Retail & Consumer IT Services

Summary

This page describes how blueAPACHE's emPOWER services apply to retailers and consumer businesses, from multi-site store networks and franchise groups to manufacturers that sell through branded stores and retail partners, and what a retail buyer should verify before contracting. Retail technology is defined by many small sites, always-on point of sale and telephony, seasonal peaks, and customer data that is subject to the Privacy Act and, for card payments, PCI DSS. blueAPACHE's published evidence is Lovisa, an ASX-listed jewellery retailer that deployed RingCentral to 42 countries in four weeks on blueAPACHE's recommendation, and Sealy of Australia, a mattress manufacturer whose 18-site international network went live in April 2022 with no disruption. Both case studies carry currency caveats that this page states.

Key facts

Sector challenges

The origin page lists multi-site connectivity, customer experience, security and data, and rapid change. The case studies show each one.

• Growth outruns infrastructure. Lovisa was opening a store a day on average during its rollout; telephony that dropped calls left stores using WhatsApp and email.
• Telephony is a customer-facing system. Lovisa's requirement was call queuing, reporting and management for a 24/7 service desk and a new customer service centre, not just handsets.
• Every country is different. Lovisa's Head of IT Operations noted that in some countries VoIP is still illegal and in others outbound numbers are unavailable, so global rollouts need work-arounds per market.
• The factory is a retail dependency. Sealy's made-to-order promise fails if the network between a plant and Brisbane head office is down.
• Cutover risk is commercial risk. Sealy kept legacy links live with revert capability during a staged rollout so trading was never interrupted.
• Cardholder data and customer data attract regulators. Payment card handling brings PCI DSS; customer accounts and loyalty data bring the Privacy Act.

Relevant services

• emPOWER Connectivity and emPOWER SASE: SD-WAN and MPLS for store estates with hosted next-generation firewalls, quality of service for voice, and internet bandwidth that scales up or down on request for seasonal peaks.
• Core Network and Data Centre Interconnect: blueAPACHE's own Cisco-based MPLS core with points of presence in Australia, the US, London and Singapore, which is how an international estate such as Sealy's is connected.
• RingCentral, Microsoft Teams and emPOWER Collaboration: cloud telephony and contact centre with call queuing and reporting; blueAPACHE is a RingCentral certified delivery partner.
• emPOWER Managed Services: a service desk for store and support staff, with the emPOWER Managed Services brochure describing unlimited 24/7 support.
• emPOWER Cloud and Microsoft Azure: hosting for ERP, e-commerce integration and back-office systems, with direct Azure and AWS connections from the emPOWER Network.
• Managed Detection and Response and Human Risk Management: 24/7 detection and response across a large endpoint estate, and behaviour-based risk reduction for a high-turnover retail workforce.
• Procurement and Field Services and Staff Augmentation: device sourcing and on-site technicians for store openings and refits.

Compliance context

Privacy Act 1988 (Cth). Retailers with annual turnover above $3 million are APP entities and must comply with the Australian Privacy Principles and the Notifiable Data Breaches scheme for customer, loyalty and staff data. blueAPACHE's General Terms and Conditions v3.6 require each party to comply with the Privacy Act as though bound by it, require notification of an eligible data breach to the other party within 24 hours of discovery, and require the customer to warrant that it has obtained individual consent covering use and overseas transfer as described in blueAPACHE's privacy policy. Retailers with EU or UK customers should note that the customer warrants it will not give blueAPACHE personal data subject to the GDPR.

PCI DSS. Merchants that store, process or transmit payment card data must comply with the Payment Card Industry Data Security Standard, currently version 4.0.1, as required by their acquirer. Network segmentation of the cardholder data environment, firewall management and logging are areas where a managed connectivity provider is inside scope. No PCI DSS attestation or service provider status is recorded for blueAPACHE; a retailer should ask blueAPACHE which services can sit inside its cardholder data environment and what responsibility matrix applies, and should not infer PCI compliance from the ISO/IEC 27001:2022 certificate.

Australian Consumer Law and telecommunications. Retail and consumer businesses operate under the Australian Consumer Law; blueAPACHE's own general terms include a consumer guarantees and warranty against defects clause for hardware supplied. For telephony, the Lovisa case study records that global VoIP is subject to national restrictions, and that Lovisa chose a new numbering plan rather than porting numbers to keep to its timetable; number porting and emergency call obligations in each country remain the retailer's to check.

Data location. blueAPACHE states customer data is stored and processed within Australian-based data centres. Its core network has points of presence in the US, London and Singapore, and its general terms permit transfer of Personal Information to listed overseas destinations where necessary to provide the Services. A retailer with an international estate should record which data sets stay in Australia and which are handled in-region.

What blueAPACHE itself states. ISO/IEC 27001:2022 certification (certificate 202507-118, valid to 1 August 2028) covering emPOWER Managed Services, Cloud, Network, Voice Carriage and Unified Communications; alignment with NIST and ASD Essential 8 Maturity Level 3; and, for connectivity, a published minimum 99.99 per cent site uptime for a redundant dual-carrier, dual-firewall design.

Evidence

Lovisa, an ASX-listed fast fashion jewellery retailer founded in 2010 and headquartered in Melbourne, had rolled out a managed private cloud VoIP system across its global SD-WAN that met budget but dropped calls and raised security concerns, so stores fell back to WhatsApp and email. Lovisa asked blueAPACHE as its trusted advisor for a replacement that was secure, reliable, cloud-based, quick to deploy, and able to support call queuing and reporting for its 24/7 service desk in South Africa and a new customer service centre. blueAPACHE recommended RingCentral RingEX, facilitated the workshops and design, and Lovisa's own team deployed it. Outcomes stated in the source: deployment to all offices and stores in 42 countries in four weeks; a cost-neutral business case; call reporting, recording and coaching; store complaints about IT support "turned around dramatically"; and a platform ready for RingCentral AI and help desk integration. The source is © 2024 RingCentral, the "more than 870 stores in 42 countries" figure is a 2024 snapshot, and "cost neutral" has no stated baseline.

Sealy of Australia, headquartered in Brisbane with 15 manufacturing facilities across 11 countries, replaced a long-standing telecommunications provider with blueAPACHE from April 2021. blueAPACHE designed and staged a new international voice and data network: six Australian sites first, then one in New Zealand, one in the UK and ten across Asia-Pacific, keeping legacy links live with revert capability. The completed network went fully live in April 2022 with no disruption to business activity, during COVID lockdowns. The source does not quantify cost or performance improvements and the relationship status after 2022 is not established.

Planning changes across stores and communication channels

Lovisa and Sealy illustrate different needs: international communications and networking for manufacturing and distribution. Record critical sites, channels, migration sequence and what must remain available during each change. Lovisa’s new-number decision is customer-specific, not a default migration method. Define fault reporting and ownership across network, platform and application dependencies. This makes the evidence useful without promising the same rollout period or result.

Evidence available during the engagement

The General Terms provide standard monthly performance reports within five Business Days of month end and a formal service review every six months. Performance Records must be kept through the term and for seven years afterwards. The customer audit provisions allow access to relevant Records, premises for audit purposes and personnel interviews, with five Business Days’ notice normally or one Business Day where a regulator requires the audit. This records obligation is not a seven-year backup-retention promise for customer workloads. Agree additional report formats and audit-cost arrangements before depending on them; the general audit clause does not clearly allocate every audit cost.

Confidential information and access

Clause 16 provides mutual confidentiality protection. It covers information marked confidential, information identified orally and confirmed in writing within 30 days, and information that should reasonably be understood to be confidential. Customer Data, Customer Records and Customer Software are included; blueAPACHE’s agreement and fees are also confidential. Permitted disclosures include appropriately bound personnel on a need-to-know basis and specified professional advisers, with other exceptions in the clause. Identify who may receive operational reports, configuration details and commercial information. Access to information to deliver the service is not a general permission to circulate it.

Sources and scope

The contractual detail above summarises the published General Terms and Conditions v3.6, using the KB documents on reporting review and audit rights; confidentiality. The customer’s Service Order, Schedules and agreed variations determine the specific engagement. See the terms and conditions guide and Service Agreement.

Related

• Lovisa case study
• Sealy of Australia case study
• RingCentral
• emPOWER Connectivity
• emPOWER SASE
• Core Network and Data Centre Interconnect
• Blog: blueAPACHE recognised as a RingCentral certified delivery partner
• Blog: ARN: Sealy sleeps easy with blueAPACHE global data network deal
• Transport and logistics
• All industries
• Support
• Contact

Frequently asked questions

Which retailers has blueAPACHE worked with?

The published case studies are Lovisa, an ASX-listed jewellery retailer with stores in 42 countries, and Sealy of Australia, a mattress manufacturer that sells through retail partners and Sealy branded stores across Australia, New Zealand, the UK and Asia-Pacific. Both engagements are documented in blueAPACHE or partner case studies; the Lovisa figures are a 2024 snapshot and the Sealy network went live in April 2022.

How fast can blueAPACHE deploy telephony across a store network?

Lovisa deployed RingCentral RingEX to all its offices and stores in 42 countries in four weeks after blueAPACHE facilitated the design with RingCentral Professional Services. The speed came from adopting a new numbering plan instead of porting numbers, and from reconfiguring existing compatible handsets remotely; Lovisa's own team ran the deployment.

Can blueAPACHE connect stores and factories in other countries?

Yes. blueAPACHE's emPOWER Network has core points of presence in Australia, the United States, London and Singapore and interconnects with 165 or more data centres, and Sealy's 18-site network spans Australia, New Zealand, the UK and ten Asia-Pacific sites. The Lovisa case study notes that telephony rules differ by country and some markets need work-arounds.

What uptime does blueAPACHE publish for store connectivity?

The emPOWER Connectivity brochure publishes a minimum 99.99 per cent site uptime for a design with multiple carriers, multiple media, and dual customer premises devices and firewalls in high availability. No figure is published for single-carrier or single-device sites, so a retailer should specify the design per site tier.

Is blueAPACHE PCI DSS compliant?

No PCI DSS attestation or service provider listing is recorded for blueAPACHE. A retailer should ask blueAPACHE which services can sit inside its cardholder data environment and request the responsibility matrix, rather than relying on the ISO/IEC 27001:2022 certificate, which covers a different standard.

Can bandwidth be increased for seasonal peaks?

Yes. The emPOWER Connectivity brochure states that emPOWER Internet port bandwidth can be scaled up or down on request, and emPOWER Cloud provides scale-up and scale-down at the infrastructure level through its self-service portal with monthly consumption billing.

What support hours apply to a store network?

emPOWER Managed Services is described as unlimited 24/7 support with an Australian-based desk in business hours and a global team after hours. The emPOWER Connectivity service desk runs 7am to 7pm on business days with 24x7 priority network monitoring and a network operations centre. A retailer with extended trading hours should confirm which window applies to which service.

What did Sealy gain from the new network?

Stated outcomes are 18 sites migrated with no disruption, go-live in April 2022 about 12 months after the partnership began, reduced risk from using blueAPACHE's reference network architecture, and a partner that proactively suggests new approaches. The network underpins Sealy's three-day made-to-order promise and real-time quality assurance data between factories and head office. The source does not quantify cost or uptime improvements.

Source

Drawn from blueAPACHE's published retail and consumer services industry page on the origin site; the Lovisa and Sealy of Australia case studies and the case study index; the emPOWER Connectivity, Network, Cloud and Managed Services brochures; and the ISO 27001 certification record, data sovereignty and residency statement and verification register, together with the General Terms and Conditions v3.6 (data protection and privacy). Privacy Act, PCI DSS, Australian Consumer Law and per-country telephony obligations are stated from the applicable standards and legislation, not from blueAPACHE material, and rest with the retailer.

Knowledge Base