Last updated: May 2026

At dPharmacy ("we", "us", "our"), your privacy matters to us. This policy explains what personal data we collect when you use dpharmacy.ie, why we collect it, what we do with it, and the rights you have over it. We comply with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Irish Data Protection Acts 1988 to 2018.

For information about returns, refunds and our sale terms, please see our Terms and Conditions.

1. Who We Are (Data Controller)

The data controller for personal data collected through dpharmacy.ie is:

• Total Care Pharmacy Ltd, trading as dPharmacy
• Registered office: Ardee, County Louth, A92 PX76, Ireland
• Company registration number (CRO): 524155
• VAT registration number: 01114074DH
• PSI registered retail pharmacy business
• Data protection contact: [email protected]
• Telephone: 041 685 7668

If you have any question about how we use your data, or you want to exercise any of your rights, contact us using the details above.

2. What Personal Data We Collect

2.1 Information you give us

• Account and contact details: name, email address, billing and delivery address, phone number.
• Order details: items purchased, payment confirmation reference (we do not store full card details).
• Communications: content of emails, messages, customer service queries and call notes.
• Marketing preferences: subscription status, channel preferences, segment data.
• Reviews and content: any reviews, ratings, or content you submit.

2.2 Information we collect automatically

• Technical data: IP address, device type, browser, operating system.
• Usage data: pages viewed, time on site, referring URL, products viewed and added to cart.
• Cookie and tracking data: see Section 5.

2.3 Health-related (special category) data

If you complete a health questionnaire for an over-the-counter medicine, or otherwise share health information with our pharmacist, that information is treated as special category data under Article 9 GDPR. We process it only with your explicit consent and only for the purpose of assessing whether the product can be supplied safely.

2.4 Information from third parties

We may receive information about you from payment processors (e.g. to confirm a payment cleared), couriers (e.g. delivery status), and analytics or advertising platforms where you have consented to share information with them.

3. Why We Use Your Data and the Legal Basis

You can withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

4. Marketing Communications

We will only send you marketing emails or SMS where you have given consent, or where you are an existing customer and we are contacting you about similar products in line with the ePrivacy Regulations 2011.

Every marketing email and SMS contains an unsubscribe option. You can also update your preferences or unsubscribe at any time by emailing [email protected].

We use Klaviyo as our email and SMS marketing platform. Klaviyo acts as a data processor on our behalf. See Section 7 for details.

5. Cookies and Tracking

When you first visit dpharmacy.ie you will see a cookie banner. We use:

• Strictly necessary cookies to make the website work (e.g. cart, checkout, login). These do not require consent.
• Analytics cookies to understand how the site is used (e.g. Google Analytics 4). Set only with your consent.
• Marketing and advertising cookies to measure campaign performance and show relevant ads (e.g. Meta Pixel, Google Ads). Set only with your consent.
• Personalisation cookies to remember your preferences and improve your experience. Set only with your consent.

You can change or withdraw your consent at any time using the cookie preferences link in the website footer. You can also block or delete cookies through your browser, but some site features may not work properly.

6. How Long We Keep Your Data

We keep personal data only for as long as needed for the purpose it was collected, and to meet legal obligations.

• Transaction and tax records: 6 years from the end of the relevant accounting period (Irish Revenue requirement).
• Customer account data: for as long as the account is active, then archived for up to 6 years to support tax and warranty obligations.
• Pharmacy and health questionnaire records: in line with PSI guidance, typically 2 years from the date of supply, longer where regulation requires.
• Marketing data: until you unsubscribe or for up to 24 months of inactivity, whichever comes first.
• Analytics data: typically retained in line with the default retention settings of the analytics platform.
• Customer service correspondence: up to 3 years.

After these periods, we either delete the data or anonymise it so it can no longer be linked to you.

7. Who We Share Your Data With

We do not sell your personal data. We share it only with trusted service providers who help us run the business. They act on our instructions under written data processing agreements.

These include:

• Payment processors (e.g. Stripe, Worldpay, or the payment providers shown at checkout) to process payments securely.
• Couriers and fulfilment partners (e.g. DPD, An Post, Fastway) to deliver your order.
• Klaviyo for email and SMS marketing communications.
• Google (Analytics, Ads, Tag Manager) for analytics and advertising, where you have consented.
• Meta (Facebook, Instagram) for advertising and pixel measurement, where you have consented.
• Hosting and IT providers that operate our website infrastructure.
• Review and customer feedback platforms where used.
• Professional advisers such as accountants and lawyers where strictly necessary.

We may also disclose personal data where required by law, regulator request, or to protect our rights or the safety of others.

In the event of a sale, merger or restructuring of the business, personal data may be transferred to the new owner. They will be bound by the same protections set out here.

8. International Transfers

Some of our service providers (notably Klaviyo, Google, and Meta) are based outside the European Economic Area, primarily in the United States. Where we transfer data outside the EEA, we rely on one of the following safeguards:

• The EU-US Data Privacy Framework where the provider is certified.
• Standard Contractual Clauses approved by the European Commission, with supplementary measures where appropriate.
• Other lawful transfer mechanisms recognised under GDPR.

You can request more information about these safeguards by contacting us using the details in Section 1.

9. How We Protect Your Data

We use a range of technical and organisational measures to keep your data safe, including:

• Encryption in transit (HTTPS/TLS) across the website and checkout.
• Access controls and role-based permissions for staff systems.
• PCI-DSS compliant payment processing handled by external providers (we do not store full card details on our systems).
• Monitoring and logging of system activity.
• Staff training on data protection and information security.
• Regular review of security controls in response to evolving threats.

No system is completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Irish Data Protection Commission within 72 hours and inform affected individuals as required by law.

10. Your Rights

You have the following rights in relation to your personal data:

• Right of access: request a copy of the data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure: ask us to delete your data in certain circumstances.
• Right to restrict processing: ask us to limit how we use your data in certain circumstances.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interest, and to object to direct marketing at any time.
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time.
• Right not to be subject to automated decision-making that produces legal or similarly significant effects (we do not currently carry out such processing).

To exercise any of these rights, email [email protected]. We will respond within one month. There is no charge for exercising your rights, although we may charge a reasonable fee or refuse requests that are clearly unfounded or excessive.

If you are unhappy with how we have handled your data, you have the right to complain to the Irish Data Protection Commission:

• Data Protection Commission
• 21 Fitzwilliam Square South, Dublin 2, D02 RD28
• Website: www.dataprotection.ie

11. Children

dpharmacy.ie is not intended for use by anyone under 18. We do not knowingly collect personal data from children. If you believe we hold data about a child, contact us and we will delete it.

12. Changes to This Policy

We may update this policy from time to time. The version published on the website at any given time is the version that applies. Material changes will be flagged on the website. The "Last updated" date at the top of this page shows when the policy was most recently revised.

13. Contact Us

For any question about this policy or how we handle your data:

• Email: [email protected]
• Telephone: 041 685 7668
• Mobile: 087 709 6499
• Post: Total Care Pharmacy Ltd, Ardee, County Louth, A92 PX76, Ireland