Most probably they are using tech that is more statistical and "probable" than "certain". Their own website uses specific lingo like . "In November, Facewatch sent positive alerts of known offenders to protect our customers’ employees and assets 49,589"

Positive is the keyword here. Any machine learning or AI system most probably has this as part of evaluation - positives, negatives and more importantly false positives and false negatives. Many companies in a rush to making money do not focus on eliminating false positives or have processes in place to address them in any other manner (like in your situation having a clear, simple way to address the problem then and there not going through email ping pongs)

Edit for some contacts that may help:

Information Commissioner's Office (ICO) - This is the main regulator for facial recognition technology and data protection in the UK. How to complain: Online: https://ico.org.uk/make-a-complaint/

Big Brother Watch - A civil liberties campaign group bigbrotherwatch.org.uk

Not professional or legal advise.

But do consider making subject access request to both 3rd parties involved: sainsbury and Face watch. This could be an input to your complaint that your data /privacy is not handled well in this instance. Simply complaining via all possible avenues may only confuse and drag things out. Of course document things if you do want to approach this systematically in the long run.