Ask HN: How to report a security vulnerability to a non-tech firm

Good day! I have, by testing reflexes, found a vulnerability on an international recognized merchant website. It is a non-tech brand (not bug-bounty friendly). How do I proceed to report this vulnerability? I cannot seem to find a tech department for that particular company.

Thanks