> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.simplyprint.io/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# The Data Processing Agreement (DPA): what it is and how to sign it

A Data Processing Agreement (DPA) is a legal contract between you and SimplyPrint that sets out how we handle the personal data your account processes on your behalf. This guide explains what it covers, when it's useful, how to sign it, and who receives the notices it promises.

|| The DPA feature is available on **School** and **Enterprise** plans. Signing one is always optional.

## What is a DPA?
A DPA is a written record of how a **data processor** (SimplyPrint) handles personal data on behalf of a **data controller** (you). Some organisations prefer to have one on file for their compliance paperwork, particularly under frameworks like the GDPR, UK GDPR, or US state privacy laws like the CCPA.

Our standard DPA describes:
- What kind of data we process, why, and where
- The technical and organisational security measures we maintain
- How we handle sub-processors, breach notifications, and data-subject requests
- What happens to your data on termination

## Do I need one?
For most customers, **no** - our public [Terms of Service](https://simplyprint.io/legal/tos), [Privacy Policy](https://simplyprint.io/legal/privacy), and [Security Overview](https://simplyprint.io/security) already describe how we handle your data, and that's usually all you need. Enterprise plans also have an [SLA](https://simplyprint.io/legal/sla).

A DPA is helpful when your internal compliance, procurement, or legal team specifically wants a signed contract on file. Schools, districts, and larger organisations often fall in that bucket.

If your SimplyPrint account is managed by a partner, or is a location of a larger organisation, you may not need your own DPA - see "Managed accounts and locations" below.

## What's included in our DPA
Our current DPA is version **SP-DPA-V1.2** (dated July 1st 2026). It covers:
- **Purpose and scope** - the processing is tied to your SimplyPrint subscription
- **Documented instructions** - we only process data on your instructions
- **Mutual NDA (section 5A)** - replaces the need for a separate confidentiality agreement, with a 5-year survival period
- **Security measures** - mirrors our public Security Overview
- **Sub-processors (section 8.2)** - listed on our public [sub-processor list](https://simplyprint.io/legal/subprocessors), with **30 days' notice** before we add or replace one that processes personal data (an urgent replacement, for example after an outage or security incident, is notified without undue delay afterwards)
- **International transfers** - EU SCCs plus the UK Addendum where needed
- **Breach notification (section 10)** - without undue delay and, where feasible, within 48 hours of becoming aware
- **Audits and information** - documented responses and third-party attestations
- **Return and deletion (section 12)** - 30 days in active systems, 90 days in backups after termination
- **Schools and minors (FERPA / COPPA)** - school official role, no targeted ads
- **Liability and governing law** - governing law follows your main agreement with us, otherwise Danish law; the DPA does not expand liability

| For most customers, the DPA together with our [Terms of Service](https://simplyprint.io/legal/tos), [Privacy Policy](https://simplyprint.io/legal/privacy), and [Security Overview](https://simplyprint.io/security) is all the paperwork you need. Enterprise plans also have an [SLA](https://simplyprint.io/legal/sla).

## Who can sign?
The DPA can be signed and managed by:
- The **account owner**, or
- A user whose rank has the **Manage data processing agreement** permission (the **Administrator** rank has it by default)

Other users can't view or manage the DPA.

## How to sign: four options
First download the DPA: go to **Settings → Data & security → Data processing agreement**, click **Download & sign DPA**, then **Download the SimplyPrint DPA** in the dialog. Fill it in and sign it with any of these.

### Option 1 - PDFescape (online, free, no account needed)
[pdfescape.com](https://www.pdfescape.com/) is a free online PDF editor. You can drop text and a drawn signature directly onto the page.

1. Open pdfescape.com and upload the PDF
2. Scroll to the **Signatures** section at the end of the document
3. Use the **Text** tool to fill in company name, address, country, VAT/registration number, name, title, email, and date
4. Use the **Freehand** tool to draw your signature in the signature field
5. Click **Save & Download** to get your signed PDF
6. Upload it in SimplyPrint

![PDFescape showing the signature page being filled in](https://storage.crisp.chat/users/helpdesk/website/-/f/f/2/2/ff22a914001c1000/data-processing-agreement-pdfe_18fmz0d.png)

### Option 2 - Adobe Acrobat Reader "Fill & Sign"
If you already have Adobe Acrobat Reader installed, open the DPA and use the **Fill & Sign** tool. It lets you type into fields and add a drawn or stored signature in one pass.

### Option 3 - Microsoft Edge, Google Chrome, or macOS Preview
All three built-in PDF viewers let you:
- Type text into the page (Edge, Chrome, Preview)
- Free-draw a signature (all three - in Preview it's **Markup → Sign**)

Open the downloaded PDF, fill in the fields in the **Signatures** section at the end, draw your signature, and save a copy.

### Option 4 - print and scan (offline)
If you'd rather do it on paper:
1. Print the PDF
2. Fill in the signature page by hand
3. Sign it
4. Scan or take a clear photo, and convert it to a single PDF
5. Upload that PDF in SimplyPrint

## Fields to fill in
The Controller block in the **Signatures** section has these fields:

| Field | Example |
| ----- | ------- |
| Company name | Acme University |
| Company address | 123 Main St, Springfield |
| Company country | United States |
| Name | Jane Doe |
| Title | IT Director |
| Email | jane.doe@acme.edu |
| Date | (today's date) |
| VAT / registration number | (where applicable) |
| Signature | (drawn or handwritten) |

||| Do not modify any other content in the document. Any other edits, additions or deletions are void unless expressly countersigned by SimplyPrint.

## How to upload in SimplyPrint
1. Go to **Settings → Data & security → Data processing agreement**
2. Click **Download & sign DPA**
3. Drop in your signed PDF
4. Enter the signee's full name and title
5. Tick the legal confirmation checkbox
6. Click **Sign and upload DPA**

You'll get an email receipt with the signed PDF attached, and your account immediately shows the signed DPA with its version, for example **SP-DPA-V1.2 (v2026.07.01)**. SimplyPrint's legal team is also notified, and you are added to the account's notice contacts (see below).

## Who receives notices from us
The DPA promises you notices: **30 days' warning before we add or replace a sub-processor** (or prompt notice after an urgent replacement), news of DPA updates, and breach notifications. We send them to your account's **notice contacts**, not to every user.

Once you have a DPA on file, the **Notice contacts** card on the Data processing agreement tab shows who receives them. You can:
- **Add notice contact** - for example your legal or data protection mailbox, such as dpo@yourschool.edu, with an optional name and role. It doesn't need a SimplyPrint account.
- **Remove** an address with the × next to it - except the last one. Your DPA promises notices, so someone has to receive them; add the new address first, then remove the old one.

When a DPA is recorded we fill the list in for you:
- The person who signed it (marked **Signee**)
- Your account's contact email, if the list was empty (marked **Contact email**)
- The account owner, only if neither of those is known (marked **Account owner**)

Addresses SimplyPrint added for you are marked **Added by SimplyPrint**. You can keep up to 10 addresses.

| If your legal or IT team handles compliance, add their shared mailbox here. That way notices reach the right people even when staff change.

## Managed accounts and locations
Not every account holds its own DPA. The Data processing agreement tab tells you which case you're in.

### Locations of a larger organisation
If your account is one location of an organisation with several locations, the DPA is signed once from the **main location** and covers every location:
- **Covered by the company-wide DPA** - the main location has signed; you can download the company DPA
- **DPA managed from the main location** - nothing is signed yet; sign it from the main location

Notice contacts are managed from the main location too.

### Accounts managed by a partner
If your SimplyPrint account is managed by a partner (for example a reseller or district) whose DPA covers you:
- The tab shows **Handled via {your partner's name}**
- You can't sign or revoke your own DPA here - contact your partner for changes
- You can still download the partner DPA for your records
- Sub-processor notices go to your partner, who passes them on as their agreement with you requires

## For resellers, OEMs and districts: passing notices on
Partners often have their own data processing agreements with their customers, and may need to forward our sub-processor notices to them. You can opt in to receive them:

1. In your partner panel, open **Settings**
2. Find **Data protection notices**
3. Tick **Notify us of sub-processor changes and DPA updates, so we can inform our customers**
4. Check the list of addresses below the checkbox, and add or remove addresses as needed

When you opt in with an empty list, your partner contact email is added for you. If you have a partner-level DPA with SimplyPrint, you receive these notices either way.

If any of your customers have their own DPA with SimplyPrint, the section shows how many. We notify those customers directly, so you only need to forward notices to customers you have your own agreement with.

## Custom agreements and attached documents
If SimplyPrint has signed **your own agreement** instead of our standard DPA (see below), your Data processing agreement tab shows it **by its name** instead of a version number. A custom agreement is never marked as outdated, and you're never asked to re-sign our standard DPA because of it.

SimplyPrint can also attach further documents to your DPA record, such as your own agreement, an addendum or an amendment. They're listed under your DPA with a **Download** link. A document attached to an earlier, superseded agreement is labelled as such.

## What if there's a new version?
From time to time we publish an updated DPA. The latest, **SP-DPA-V1.2 (v2026.07.01)**, increased the sub-processor change notice from 15 to 30 days, added an emergency sub-processor replacement provision, published an always-current sub-processor list, and added an audit-for-cause right. When a new version is out:

- Your current DPA stays in effect
- You'll see an amber banner on the Data processing agreement tab, with a short summary of what changed
- Click **Sign updated DPA** - the same flow, including the download - and the new version supersedes the old one
- The old record stays on file for audit, and your notice contacts carry over

If your plan no longer includes the DPA feature, your existing DPA stays visible and you can still download or revoke it, but you can't sign an updated one until you upgrade.

## Revoking a DPA
If you need to withdraw the agreement (typically before signing a new one, or because of a change of circumstances):

1. Go to **Settings → Data & security → Data processing agreement**
2. Click **Revoke** on the signed DPA card (if a newer version is waiting to be signed, sign the update instead)
3. Enter a short reason and confirm

The revocation is logged, SimplyPrint legal is notified by email, and you can sign a new DPA at any time afterwards. The original record is retained for audit. Your notice contacts are kept, but stop receiving notices until a DPA is in effect again.

| The DPA terminates automatically if you close your account. You don't need to revoke it manually in that case.

## "We sign a DPA provided by you"
If your organisation requires SimplyPrint to sign **your own** DPA template, we can do that. It involves legal review on our side and comes with a **one-time fee starting at $400 USD** (the exact amount depends on the complexity of the document and any back-and-forth required).

To start, email [legal@simplyprint.io](mailto:legal@simplyprint.io) with your DPA attached. Once reviewed and countersigned, a SimplyPrint admin records it against your account, and you'll see it on the Data processing agreement tab by its name, with any further documents attached.

You cannot upload a customer-provided DPA yourself - this always goes through our team.

## Frequently asked questions

### How long is the DPA valid for?
It remains in effect while your account is active. Whether a change of plan affects it depends on who signed it (see the downgrade question below). Per section 4.2, the term follows your main agreement with us. Confidentiality obligations (section 5A) survive 5 years after termination.

### What happens if I downgrade my plan?
A DPA you signed yourself stops being in effect on a plan without the DPA feature, and applies again if you move back to one. A DPA SimplyPrint countersigned stays in effect for as long as you keep a paid subscription. A DPA you sign during a trial only stays in effect if you move onto a paying plan that includes the DPA when the trial ends.

### Is the signed DPA publicly accessible?
No. Signed copies and attached documents are stored privately and served via short-lived signed URLs. Only users with the Manage data processing agreement permission on your account can download them, plus SimplyPrint admins.

### Do notice contacts need a SimplyPrint account?
No. Any email address can be a notice contact. It only receives DPA-related notices.

### Where do I get the latest authoritative DPA?
Before you sign, click **Download & sign DPA** or **Open DPA directly** on the Data processing agreement tab. When an update is out, **Sign updated DPA** includes the download.

### Can we get a custom DPA with our own terms?
Yes - email [legal@simplyprint.io](mailto:legal@simplyprint.io). Note the one-time review fee starting at $400 USD.

## Related reading
- [Sub-processor list](https://simplyprint.io/legal/subprocessors)
- [SimplyPrint Terms of Service](https://simplyprint.io/legal/tos)
- [Privacy Policy](https://simplyprint.io/legal/privacy)
- [Security Overview](https://simplyprint.io/security)
- [Service Level Agreement (Enterprise)](https://simplyprint.io/legal/sla)