attribution requires evidence of the actual relationship or outcome, and the location remains unresolved ^{1, 25}.

Primark’s UK CCTV/bodycam notice confirms overhead self-checkout camera trials, aggregated statistics and real-time alerts, while stating that recordings are not used for automated decisions or biometric evaluation. It says the relevant surveillance data remains in the UK/EEA, but does not name the security provider ²⁶. Its general privacy notice permits international service-provider transfers without listing destination countries and carries a 2022 update date; it cannot establish or exclude Israel as a destination for other data ²⁷.

No public evidence identified in refreshed Primark/ABF searches for Check Point, Wiz, CyberArk, SentinelOne, NICE, Verint, Oosto/AnyVision, Trigo or Corsight contracts, or a concrete Israeli military, occupation or human-rights outcome. No public evidence identified of Primark Israeli R&D, government-cloud participation or offensive cyber provision. These are bounded public-search findings, not a complete vendor inventory.

ABF and Wittington disclosures confirm the parent/control channels remain relevant, while describing financial-investment categories without a complete security-by-security portfolio ^{28, 29}. No public evidence identified of a named controlling-principal Israeli cyber, surveillance or military-technology investment in the bounded searches; this does not certify every individual’s private holdings. The earlier Primark-only scope language does not exclude verified parent or controller conduct from consideration ^{28, 29}.