What it takes for a supermarket to keep selling

I have replaced till or merchandising platforms at three retailers, and I plan them backwards from the trading calendar rather than forwards from a vendor's support date. At Ravessa that meant mapping the cost of a poor cutover for each week of the year, declaring freeze windows for Holy Week, the summer season in coastal stores and the seven weeks from mid-November to the Epiphany, and cutting stores over on Monday nights with a go or no-go decision at five the next morning. It also means treating the shop floor as part of the scope: counter scales, label printers, card terminals, cash-recycling machines and self-checkout security scales all touch the till. Our pilot found that 2.7 per cent of weighed fresh items scanned incorrectly because nobody had listed the scales. I now ask for a device inventory, tested in a trading store, before a programme reaches the board.

Every Ravessa supermarket now has two independent network paths, a fixed line and a mobile connection from a different carrier, and a small in-store server that holds prices, promotions and the product file. If the store loses both paths, its tills keep selling for up to seventy-two hours and send their transactions when the connection returns. I treat that offline capability as a product with an owner, a test schedule and a published limit, not as a contingency in a binder. Store-level network incidents that stopped tills fell from about 410 a year in 2017 to fewer than 40 in 2025. We rehearse a full disconnection in a trading store twice a year, on an ordinary weekday, with the store manager deciding when to end the exercise.

About four in five euros we take at the till arrive by card, so the card-processing chain is part of our trading capacity. After a 165-minute outage at our processor on the Saturday before Christmas 2023, I proposed a second acquirer with automatic routing, and limited offline acceptance for transactions up to €80 when both routes fail. Offline acceptance means the retailer carries the loss if a card is later declined, so the limits were agreed with our finance director and internal audit, operate only during a declared outage and end after three hours, when stores move to cash and other methods. The arrangement cost €1.7 million to build and adds about €0.4 million a year in fees. During the next outage, in September 2025, 97 per cent of card payments completed. I keep the arrangements within the card industry's data security standard, which our acquirers assess every year.

Our loyalty card has about three million active members and identifies 71 per cent of sales, which makes it both our most useful data and our largest privacy responsibility. Personalised offers rely on members' consent; analysis of shopping patterns at aggregate level relies on a documented legitimate-interest assessment that our data protection officer reviews. In 2023 I recommended deleting 1.1 million dormant profiles that had not been used for three years, which the commercial team opposed because the history had value to suppliers. The GDPR's principle of storage limitation applies to old data that might be useful as much as to data that is not. I also built our breach procedure around the regulation's requirement to notify the Spanish data protection authority, the AEPD, within seventy-two hours where feasible, and we met it in February 2023.

A supermarket's fresh promise is made at four in the morning on a loading dock. Since 2022 we have raised the share of inbound pallets announced by an advance shipping notice from 38 to 81 per cent of the 1,200 suppliers who deliver to our centres, and we now receive temperature records from every refrigerated trailer arriving at the fresh platform. That lets the platform redirect stock when a lorry is late instead of discovering a gap at the store. On forecasting, I introduced machine-learning orders for fresh lines in 2024 with explicit limits: the model orders automatically only in categories where its error range is narrow, store managers approve orders for fish, butchery and delicatessen counters, and every override is recorded with a reason. Fresh shrink fell from 4.6 to 3.9 per cent of fresh sales.

I have led one serious incident, the ransomware attack on our Guadalajara distribution centre in February 2023, and the experience changed how I prepare for the next. Decisions in the first hours depend on what was prepared before them: network segments that can be isolated separately, backups an attacker cannot reach, a list of who decides what, and pre-agreed wording for employees, the authorities and the market. Since 2023 every supplier with remote access uses multi-factor authentication through a monitored gateway, privileged accounts sit in a vault, and our distribution centres are separated from each other as well as from head office. We test restores every quarter and run an exercise with the executive committee and two board members each year. We have also prepared as though the EU's NIS2 directive applies to our distribution activity, without waiting for legal certainty on its reach.