Privacy notice
This notice explains how MacroMed Healthcare Limited, trading as Hayes First Aid, collects, uses, shares and keeps your personal data. Last updated 28 September 2026.
- Who we are and how to contact us about data protection
- What personal data we collect
- Why we use your data, our lawful basis, and how long we keep it
- Whether you have to give us your data
- Who we share your data with
- Transfers outside the European Economic Area
- Automated decision-making and profiling
- Your rights
- Complaints and the Data Protection Commission
- Cookies
- Age
- Changes to this notice
- We collect only what we need to take your order, run your account and run our website.
- We do not sell, rent or trade your personal data.
- Card payments, including Apple Pay, Google Pay and Link, are processed by Stripe. We never see or store your full card number.
- Analytics and advertising cookies are used only if you accept them in the cookie banner. You can change your choice at any time.
- Marketing consent is asked for separately. It is never a condition of placing an order or opening an account.
- You can ask us for a copy of your data, ask us to correct it, or ask us to delete it, free of charge.
- Data protection queries: sales@hayesfirstaid.com or 069 66006.
Personal data means any information that identifies you, or could identify you when combined with other information we hold. Your name, your delivery address and your IP address are all personal data.
Data controller means the organisation that decides why and how personal data is used. For everything described in this notice, that is us.
Processor means a company that handles personal data on our instructions and may not use it for its own purposes. Our delivery partner and our payment provider are processors.
Lawful basis means the reason the law allows us to use your data. Every use in this notice has one, and it is named in the table in section 3.
Consent means agreement you give freely, for a specific purpose, which you can withdraw at any time. Where consent is our basis, refusing or withdrawing it has no effect on your order.
Special category data means health data and other data the law treats as more sensitive. We do not ask for it. If you send us health information in a message, we use it only to answer you and we do not add it to your customer record.
Working Day means Monday to Friday, excluding Irish public holidays. We are closed on Irish public holidays.
1. Who we are and how to contact us about data protection
MacroMed Healthcare Limited, trading as Hayes First Aid, is the data controller for the personal data described in this notice. We process it under the General Data Protection Regulation (EU) 2016/679 and the Data Protection Acts 1988–2018.
| Registered name | MacroMed Healthcare Limited, trading as Hayes First Aid |
| Registered address | Castle Demesne, Newcastle West, Co. Limerick, V42 N220, Ireland |
| Company Registration Number | 510559 |
| VAT number | IE9824728C |
For anything to do with your personal data, including a copy of what we hold, a correction, a deletion, a withdrawal of consent or a complaint, contact us using any of the routes below. Please say that your query is about data protection so that it reaches the right person.
| sales@hayesfirstaid.com | |
| Post | Data Protection, Hayes First Aid, Castle Demesne, Newcastle West, Co. Limerick, V42 N220 |
| Phone | 069 66006 / 01 5079900 |
| Hours | Monday–Friday 09:00–17:00 (GMT). Closed on Irish public holidays. |
Data Protection Officer
We are not required to appoint a Data Protection Officer, and we have not appointed one. We are not a public authority, our core activity is selling first aid and medical equipment rather than monitoring people on a large scale, and we do not process special category data on a large scale. Data protection queries are handled through the contact details above.
2. What personal data we collect
- Account details: your name, email address and password (held encrypted, never in readable form). For an organisation account, the organisation name, the type of organisation, which sets the pricing on the account, and, if you give them, the organisation's VAT number and company number.
- Order details: billing and delivery addresses, phone number, the products you bought, and the order history on your account.
- Payment information: card payments, including Apple Pay, Google Pay and Link, are processed by Stripe. We receive confirmation that the payment succeeded, a payment reference, and the card type and last four digits so that we can match a refund to a payment. We never receive or store your full card number. If you pay by bank transfer or cheque, we record the payment against your order or invoice.
- Communications: messages you send us by email, WhatsApp, phone or the contact form on our website, and our replies. Where a call is recorded, we tell you at the start of the call.
- Website data: with your consent, information about how you use the website, collected through the cookies listed in our Cookie settings. This includes your IP address, which is personal data.
- Price display choice: if you choose to see prices with or without VAT, that choice is saved on your account when you are signed in, and in your browser when you are not.
- Complaints, returns and warranty records: what went wrong, what we did about it, and any evidence you sent us.
We do not ask for health information. Nothing on our website asks you why you are buying a product. If you include health information in a message, for example when describing an incident, we use it only to answer you, and we do not add it to your customer record or use it for marketing.
3. Why we use your data, our lawful basis, and how long we keep it
Every use of your personal data has a named lawful basis and a stated retention period. Where the basis is consent, you can withdraw it at any time and we will stop.
| What we do with it | Our lawful basis | How long we keep it |
|---|---|---|
| Fulfilling your order: taking the order, taking payment, picking, packing, dispatch, and dealing with any query about that order | Performance of our contract with you | For the life of the order, then as part of the order record (see the financial records row below) |
| Your account: sign-in, saved addresses, order history, reordering and invoices | Performance of our contract with you | While your account is active, and for a period afterwards in case of a query or a dispute |
| Delivery: giving your name, delivery address and phone number to DPD so that the parcel can be delivered and DPD can contact you about the delivery. Nothing is sent to DPD for a Click & Collect order. | Performance of our contract with you | Sent to DPD at dispatch. DPD then holds it under its own retention policy, which we do not control. Our copy stays with the order record |
| Payments: processing your card payment, including Apple Pay, Google Pay and Link, and any refund, through Stripe | Performance of our contract with you | We hold the payment reference, card type and last four digits with the order record. Stripe holds the card data under its own retention policy |
| Invoices and financial records: tax, accounting and audit | Legal obligation | 6 years, as required by Irish Revenue |
| Marketing: email newsletters, offers and product news | Your separate consent. It is asked for on its own and is never a condition of placing an order or opening an account. Saying no has no effect on your order | Until you withdraw consent or ask us to stop. We keep the record that you consented, and when, for as long as we rely on it and for a period afterwards to show that we had it |
| Analytics: understanding how people find and use the website so that we can improve it | Your consent, given through the cookie banner | Cookie lifetimes are listed in our Cookie settings |
| Advertising: measuring how our advertising performs and, where you allow it, showing you relevant advertisements | Your consent, given through the cookie banner | As set out in our Cookie settings |
| Answering you on the channel you chose: email, phone, WhatsApp or the contact form on our website | Performance of our contract where the message is about an order; otherwise our legitimate interest in answering a person who has contacted us | For as long as the conversation is open, and afterwards where it forms part of an order, complaint or warranty record |
| Complaints, returns, warranty and disputes | Performance of our contract with you, and legal obligation where a statutory right applies | For the life of the matter and while a claim could still be brought. Irish law allows a consumer to bring a claim for a faulty product for up to six years from delivery |
| Keeping the website and your account secure: preventing fraud, misuse and unauthorised access, and keeping the website working | Our legitimate interests. The interest is running a secure website and protecting our customers' accounts from use by someone else. We have weighed that against your interests, and it does not involve profiling you | Security and error logs are kept for a limited period |
4. Whether you have to give us your data
Some personal data is needed to supply you. The rest is optional.
- To buy from us, you must give us your name, a delivery address (unless you collect the order), a billing address, an email address and a phone number. This is a contractual requirement. Without it we cannot form a contract with you, take the payment or deliver the order. If you do not provide it, we cannot accept the order. There is no other consequence.
- To have an account, you must give us an email address and set a password. Without them there is no account to sign in to. You can buy from us without opening an account.
- Some information we are required by law to record. An invoice must carry certain details, and we must keep it for six years.
- Everything else is optional. Marketing, analytics, advertising and WhatsApp all rest on your consent. Saying no to any of them, or saying yes and later changing your mind, has no effect on your order, your account, your price or the service you receive.
5. Who we share your data with
We share your data only where it is needed to do what you asked for, or where the law requires it. We do not sell, rent or trade your personal data.
| Who | What they receive | Why |
|---|---|---|
| Stripe | Your card details, or your Apple Pay, Google Pay or Link payment, entered directly into Stripe's payment form, plus the order amount and reference | To take the payment and process any refund. Stripe is our payment processor |
| DPD | Your name, delivery address and phone number | To deliver your parcel and contact you about the delivery. Not used for Click & Collect orders |
| Only where you have accepted analytics or advertising cookies: website usage data and your IP address, through Google Analytics, Google Ads and Google Tag Manager | To measure how the website is used and how our advertising performs. Full detail is in our Cookie settings | |
| Your phone number and the content of your messages, where you choose to contact us on that channel | To hold the conversation you started. You do not have to use WhatsApp. Email and phone reach the same people | |
| Our website, hosting, email and IT providers | Access to the systems your data is held in, under contract and on our instructions only | To run and maintain our website and our business systems |
| Our accountants and professional advisers | Financial records, and only what a specific matter requires | Accounts, audit, tax and legal advice |
| Public authorities | Only what we are legally required to give | Where the law requires it, for example Revenue or a court order |
Each recipient receives the minimum needed to do its job, under a contract that requires it to handle the data on our instructions. None of them may use your data for their own marketing. Google is the exception: Google's own terms govern what it does with data collected through its services. That is why those cookies are off until you accept them, and why you can switch them off again at any time.
6. Transfers outside the European Economic Area
Some of your personal data is transferred outside the European Economic Area (EEA). This happens with the following providers:
- Google: Google Analytics, Google Ads and Google Tag Manager, where you have accepted analytics or advertising cookies. Google is a United States company.
- WhatsApp: where you choose to message us on that channel. WhatsApp is operated by a United States company.
- Stripe: our payment processor, which is a United States company with an Irish entity.
- Some of our website, hosting, email and IT providers, where the provider or its parent company is established outside the EEA.
Where your personal data is transferred outside the EEA, we rely on the safeguards permitted by the General Data Protection Regulation: either an adequacy decision of the European Commission covering the country or framework the recipient is certified under, or the European Commission's standard contractual clauses where no adequacy decision applies.
You can ask us which safeguard applies to a particular provider. Write to sales@hayesfirstaid.com and we will tell you the mechanism relied on and, if you ask, how to obtain a copy of it.
7. Automated decision-making and profiling
We do not make decisions about you by automated means that produce legal effects or similarly significantly affect you. No purchase, refund, return, complaint or account decision is made by a machine. A person decides, and you can ask that person for the reason.
Two things are automated, and neither is a decision about you in that sense:
- Payment fraud screening by Stripe. A card payment may be declined by Stripe's automated checks or by your own bank. If a payment is declined and you think it should not have been, contact us and we will look into it. You can also raise it with your bank.
- Website analytics, where you have consented. This measures how pages are used overall. It is not used to make decisions about you as an individual, to set your price, or to decide whether we will deal with you.
We do not use your data to build a profile of you, and we do not set prices based on your browsing. The pricing on an account is set by us according to the type of organisation.
8. Your rights
You have the following rights by law. Using any of them is free, and we will not treat you differently for using one.
| Your right | What it means |
|---|---|
| Access | Ask us for a copy of the personal data we hold about you, and for an explanation of what we do with it. |
| Rectification | Ask us to correct anything that is wrong, or to complete anything that is incomplete. |
| Erasure | Ask us to delete your data. We will do so unless we are required to keep it, for example an invoice we must hold for six years. If we cannot delete something, we will tell you which item and why. |
| Restriction | Ask us to pause the use of your data while a dispute about it is resolved. |
| Objection | Object to our use of your data where we rely on legitimate interests. Where you object to direct marketing, we will stop. |
| Portability | Ask for the data you gave us in a common machine-readable format, or ask us to send it to another provider where that is technically possible. |
| Withdraw consent | Withdraw any consent you gave, including for marketing, analytics, advertising or WhatsApp, at any time. Withdrawing consent is as easy as giving it. It does not affect what we lawfully did before you withdrew it. |
Email sales@hayesfirstaid.com, or call 069 66006 and say that your query is about data protection. We respond within one month. If a request is complex, we may need up to two further months. If so, we will tell you within the first month and explain why. We may need to confirm your identity before we release data, and we will ask only for what is needed to do that.
To stop marketing emails, use the unsubscribe link in any marketing email. It takes effect immediately. To change your cookie choices, use the Cookie settings link at the foot of any page.
9. Complaints and the Data Protection Commission
If you are unhappy with how we have handled your data, you can raise it with us first by emailing sales@hayesfirstaid.com or calling 069 66006. We will acknowledge it within 2 Working Days and give you a full response within 10 Working Days. If we need longer, we will tell you why and when to expect an answer.
You do not have to contact us first. You have the right to complain to the supervisory authority at any time, whether or not you have raised the matter with us.
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland.
www.dataprotection.ie
The Data Protection Commission is Ireland's independent supervisory authority for data protection. If you live in another EU country, you may also complain to the supervisory authority where you live or work.
10. Cookies
Our website uses cookies that are strictly necessary for it to work and, only with your consent, cookies for analytics and advertising. Strictly necessary cookies cannot be switched off, because the website cannot provide the service you asked for without them. All other cookies are off until you accept them.
You can change your choices at any time using the Cookie settings link at the foot of any page.
The full list of cookies, what each one does, how long it lasts and the legal position for each category is in our Cookie settings. Both documents state the same position: analytics and advertising rest on your consent.
11. Age
You must be 18 or over to place an order or open an account with us. This is a condition of our Terms and conditions, and it is why this notice is written for adults.
Our website is not directed at children, and we do not knowingly collect personal data from anyone under 18. If you believe a child has given us personal data, tell us at sales@hayesfirstaid.com and we will delete it.
We supply schools, clubs and youth organisations. In those cases our customer is the organisation, and the person we deal with is an adult acting for it. We do not collect data about the children the equipment is there to protect.
12. Changes to this notice
We update this notice when what we do changes, or when the law changes. The last-updated date on this page shows which version is current.
Where a change materially affects how we use your personal data, we will tell you by a notice on this page and, where we hold your email address and the change warrants it, by email. Where a change requires your consent, we will ask for it. We will not treat your continued use of our website as agreement to a change.
