What an electronics retailer's CTO has to master before Boxing Day

Halvorne earns about a fifth of its annual online sales between Black Friday and the first week of January, so I run peak readiness as a programme that starts in June. We build a load forecast from the merchandise plan and the marketing calendar, then test at two and a half times that forecast against a production-sized environment. A waiting room admits visitors only as fast as checkout can serve them. Changes are frozen from 1 November to 6 January except for fixes approved by me and the duty commerce lead. Each October we hold game days on which we deliberately break a dependency, such as search, a carrier lookup or a payment provider, and rehearse the degraded mode. The mistake I see most often is sizing for traffic rather than for the slowest dependency. In 2021 ours was the store-stock lookup behind click-and-collect, so we now cache store availability every 90 seconds and say so on the page. At the Boxing Day 2025 opening we served 212,000 concurrent sessions and 540 orders a minute without a customer-facing outage.

A retailer's checkout depends on several payment providers it does not control: gateways, card acquirers, digital wallets and buy-now, pay-later services. I plan for each of them to fail on our busiest day. Since 2023 we have run two card gateways, and the second can now carry about 60 per cent of peak volume. When both are impaired, a deferred-authorisation mode accepts tokenised card details from signed-in returning customers for baskets up to A$2,500, excluding gift cards and the most-stolen product lines, and releases nothing to a warehouse or collection counter until payment is authorised. In stores, terminals can accept cards offline within limits we agree with our acquirer and send the transactions when the connection returns; we review those limits before every peak, because they are a deliberate trade between fraud and lost sales. Routing dual-network debit cards through the lower-cost network, where the customer has not chosen otherwise, saves about A$1.8 million a year. Tokenisation has kept stored card numbers out of our own systems entirely.

I prefer to replace retail platforms piece by piece behind a routing layer, moving one capability at a time and keeping the old path available until the new one has carried a peak. At Halvorne we moved search, product content, the cart, checkout, order management and promotions in that order, through 31 releases over 34 months. My working rule is that a step is small enough only if it can be reversed within an hour; changes that cannot be reversed by a route, such as a new order data model, run in parallel with daily reconciliation until every order agrees. The approach has costs I report openly. We spent about A$11 million running two systems together, the visible website redesign arrived a year later than our chief customer officer wanted, and engineers had to maintain knowledge of both systems. In exchange, the board could fund the programme in tranches, each with a release test, and could have stopped at any boundary holding something useful. Release frequency rose from monthly to about forty a week.

Retailers collect personal information for good reasons at the counter and then forget to forget it. My approach is to give every class of customer data a named business owner, a purpose and a deletion date, and to report the worst-case number of people exposed by a breach of each major system as a standing risk measure. Australian Privacy Principle 11 already expects organisations to destroy or de-identify personal information they no longer need, and the Notifiable Data Breaches scheme requires notification when a breach is likely to result in serious harm. Penalties rose sharply in late 2022, and the reforms passed in 2024 added a statutory tort for serious invasions of privacy and stronger enforcement tools. I leave legal interpretation to our general counsel and focus on the engineering: inventories of every store of personal data, including mailboxes and file shares, deletion that is verified and audited, backup retention short enough not to undo it, and new systems that cannot go live without a deletion design.

An electronics retailer's contact centre answers two different kinds of question. Most ask where an order is, whether a store has stock or what a product's specifications are; those can be answered from data we hold, and an assistant can answer them well. A smaller share concern faulty products, refunds and warranties, where customers hold rights under Australian Consumer Law that sit alongside any manufacturer's warranty. I design assistants around that boundary. Ours answers delivery, stock and specification questions only from our own carrier and product data, cites its source and says when it does not know. Any mention of a fault, return or warranty passes the conversation to a person with a summary, the order and the product's history. I measure resolution as no recontact within seven days rather than containment, because a customer who leaves with a wrong answer and returns is a cost, not a success. Test conversations are written with frontline agents, and we sample 400 live conversations a week against the order record.