The Data Processing Agreement (DPA): what it is and how to sign it
A Data Processing Agreement (DPA) is a legal contract between you and SimplyPrint that sets out how we handle the personal data your account processes on your behalf. This guide explains what it covers, when it's useful, how to sign it, and who receives the notices it promises.
What is a DPA?
A DPA is a written record of how a data processor (SimplyPrint) handles personal data on behalf of a data controller (you). Some organisations prefer to have one on file for their compliance paperwork, particularly under frameworks like the GDPR, UK GDPR, or US state privacy laws like the CCPA.
Our standard DPA describes:
- What kind of data we process, why, and where
- The technical and organisational security measures we maintain
- How we handle sub-processors, breach notifications, and data-subject requests
- What happens to your data on termination
Do I need one?
For most customers, no - our public Terms of Service, Privacy Policy, and Security Overview already describe how we handle your data, and that's usually all you need. Enterprise plans also have an SLA.
A DPA is helpful when your internal compliance, procurement, or legal team specifically wants a signed contract on file. Schools, districts, and larger organisations often fall in that bucket.
If your SimplyPrint account is managed by a partner, or is a location of a larger organisation, you may not need your own DPA - see "Managed accounts and locations" below.
What's included in our DPA
Our current DPA is version SP-DPA-V1.2 (dated July 1st 2026). It covers:
- Purpose and scope - the processing is tied to your SimplyPrint subscription
- Documented instructions - we only process data on your instructions
- Mutual NDA (section 5A) - replaces the need for a separate confidentiality agreement, with a 5-year survival period
- Security measures - mirrors our public Security Overview
- Sub-processors (section 8.2) - listed on our public sub-processor list, with 30 days' notice before we add or replace one that processes personal data (an urgent replacement, for example after an outage or security incident, is notified without undue delay afterwards)
- International transfers - EU SCCs plus the UK Addendum where needed
- Breach notification (section 10) - without undue delay and, where feasible, within 48 hours of becoming aware
- Audits and information - documented responses and third-party attestations
- Return and deletion (section 12) - 30 days in active systems, 90 days in backups after termination
- Schools and minors (FERPA / COPPA) - school official role, no targeted ads
- Liability and governing law - governing law follows your main agreement with us, otherwise Danish law; the DPA does not expand liability
Who can sign?
The DPA can be signed and managed by:
- The account owner, or
- A user whose rank has the Manage data processing agreement permission (the Administrator rank has it by default)
Other users can't view or manage the DPA.
How to sign: four options
First download the DPA: go to Settings → Data & security → Data processing agreement, click Download & sign DPA, then Download the SimplyPrint DPA in the dialog. Fill it in and sign it with any of these.
Option 1 - PDFescape (online, free, no account needed)
pdfescape.com is a free online PDF editor. You can drop text and a drawn signature directly onto the page.
- Open pdfescape.com and upload the PDF
- Scroll to the Signatures section at the end of the document
- Use the Text tool to fill in company name, address, country, VAT/registration number, name, title, email, and date
- Use the Freehand tool to draw your signature in the signature field
- Click Save & Download to get your signed PDF
- Upload it in SimplyPrint
Option 2 - Adobe Acrobat Reader "Fill & Sign"
If you already have Adobe Acrobat Reader installed, open the DPA and use the Fill & Sign tool. It lets you type into fields and add a drawn or stored signature in one pass.
Option 3 - Microsoft Edge, Google Chrome, or macOS Preview
All three built-in PDF viewers let you:
- Type text into the page (Edge, Chrome, Preview)
- Free-draw a signature (all three - in Preview it's Markup → Sign)
Open the downloaded PDF, fill in the fields in the Signatures section at the end, draw your signature, and save a copy.
Option 4 - print and scan (offline)
If you'd rather do it on paper:
- Print the PDF
- Fill in the signature page by hand
- Sign it
- Scan or take a clear photo, and convert it to a single PDF
- Upload that PDF in SimplyPrint
Fields to fill in
The Controller block in the Signatures section has these fields:
Field | Example |
|---|---|
Company name | Acme University |
Company address | 123 Main St, Springfield |
Company country | United States |
Name | Jane Doe |
Title | IT Director |
Date | (today's date) |
VAT / registration number | (where applicable) |
Signature | (drawn or handwritten) |
How to upload in SimplyPrint
- Go to Settings → Data & security → Data processing agreement
- Click Download & sign DPA
- Drop in your signed PDF
- Enter the signee's full name and title
- Tick the legal confirmation checkbox
- Click Sign and upload DPA
You'll get an email receipt with the signed PDF attached, and your account immediately shows the signed DPA with its version, for example SP-DPA-V1.2 (v2026.07.01). SimplyPrint's legal team is also notified, and you are added to the account's notice contacts (see below).
Who receives notices from us
The DPA promises you notices: 30 days' warning before we add or replace a sub-processor (or prompt notice after an urgent replacement), news of DPA updates, and breach notifications. We send them to your account's notice contacts, not to every user.
Once you have a DPA on file, the Notice contacts card on the Data processing agreement tab shows who receives them. You can:
- Add notice contact - for example your legal or data protection mailbox, such as dpo@yourschool.edu, with an optional name and role. It doesn't need a SimplyPrint account.
- Remove an address with the × next to it - except the last one. Your DPA promises notices, so someone has to receive them; add the new address first, then remove the old one.
When a DPA is recorded we fill the list in for you:
- The person who signed it (marked Signee)
- Your account's contact email, if the list was empty (marked Contact email)
- The account owner, only if neither of those is known (marked Account owner)
Addresses SimplyPrint added for you are marked Added by SimplyPrint. You can keep up to 10 addresses.
Managed accounts and locations
Not every account holds its own DPA. The Data processing agreement tab tells you which case you're in.
Locations of a larger organisation
If your account is one location of an organisation with several locations, the DPA is signed once from the main location and covers every location:
- Covered by the company-wide DPA - the main location has signed; you can download the company DPA
- DPA managed from the main location - nothing is signed yet; sign it from the main location
Notice contacts are managed from the main location too.
Accounts managed by a partner
If your SimplyPrint account is managed by a partner (for example a reseller or district) whose DPA covers you:
- The tab shows Handled via {your partner's name}
- You can't sign or revoke your own DPA here - contact your partner for changes
- You can still download the partner DPA for your records
- Sub-processor notices go to your partner, who passes them on as their agreement with you requires
For resellers, OEMs and districts: passing notices on
Partners often have their own data processing agreements with their customers, and may need to forward our sub-processor notices to them. You can opt in to receive them:
- In your partner panel, open Settings
- Find Data protection notices
- Tick Notify us of sub-processor changes and DPA updates, so we can inform our customers
- Check the list of addresses below the checkbox, and add or remove addresses as needed
When you opt in with an empty list, your partner contact email is added for you. If you have a partner-level DPA with SimplyPrint, you receive these notices either way.
If any of your customers have their own DPA with SimplyPrint, the section shows how many. We notify those customers directly, so you only need to forward notices to customers you have your own agreement with.
Custom agreements and attached documents
If SimplyPrint has signed your own agreement instead of our standard DPA (see below), your Data processing agreement tab shows it by its name instead of a version number. A custom agreement is never marked as outdated, and you're never asked to re-sign our standard DPA because of it.
SimplyPrint can also attach further documents to your DPA record, such as your own agreement, an addendum or an amendment. They're listed under your DPA with a Download link. A document attached to an earlier, superseded agreement is labelled as such.
What if there's a new version?
From time to time we publish an updated DPA. The latest, SP-DPA-V1.2 (v2026.07.01), increased the sub-processor change notice from 15 to 30 days, added an emergency sub-processor replacement provision, published an always-current sub-processor list, and added an audit-for-cause right. When a new version is out:
- Your current DPA stays in effect
- You'll see an amber banner on the Data processing agreement tab, with a short summary of what changed
- Click Sign updated DPA - the same flow, including the download - and the new version supersedes the old one
- The old record stays on file for audit, and your notice contacts carry over
If your plan no longer includes the DPA feature, your existing DPA stays visible and you can still download or revoke it, but you can't sign an updated one until you upgrade.
Revoking a DPA
If you need to withdraw the agreement (typically before signing a new one, or because of a change of circumstances):
- Go to Settings → Data & security → Data processing agreement
- Click Revoke on the signed DPA card (if a newer version is waiting to be signed, sign the update instead)
- Enter a short reason and confirm
The revocation is logged, SimplyPrint legal is notified by email, and you can sign a new DPA at any time afterwards. The original record is retained for audit. Your notice contacts are kept, but stop receiving notices until a DPA is in effect again.
"We sign a DPA provided by you"
If your organisation requires SimplyPrint to sign your own DPA template, we can do that. It involves legal review on our side and comes with a one-time fee starting at $400 USD (the exact amount depends on the complexity of the document and any back-and-forth required).
To start, email legal@simplyprint.io with your DPA attached. Once reviewed and countersigned, a SimplyPrint admin records it against your account, and you'll see it on the Data processing agreement tab by its name, with any further documents attached.
You cannot upload a customer-provided DPA yourself - this always goes through our team.
Frequently asked questions
How long is the DPA valid for?
It remains in effect while your account is active. Whether a change of plan affects it depends on who signed it (see the downgrade question below). Per section 4.2, the term follows your main agreement with us. Confidentiality obligations (section 5A) survive 5 years after termination.
What happens if I downgrade my plan?
A DPA you signed yourself stops being in effect on a plan without the DPA feature, and applies again if you move back to one. A DPA SimplyPrint countersigned stays in effect for as long as you keep a paid subscription. A DPA you sign during a trial only stays in effect if you move onto a paying plan that includes the DPA when the trial ends.
Is the signed DPA publicly accessible?
No. Signed copies and attached documents are stored privately and served via short-lived signed URLs. Only users with the Manage data processing agreement permission on your account can download them, plus SimplyPrint admins.
Do notice contacts need a SimplyPrint account?
No. Any email address can be a notice contact. It only receives DPA-related notices.
Where do I get the latest authoritative DPA?
Before you sign, click Download & sign DPA or Open DPA directly on the Data processing agreement tab. When an update is out, Sign updated DPA includes the download.
Can we get a custom DPA with our own terms?
Yes - email legal@simplyprint.io. Note the one-time review fee starting at $400 USD.
Related reading
- Sub-processor list
- SimplyPrint Terms of Service
- Privacy Policy
- Security Overview
- Service Level Agreement (Enterprise)
Updated on: 03/10/2026
Thank you!