Zara is a brand of Inditex, whose group privacy policy identifies the data controller as 'INDUSTRIA DE DISEÑO TEXTIL, S.A. (Inditex, S.A)', a Spanish company headquartered in Arteixo (A Coruña), Spain, acting as parent company of the Inditex Group (which also owns Pull&Bear, Massimo Dutti, Bershka, Stradivarius, Oysho, Zara Home and Lefties); the Zara iOS app's App Store seller matches this exact legal name. The group privacy policy states personal data (identity, transaction, and browsing/connection data) is accessed by other Inditex Group entities and by third-party technology and customer-support service providers, including providers outside the EEA under Privacy Shield certification or Standard Contractual Clauses, and that cookies are used to show advertisements based on browsing habits. The Zara app's own App Store privacy label self-declares a 'Data Used to Track You' category (Identifiers), a direct admission of cross-app/cross-site ad tracking, alongside broad identity-linked collection (purchases, search history, contact info, payment info). Have I Been Pwned's breach catalog lists a Zara incident (zara.com, breach date 2026-04-15) affecting approximately 197,376 accounts, with email addresses, geographic locations, purchases, and support tickets among the exposed data classes; no AEPD enforcement action could be confirmed from a primary Spanish Data Protection Agency (AEPD) or Inditex page (aepd.es was not reachable and no alternative primary source could be located), and the policy does name the AEPD as the relevant complaint authority.
TRACK RECORD
1 BREACH
[2026-04-15] · BREACH
Have I Been Pwned lists a breach record for Zara: "Zara".
Approximately 197,376 accounts affected, per HIBP.
Exposed: Email addresses, Geographic locations, Purchases, Support tickets.
Inditex's group Privacy Policy states that, depending on the purpose, it processes users' identity data (name, surname, language and market of interaction, contact data), transaction information (information on purchase tickets, orders, and returns), and connection and browsing data.
Inditex's group Privacy Policy identifies the data controller as INDUSTRIA DE DISEÑO TEXTIL, S.A. (Inditex, S.A), a Spanish company that acts as parent company of the Inditex Group, with a postal address at Avda. de la Diputación, Edificio Inditex, 15143, Arteixo (A Coruña), Spain, and a named Data Protection Officer e-mail contact.
Inditex's group Privacy Policy states that, per the policy, access to personal data is given to entities of the Inditex Group and to third parties that provide support services (technological service providers, customer support providers), and that where such providers are located outside the European Economic Area, data transfers are protected either by Privacy Shield certification or by EU Commission-approved Standard Contractual Clauses; the Cookies section separately states cookies may be used to show advertisements based on browsing habits.
Inditex's group Privacy Policy states that users have the right to file a claim before the responsible data protection regulatory authority, specifically before the Spanish Data Protection Agency (AEPD), a named regulator complaint channel; no specific past enforcement action, breach, or audit was described on the page, and this research could not independently query the AEPD's own site (403 under the pipeline UA) for any action against Inditex/Zara within budget.
Have I Been Pwned's breach catalog lists the "Zara" incident (zara.com), breach date 2026-04-15, affecting approximately 197,376 accounts. Data classes exposed per HIBP: Email addresses, Geographic locations, Purchases, Support tickets. Source: Have I Been Pwned (haveibeenpwned.com), CC BY 4.0.
The Zara iOS app's App Store privacy label self-declares a 'Data Used to Track You' category — data used to track the user across apps and websites owned by other companies — covering Identifiers; the app also declares identity-linked Contact Info and Identifiers used for the developer's own advertising or marketing.