Digital Audit - The Body Shop

Domain: Digital - Digital / Technology Entity scope: The Body Shop International Limited (cosmetics retailer); current owner Auréa Group documented and attributed at parent level; former owners L’Oréal (2006–2017) and Natura &Co (2017–2023) documented and attributed at prior-owner level throughout. Compiled: 2026-06-25 Method: Live web search only

Enterprise Technology Stack & Vendor Relationships

The Body Shop’s enterprise technology stack has been substantially rebuilt across multiple phases, with the core platform anchored in SAP commerce and ERP software. The company has used SAP since 1999,¹ and the most significant recent build-out was a global SAP Commerce Cloud (formerly Hybris) deployment executed during 2019–2020 in partnership with KPS UK (formerly Envoy Digital), covering 16 websites and ultimately scoped for over 60 countries.² That implementation included SAP Customer Data Cloud and SAP Marketing Cloud as part of the SAP CX/C4 suite.² SAP is domiciled in Walldorf, Germany. KPS is a German-headquartered SAP consultancy with UK operations; not Israeli-domiciled.

Alongside the SAP core, an earlier global cloud IT overhaul was delivered by Accenture, which helped the brand revamp operations across 70 countries with a cloud-based IT system in approximately 18 months.³ Accenture is US-domiciled; not Israeli.

For loyalty programme technology, The Body Shop’s “Love Your Body Club” was implemented using Talon.One, a promotions and incentives platform.⁴ Talon.One is headquartered in Berlin, Germany; not Israeli-domiciled.

The brand has used Sailthru (now acquired by Zeta Global, September 2025), a New York–based personalisation and email marketing platform, for its retail personalisation and cross-channel marketing.⁵ Sailthru/Zeta Global is US-domiciled; not Israeli.

For the Middle East markets (UAE and Saudi Arabia), a Shopify Plus migration and mobile app relaunch were delivered by DigiFist in 2025, integrating with Odoo ERP.⁶ Shopify is Canadian; Odoo is Belgian. Neither is Israeli-domiciled.

In Southeast Asia (Indonesia, Malaysia, Vietnam, Cambodia), The Body Shop worked with Ranosys - a Singapore-headquartered e-commerce agency - on Magento/Adobe Commerce performance improvements.⁷ Ranosys is Singapore-domiciled; not Israeli.

For product lifecycle management, The Body Shop selected Centric PLM (announced March 2026) to serve as a single source of truth for product data globally, covering UK, Asia, India and the Middle East.⁸ Centric Software is headquartered in Campbell, California (USA) and is a subsidiary of Dassault Systèmes (France).⁹ Not Israeli-domiciled.

For supply chain planning and AI-driven forecasting, The Body Shop selected RELEX Solutions (announced October 2025), deploying its unified retail planning platform across global stores, franchises and distribution centres.¹⁰ RELEX Solutions is headquartered in Helsinki, Finland.¹¹ Not Israeli-domiciled.

Israeli-domiciled vendor finding: No public evidence identified of any Israeli-domiciled enterprise technology vendor in The Body Shop’s confirmed stack.

Surveillance, Biometrics & Retail Technology

The Body Shop’s tech-driven flagship at Oxford Street (111 Oxford Street, London) features an AI-led skin analysis tool that uses face-mapping to identify up to 14 skin care concerns and provide personalised product recommendations.¹² The tool is integrated into a “Skincare Experience Table” at the centre of the store. No third-party technology vendor for this specific AI system is named in any available press release or trade coverage; the supplier is not publicly identified. No evidence of deployment beyond this single store.

No public evidence identified of The Body Shop deploying facial recognition for security, loss-prevention, or customer-tracking purposes.

No public evidence identified of The Body Shop deploying biometric payment systems (fingerprint, iris, palm-vein) in any market.

For payment acceptance, The Body Shop accepts major credit cards, PayPal, Google Pay, Apple Pay, and Buy Now Pay Later via Sezzle in the US market.¹³ These are mainstream Western payment processors; none are Israeli-domiciled.

No public evidence identified of automated checkout or AI-powered self-checkout technology deployment.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

The Body Shop’s SAP Commerce Cloud deployment runs on Microsoft Azure public cloud infrastructure, which is SAP’s standard hosting environment for Commerce Cloud (CCv2) customers.¹⁴ SAP operates data centres across Europe (including UK and EU regions), enabling GDPR-compliant data residency selection. No public disclosure by The Body Shop of their specific data-centre region selection has been identified.

The brand’s Shopify Plus implementation in Middle East markets (UAE, KSA) runs on Shopify’s global cloud infrastructure.⁶ Shopify is hosted on Google Cloud Platform globally.

The earlier Accenture-led cloud IT overhaul was described as a “cloud-based IT system” without a named hyperscaler provider.³

No public evidence identified of The Body Shop participating in any sovereign cloud programmes, government-facing data residency arrangements, or Israeli cloud infrastructure (such as AWS Israel, Azure Israel, or any Israeli-domiciled cloud provider).

No public evidence identified of data centre co-location agreements with Israeli-linked facilities.

Defence, Intelligence & Security Sector Technology Relationships

No public evidence identified of any relationship between The Body Shop and any defence, intelligence, or military sector technology provider or programme. The Body Shop is a cosmetics retailer with no disclosed or publicly traceable defence or intelligence sector technology relationships.

No public evidence identified of The Body Shop using Israeli-domiciled cybersecurity vendors such as Check Point Software (Israeli-founded, Tel Aviv–domiciled), CyberArk (Israeli-founded, US-domiciled), or Wiz (Israeli-founded, US-domiciled). No security vendor relationships of any kind are publicly disclosed by The Body Shop.

AI, Algorithmic & Autonomous Systems

The Body Shop has articulated an explicit ambition to become “an AI and data-first beauty company,” a phrase used publicly by Hitesh Amin, Chief Technology & Transformation Officer, in the context of both the RELEX Solutions and Centric PLM partnerships.¹⁰⁸

Active AI deployments identified from live sources:

1. AI-driven demand forecasting and replenishment via RELEX Solutions, deployed across global stores, franchises and distribution centres from October 2025.¹⁰ RELEX’s platform uses machine-learning demand modelling. RELEX is Finnish-domiciled.

2. AI-led skin analysis at the Oxford Street flagship, using face-mapping to identify skin concerns.¹² Vendor not publicly named; no evidence this is Israeli-domiciled.

3. Personalisation and recommendation engine via Sailthru (now Zeta Global), delivering cross-channel product recommendations aligned to purchase history and browsing behaviour.⁵ US-domiciled.

4. Centric PLM with AI-enabled capabilities for product lifecycle management (project management, artwork, compliance, sourcing) across UK, Asia, India, Middle East.⁸ US/France-domiciled.

No public evidence identified of The Body Shop deploying autonomous fulfilment robots, generative AI for customer service, or large-language-model-based product discovery tools at commercial scale.

No public evidence identified of The Body Shop’s AI systems being provided by Israeli-domiciled vendors.

Technology Ecosystem & R&D Footprint

The Body Shop maintains a product innovation and formulation laboratory at its global headquarters.¹⁵ R&D activity is concentrated on cosmetic formulation (ingredient sourcing, sustainability claims, biotech materials) rather than software or digital-technology intellectual property. There is no evidence of technology patents filed by The Body Shop in digital domains.

A materials R&D partnership with Newlight Technologies (US-domiciled) to develop AirCarbon bioplastic packaging has been publicly disclosed;¹⁵ this is a materials science collaboration, not a digital technology relationship.

The brand’s broader digital ecosystem partners - SAP, KPS UK, Accenture, Shopify, Odoo, RELEX, Centric, Talon.One, Sailthru - are all headquartered in Germany, the US, Canada, Belgium, Finland, or the UK. No technology ecosystem participant domiciled in Israel has been identified in live sources.

Auréa Group (parent, September 2024 onwards) has not made public disclosures about proprietary digital technology assets contributed to The Body Shop’s operations. Auréa Group acts are attributed at parent level unless brand-specific.

Civil Society Scrutiny & Regulatory History

BDS / boycott scrutiny: The Body Shop has been subject to BDS-movement boycott calls, primarily inherited from its former ownership by L’Oréal (attributed to L’Oréal as former owner, 2006–2017). The Body Shop itself has stated it has no stores in Israel and is not owned by L’Oréal.¹⁶ A separate Israeli business trading as “Body Shop” has caused public confusion, but it is not The Body Shop International Limited (see Economic and Political audits for the unresolved licensing question).¹⁶ Activist-aggregator claims linking The Body Shop to Israeli technology or digital suppliers are marked UNVERIFIED: no primary or credible secondary source corroborates an Israeli-domiciled technology or digital-supplier relationship.

ICO / GDPR regulatory history: No public evidence identified of The Body Shop receiving an enforcement notice, fine, or undertaking from the UK Information Commissioner’s Office (ICO) or any EU data protection authority. The Body Shop maintains a privacy policy, a DPO contact, and a cookie consent management mechanism on its website.¹⁷ No data breach notification involving customer personal data from The Body Shop has been identified in publicly searchable security incident databases for 2022–2025.

General data practices: The Body Shop’s cookie policy discloses use of functional and marketing cookies, and states that non-essential cookies require affirmative consent.¹⁷ No civil society organisation or regulatory body has published a specific investigation or criticism of The Body Shop’s digital data practices during the audit period (2024–2026).

End Notes