V-DIG Audit: Superdrug Stores plc

Target: Superdrug Stores plc Parent: A.S. Watson Group (subsidiary of CK Hutchison Holdings Ltd, Hong Kong) Registered Jurisdiction: England and Wales (Companies House no. 00807043) Audit Phase: V-DIG — Digital Forensics / Technology Supply Chain Evidence Base: Training-data knowledge (coverage through 2026-04); live web search unavailable during research session. All URLs require independent verification prior to formal publication.

Enterprise Technology Stack & Vendor Relationships

Core Commerce, CRM, and Operations Platforms

Superdrug’s publicly documented technology estate is built on a stack of US and European-origin enterprise platforms. In approximately 2021, the company migrated its e-commerce infrastructure to SAP Commerce Cloud, replacing a legacy platform, in a project reported by trade press ¹. SAP is a German-headquartered company; no Israeli-origin classification applies.

Customer engagement and loyalty operations are handled via Salesforce Marketing Cloud and Salesforce Commerce Cloud, confirmed through a Salesforce UK case study from approximately 2022 documenting how the company uses the platform for personalised beauty communications and loyalty programme management ^{2 3}. Superdrug’s loyalty app revamp was specifically attributed to Salesforce Marketing Cloud capabilities in trade coverage of the same period ³.

For master data management and product data governance, Superdrug entered a partnership with Informatica — a US cloud data management vendor — announced in approximately 2022 ⁴. This deployment addresses product information consistency across Superdrug’s omnichannel estate.

Point-of-sale and unified commerce operations are supported by Aptos (formerly Epicor Retail), a US retail technology vendor selected by Superdrug in approximately 2023 ⁵. Supply chain management technology was provided by Manhattan Associates, a US company, in a selection reported in approximately 2020 ⁶.

Superdrug’s e-commerce and API infrastructure runs on Google Cloud Platform, including deployment of Apigee for API management, as documented in Google Cloud’s customer case study materials ^{7 8}. Google Cloud is a US company. The company’s digital strategy — spanning loyalty, data, and omnichannel execution — was discussed publicly by Superdrug’s digital team at the 2023 Retail Technology Show and covered in trade media ⁹.

Israeli-Origin Software and Services

No public evidence identified of a direct licensing, subscription, or integration relationship between Superdrug and any Israeli-origin software or cybersecurity vendor. Specifically, no case study, press release, procurement record, trade-press report, or regulatory filing identifies Superdrug as a customer of any of the following: Check Point Software, Wiz, SentinelOne, CyberArk, NICE Systems, Verint Systems, Claroty, or Palo Alto Networks.

NICE Systems and Verint Systems both maintain active UK retail and contact centre customer bases ^{9 10}, but no publicly available source identifies Superdrug specifically as a customer of either company. No public evidence identified.

Parent-Group Technology Governance

A.S. Watson Group’s 2023 Sustainability Report ¹¹ and CK Hutchison Holdings’ Annual Reports ^{12 13} address group-level technology governance and IT risk. However, neither document disaggregates technology vendor relationships to the individual operating-company level. The identity of Superdrug-specific cybersecurity, infrastructure, or software vendors is therefore not confirmable from group-level public filings alone.

Procurement Intermediaries and Systems Integrators

No public evidence identified of a named systems integrator (e.g., Accenture, Capgemini, TCS, Wipro) engaged by Superdrug under a mandate that included the deployment of Israeli-origin technology. The SAP Commerce Cloud and Google Cloud deployments did not generate public disclosures naming an implementing partner. No public evidence identified of Israeli-origin technology being embedded in Superdrug’s enterprise infrastructure through an intermediary relationship.

Cybersecurity Vendor Stack — Evidentiary Gap

Superdrug does not publicly disclose its endpoint security, SIEM, firewall, or network monitoring vendors. No Companies House filing ¹⁴, investor document, or trade-press article names a cybersecurity vendor. The identity of Superdrug’s cybersecurity suppliers — Israeli-origin or otherwise — cannot be established from open sources. Whether Superdrug outsources security operations to a managed security services provider (MSSP) that itself relies on Israeli-origin technology as a sub-component (e.g., Check Point, SentinelOne, or CyberArk as MSSP platform components) is similarly not determinable from public sources.

Surveillance, Biometrics & Retail Technology

Facial Recognition and Biometric Identification

The four most significant UK civil-society and regulatory surveys of facial recognition in retail — conducted between 2022 and 2023 — do not identify Superdrug as a deploying retailer:

• Big Brother Watch’s June 2022 “Face Off: The Lawless Growth of Facial Recognition in UK Retail” report, which named several UK retailers using the technology including Southern Co-op and Facewatch deployments, did not name Superdrug ¹⁵.
• Which? magazine’s 2023 investigation into facial recognition in UK shops did not identify Superdrug as a user ¹⁶.
• The ICO’s 2023 update report on live facial recognition technology in public spaces did not identify Superdrug ¹⁷.
• Wired UK’s 2022 survey of which UK retailers use facial recognition did not list Superdrug ¹⁸.

No public evidence identified that Superdrug has deployed facial recognition, biometric identification, gait analysis, or behavioural analytics technology of Israeli origin. This specifically includes products from the following Israeli-origin or Israeli-founded vendors: Trigo, BriefCam, AnyVision/Oosto, and Trax.

Trigo’s publicly disclosed UK retail deployments at training cut-off included pilots with Tesco and Aldi; Superdrug is not named in any Trigo press release or case study ¹⁹. Oosto (formerly AnyVision) disclosed no UK health-and-beauty or grocery retail deployments at training cut-off ²⁰.

A 2022 UK Parliamentary written question on facial recognition retail use ²¹ did not name Superdrug in the ministerial response, providing further indirect negative evidence.

Predictive Analytics, Workforce Surveillance, and Social Media Monitoring

No public evidence identified of Superdrug deploying Israeli-origin predictive analytics platforms, social media monitoring tools, or workforce surveillance systems. Superdrug’s disclosed use of analytics is limited to consumer-facing personalisation (via Salesforce) and operational demand forecasting (via Manhattan Associates supply chain tooling) ^{2 6}.

In-Store Analytics and Loss Prevention — Evidentiary Gap

Superdrug has not published details of its in-store camera, analytics, or loss-prevention technology suppliers. The Big Brother Watch and ICO surveys provide indirect negative evidence — Superdrug is not named — but do not constitute a definitive audit of its in-store technology estate. The identity of Superdrug’s loss-prevention technology vendors cannot be confirmed from open sources.

Third-Party and Indirect Deployment

No public evidence identified that Israeli-origin surveillance technology reaches Superdrug indirectly via managed security services, bundled enterprise suites, or third-party platform providers.

Cloud Infrastructure, Data Residency & Sovereign Cloud Participation

Cloud Platform and Data Centre Footprint

Superdrug’s e-commerce infrastructure is publicly documented as running on Google Cloud Platform ^{7 8}, a US-domiciled cloud provider. No data centre operations in Israel are disclosed by Superdrug, A.S. Watson Group, or CK Hutchison Holdings in any public corporate filing at training cut-off ^{11 12}. Superdrug is a UK-market-only retailer with no disclosed operational presence in Israel.

A.S. Watson Group’s disclosed geographic footprint — as reported in its 2023 Sustainability Report ¹¹ — covers the UK, Ireland, and twelve markets across continental Europe and Asia. No Israeli data centre, co-location facility, or cloud region is referenced.

Government Cloud Programmes — Project Nimbus and Equivalents

No public evidence identified of Superdrug participating in any government cloud programme, including Israel’s Project Nimbus (a joint AWS/Google Cloud contract). Superdrug is a retail consumer business and technology consumer; it is not a cloud services vendor, platform provider, or IT services company. It does not appear on the UK Government’s G-Cloud supplier register as a technology provider ²².

Sovereign Cloud and Data Residency Services

No public evidence identified of Superdrug providing technology services, data infrastructure, or cloud capabilities to any state institution of any jurisdiction — Israeli, UK, or otherwise. Superdrug’s technology function is entirely inward-facing, serving retail operations, e-commerce, and customer loyalty.

Data Sub-Processor Disclosures — Evidentiary Gap

Superdrug’s privacy policy ²³ and Online Doctor privacy policy ²⁴ reference third-party data processors but do not publish a full, itemised sub-processor list. The identity of all data sub-processors — which might reveal indirect exposure to Israeli-origin cloud or analytics infrastructure — cannot be determined from published documents. This gap is material to a complete data residency assessment.

Defence, Intelligence & Security Sector Technology Relationships

Military and Intelligence Contracts

No public evidence identified. Superdrug is a high-street health-and-beauty retailer with no publicly disclosed contracts with any defence, intelligence, or military body in any jurisdiction.

Dual-Use Technology Provision

No public evidence identified. Superdrug does not develop, manufacture, or export technology products; it is a retail consumer of technology. No export licensing activity, dual-use goods registration, or defence procurement record has been identified in any public filing ¹⁴.

Offensive Cyber and Weapons Technology

No public evidence identified. Superdrug does not develop, sell, or license software products of any kind to any external party. This sub-category is structurally inapplicable to this target: Superdrug is a technology consumer, not a vendor.

Group-Level Technology Subsidiaries — Evidentiary Gap

CK Hutchison’s subsidiary entities include telecommunications operators (3 UK, Wind Tre, etc.) with their own technology infrastructure. Whether any group-level cybersecurity or cloud services contract — potentially covering Israeli-origin technology — extends to Superdrug’s IT estate through CK Hutchison shared services arrangements has not been disclosed publicly ^{12 13}. This constitutes a gap in the available evidence rather than a positive finding.

AI, Algorithmic & Autonomous Systems

AI/ML Products and Services

No public evidence identified of Superdrug developing, marketing, or selling AI or machine learning platforms, models, or services to any external party, including Israeli state bodies or entities operating in occupied territories.

Consumer-Facing and Operational AI Use

Superdrug’s publicly disclosed AI and machine learning applications are limited to:

• Personalisation and product recommendation — delivered through Salesforce Commerce Cloud and Marketing Cloud ^{2 3}, which are US-origin platforms.
• Demand forecasting and inventory optimisation — delivered through Manhattan Associates supply chain tooling ⁶, a US-origin platform.

No evidence has been identified that any data set originating in Israel or the occupied territories has been incorporated into Superdrug’s AI development or operational model training.

Autonomous Systems and Lethality

No public evidence identified. Structurally inapplicable: Superdrug is a retail consumer of technology with no involvement in autonomous weapons systems, drone technology, or any defence-adjacent autonomous system.

Algorithmic Decision-Making and Regulatory Exposure

Superdrug’s use of algorithmic systems for customer-facing decisions (pricing, personalisation, loyalty rewards) is subject to UK GDPR obligations administered by the ICO ²⁵. No ICO enforcement action relating to algorithmic decision-making, automated profiling, or AI-related data processing violations has been identified in publicly available ICO enforcement records.

Technology Ecosystem & R&D Footprint

Israeli R&D Centres and Engineering Presence

No public evidence identified. Superdrug has no offices, laboratories, or engineering facilities in Israel. A.S. Watson Group’s disclosed geographic footprint — covering the UK, Ireland, and twelve markets across continental Europe and Asia as reported in its 2023 Sustainability Report ¹¹ — includes no Israeli presence. CK Hutchison’s Annual Report 2023 ¹² similarly discloses no Israeli operations within the group.

Acquisitions of Israeli-Origin Technology Companies

No public evidence identified. Superdrug has made no publicly disclosed acquisition of any technology company, Israeli-origin or otherwise. At training cut-off, no Israeli technology company acquisition was disclosed in CK Hutchison Holdings’ annual reports ^{12 13} in relation to Superdrug’s technology operations.

Patent Portfolios and IP Arrangements with Israeli Entities

No public evidence identified. Superdrug holds no significant patent portfolio; it is a retailer, not a technology or pharmaceutical R&D company. No co-development arrangements with Israeli research institutions — including Technion, Hebrew University, Weizmann Institute, or other Israeli-domiciled research bodies — are disclosed in any public filing ¹⁴.

Health Clinic Technology and Patient Data

Superdrug Online Doctor operates an online clinical consultation service with its own patient data handling framework, governed by a separate privacy policy ²⁴. No Israeli-origin clinical technology, electronic health record systems, or health data processing partnerships are identified in any public document relating to Superdrug Online Doctor. Patient data is processed under UK GDPR and applicable health regulatory frameworks.

Modern Slavery and Supply Chain Transparency

Superdrug publishes an annual Modern Slavery Act Transparency Statement as required under UK legislation ²⁶. The statement addresses labour standards in physical supply chains; it does not address technology supply chain provenance, including the national origin of software vendors or digital infrastructure providers.

Civil Society Scrutiny & Regulatory History

NGO and Academic Investigations

No NGO investigation, academic study, or UN report specifically addressing Superdrug’s technology relationships with the Israeli state, operations in occupied territories, or Israeli-origin technology deployment has been identified in publicly available material at training cut-off. The following sources were assessed and returned no Superdrug-specific finding in this domain:

• Big Brother Watch — “Face Off” (2022) ¹⁵: Named other UK retailers deploying facial recognition; Superdrug not named.
• Which? — Facial recognition in UK shops investigation (2023) ¹⁶: Superdrug not identified.
• ICO — Live facial recognition update report (2023) ¹⁷: Superdrug not identified.
• Palestine Solidarity Campaign — corporate campaigns ²⁷: No dedicated Superdrug technology campaign identified.
• Ethical Consumer — Superdrug company profile (2024) ²⁸: Addresses supply chain ethics, labour standards, and animal testing; no reference to Israeli technology relationships.
• Wired UK — facial recognition retail survey (2022) ¹⁸: Superdrug not listed.

Boycott, Divestment, and Sanctions Campaigns

No public evidence identified of an organised boycott, divestment, or sanctions campaign specifically targeting Superdrug in relation to technology provision to Israeli state entities or operations in occupied territories. The BDS National Committee’s published boycott target lists for 2023–2024 do not name Superdrug ^{29 30}.

Superdrug has been subject to separate, unrelated consumer-facing boycott calls — concerning animal testing policies and parent-company labour practices — but these fall outside the V-DIG domain boundary and are noted here only for completeness.

ICO Regulatory Record

Superdrug is registered with the ICO as a UK data controller (registration Z6390376) ²⁵ and maintains GDPR-compliant privacy notices for its retail operations ²³ and Online Doctor service ²⁴. No ICO enforcement notice, monetary penalty notice, or formal undertaking relating to surveillance technology, Israeli data flows, or biometric data processing has been identified in publicly available ICO enforcement records.

UK Parliamentary Record

A 2022 UK Parliamentary written question on facial recognition retail use ²¹ did not name Superdrug in the ministerial response. No further Parliamentary questions, Early Day Motions, Select Committee evidence, or Hansard references specifically naming Superdrug in the context of surveillance technology or Israeli technology relationships have been identified.

End Notes