---

View change history

2026-11-03

• netcup (cloud slicing and other heavy processing, in the EU) and Bird (SMS notifications, only if you turn them on) are now on our list of current sub-processors. We announced both in advance on our Sub-Processors list and gave notice on 3 October 2026; that notice period has now passed. Bird keeps your data in its EU region; the list states its transfer basis.
• We no longer name the individual countries our hosting is in: all of it is in the EU, and your data is still stored in the EU by default.
• Removed OneSignal from our list of sub-processors. We no longer use it, and push notifications to the mobile app go directly through Apple and Google.
• Added "Security incidents and data breaches": how we contain, assess, notify and fix a personal data breach, and who we tell and how fast. Organisations that manage accounts hear from us within 48 hours where feasible, as our Data Processing Agreement already promised.
• Added "If SimplyPrint changes ownership": personal data only moves to a new owner as part of the transaction, the new owner must keep this policy and any Data Processing Agreement, account owners are told by email before the transfer, and you can export and delete your data first.
• "Changes to our privacy policy" now says how we announce a material change: an email to account owners at least 30 days ahead, a notice on this page, and a notice in SimplyPrint. Sub-processor changes keep their own advance notice. Our Data Processing Agreement already promised the 30 days.
• Described what we store about students and what we never do with it, how our staff access accounts and when engineers may work with a specific file to fix a fault, that backups are stored in the EU with the rest of your data, and that we don't host customer data on our own premises.
• Rewrote the Data Processing Agreement section: School and Enterprise accounts sign it themselves in SimplyPrint, and we also sign institutions' own agreements. Listed the documentation we provide for privacy and security reviews.
• Named the Danish Data Protection Agency (Datatilsynet) as the authority to complain to, in place of the UK Information Commissioner, and added [email protected] for data protection matters.

2026-10-20

• Added a note on affiliate links: some links to shops are affiliate links, the shop or affiliate network may set its own cookies once you click through, and we send them no personal data. It also says what we record when you click a shop link, a deal or an Amazon search through SimplyPrint: what was clicked, from which page, your country and, when we know it, your user and account. No IP address, and it is deleted with your account.

2026-10-03

• Moved the earliest start date for netcup and Bird, our two planned sub-processors, from 1 November to 3 November 2026. Neither is processing any data yet.

2026-09-27

• Added a "Connected stores and marketplaces" section for SimplyPrint Shop, an optional feature in a closed pilot. It applies only if you connect an online store or marketplace to SimplyPrint, and describes what we read, that we act as your processor for that data, what we never do with it, and what happens when you disconnect.
• Described the SimplyPrint mobile app's push notifications: the push token and device details the app registers, and what a notification contains. Listed the services that deliver them - Apple, Google and OneSignal - on the Sub-Processors page. These services have delivered our push notifications all along; they were not listed before.
• Added that we keep a log of the push notifications we send to your devices, including whether each was delivered and opened, for 30 days to troubleshoot delivery, and only totals after that.
• OneSignal is being phased out: by 1 November 2026 we stop using it and delete our data there, and push notifications go directly through Apple and Google.
• Noted that Apple's push notification service is the one provider outside the EU/EEA without the Data Privacy Framework or Standard Contractual Clauses: Apple provides it under its own developer terms.

2026-09-25

• Announced Bird as a planned sub-processor for SMS notifications, from 1 November 2026 at the earliest. It is not processing any data yet.

2026-09-21

• Announced netcup as a planned sub-processor for additional EU hosting capacity, from 1 November 2026 at the earliest. It is not processing any data yet.

2026-08-10

• Replaced external IP geolocation with a locally hosted MaxMind GeoLite2 database, so IP addresses are no longer sent to an IP geolocation provider.

2026-07-11

• Disclosed Zapier embed on the /integrations/zapier page as a third-party widget - it stores a visitor identifier in your browser's localStorage (Zapier's own widget behavior, not used by SimplyPrint for tracking or analytics)
• The Zapier embed is consent-gated and only loads on that specific page after you opt in
• Added Zapier's visitor identifier to the cookie/localStorage policy list

2026-07-01

• Moved the full third-party sub-processor list to a dedicated, always-current page (Sub-Processors) and linked to it from this policy. The new page lists each provider's legal entity, registered address, country, the data they process, where it is processed, and the transfer basis, and is available as a PDF on request.

2026-05-29

• Added a "How long do we keep your data?" section clarifying our data retention periods, including that after account deletion we may keep a minimal set of transaction and security data for up to around 13 months to defend payment disputes and prevent fraud, and accounting records for longer where required by law.

2026-05-23

• Added a US K-12 districts subsection under the existing DPA section, noting SimplyPrint has signed the SDPC / TEC multi-state National Data Privacy Agreement (NDPA v1.0) for 15 US states.

2026-01-28

• Added "Schools & Organizations" section: managed accounts (students/employees) never receive marketing or attribution cookies
• Switched from Google reCAPTCHA to Cloudflare Turnstile for bot protection (privacy-preserving, no tracking)
• Switched geo IP provider from geoplugin.com to ipinfo.io (both in third-parties and Print jobs section)
• Removed "Dinero" accounting system (reduced third-parties)
• Clarified Arcade does not place any cookies
• Clarified YouTube cookies are set when you choose to load a video
• Updated third-party embeds policy: consent banner applies if you've accepted Functional cookies
• Rewrote tracking/consent sections
• Added geographic consent handling
• Consolidated cookie section
• New attribution purpose
• Updated subprocessor data sharing

2025-09-19

• Privacy Policy v2 released

2022-10-30

• Initial Privacy Policy

Privacy policies are boring, complicated, legal mumbo jumbo, so let's start with a quick overview.

---

At SimplyPrint, we aim to only collect the minimum required data on our users. This means, we only ask for our user’s phone number if they want a text message when their print is finished, and we only ask for their address when required for invoicing. We wish to be fully transparent in how we use your data. This privacy policy will explain what data we collect, how we use it, and what rights you have regarding your data.

What data do we collect?

Our company collects the following data:

• Personal identification information; first name, last name, email address, and optionally phone number and address upon paid subscription. Email address is optional for SSO (Single Sign On) users.
  • When you sign in via Single Sign-On (SSO) or a federated identity provider, we receive attributes such as name, possibly email address, organizational affiliation, and group membership from your institution’s identity provider.
• Company details for our Enterprise subscription; company name, email, country and timezone, address and billing address, possibly phone number, full name of att. person, company VAT number, possibly EAN number in Denmark.
• User info; on each user, other than the mentioned personal identification information above, we store info about login sessions and the IP address of those sessions, as well as which pages within SimplyPrint the user visited during the given session, and how long the session was. An action log of every action the user makes within the SimplyPrint platform (like starting a print, cancelling, etc.), with the IP and possibly country, city, and region of the action. This is done to help the user undo their actions, and for organizational profiles to see which user did what. The user’s password is also stored in our databases, using a one-way hash function.
• User files & folders; full file content, file name and extension, date uploaded, and name of folders.
• Printers; Each printer is powered by a device that communicates with SimplyPrint. For each device, we collect network information such as SSID, MAC address, and local IP address (private network). Additionally, we collect its public IP address, which is used to pair pending printers (that are pending setup) with the user. We also gather device specifications, including model information (e.g., Raspberry Pi 4B), machine hostname, CPU details, and memory capacity, as well as device software details like the version of OctoPrint and a list of installed plugins. We collect real-time updates from the printer, including temperature, print job status, and other operational metrics, to provide users with current information for remote monitoring. Printer-specific data, such as firmware version, ambient temperature, and auto bed leveling (ABL) data, may also be collected. If enabled by the user, the printer's downtime is logged, noting the start and end times of any lost internet connection.
• Print jobs; each print a printer that is connected to SimplyPrint starts is logged; whether it’s started via SimplyPrint or any other way (SD card, OctoPrint, etc.), as long as the Raspberry Pi/machine running SimplyPrint is connected to the printer. For each print job, we collect; date of start and finish, number of times the print was paused, if the print finished, failed, or was cancelled, percentage reached, time left of the print, ID of user that prints, filament usage (either calculated via SimplyPrint, or provided by the printer itself/local services such as OctoPrint), local name of the printed file, slicer used (when printed through SimplyPrint & analyzed), and an approximate country and, when available, longitude/latitude coordinates where the print was started together with their accuracy radius. We derive this location on SimplyPrint's servers from the machine's public IP address using a locally stored MaxMind GeoLite2 database. The IP address is not sent to MaxMind, and the location is only used internally.
• Livestream & camera; when using a camera on the machine running SimplyPrint, the user has the option to stream the camera feed to SimplyPrint. This is done by the machine taking a picture and sending the image file to SimplyPrint’s servers in a secure request. The image is then stored for as little as 10 seconds before it’s permanently removed. We only store pictures up to 7 days, and the pictures can only be accessed by the account that owns the printer from which the picture is taken.
• Mobile app & push notifications; if you install the SimplyPrint mobile app, it registers a push token for your device, which we link to your user so notifications reach you. Push notifications are delivered through the push services on our Sub-Processors list. They receive the push token, basic device details (such as model, operating system and language), and the notification itself - for example which printer and print it is about, and sometimes a link to a picture from the printer's camera. We keep a log of the push notifications we send to your devices, including whether each was delivered and opened, for 30 days so we can troubleshoot delivery; after that we only keep totals. You control whether notifications are shown in your device's notification settings and can turn them off at any time.

How do we use your data?

Our company collects your data so we can:

• Process possible orders
• Manage your account
• Gather data on general user behavior, guiding us to improve our software
• Send emails, print notifications, and special offers
• Understand how users discover SimplyPrint (attribution) - We temporarily store how you found us (e.g., which ad or link) in your browser's sessionStorage. If you don't create an account, this data is deleted when you close the tab and is never sent to us. On signup, this attribution data is saved with your consent preferences. If you consented to marketing cookies and came from an advertisement, we notify the ad platform via a secure server-to-server call - we only send an anonymous click ID and action type, never your personal information.

For federated SSO login, SimplyPrint adheres to the REFEDS Data Protection Code of Conduct v2 regarding the use of identity attributes. This means we only request and process the minimum attributes necessary to provide access to our service, and we do not use them for any unrelated purpose.

How do we store your data?

Our company securely stores your data, including our backups, at a DigitalOcean datacenter in Frankfurt, Germany. This datacenter is located within the EU and is fully GDPR-compliant. Compute-heavy processing, such as cloud slicing, runs on servers at the other EU hosting providers on our Sub-Processors list, which work on your files while they process them and do not hold your account data. SimplyPrint does not host customer data on its own premises, and we don't use customer data to develop or test SimplyPrint. The one exception is a fault we need to investigate: then our engineers may work with the specific files or records involved, such as a file that fails to slice, in temporary storage and only for as long as they need it.

SimplyPrint staff only access your account when that is needed to support you or to keep the service secure. When our support team works in an account, it does so through a support session, which is time-limited, logged with its reason, and can be ended by the account at any time. Every session is listed under Settings → Data & security, where the account's administrators can also require that support asks for their approval before each session.

If you wish to learn more about how we handle security at SimplyPrint, you can read our Security Overview by clicking the button below. Here we go more in-depth regarding what measures we take to keep your data safe and providing a deeper look into the different third-party providers we use for our web services. This document also digs into the security of the local SimplyPrint setup, on Raspberry Pi's/other machines, and what websites & ports that will be requested from within your local network.

Read the SimplyPrint security overview

DPA (Data Processing Agreement)

If you are a company, school, school board, institution or government using SimplyPrint, you can sign a Data Processing Agreement (DPA) with us. It sets out how we process personal data on your behalf as your processor: our security measures, breach notification, sub-processors, international transfers, audits, and the return and deletion of your data. On the School and Enterprise plans, you can sign our standard DPA yourself in SimplyPrint under Settings → Data & security, and choose who in your organisation receives the notices it promises.

We also review and sign institutions' own data protection agreements, and are glad to do so for school boards, districts, universities and other organisations, especially when one agreement covers several schools or sites. Write to [email protected] - we aim to respond within 24 hours.

US K-12 districts: SDPC Multi-State NDPA

For US K-12 school districts, SimplyPrint has also signed the Student Data Privacy Consortium (SDPC) / TEC Standard National Data Privacy Agreement (NDPA), Version 1.0. Eligible districts in Massachusetts, Maine, Colorado, Illinois, Iowa, Missouri, New Hampshire, Nebraska, New Jersey, Ohio, Rhode Island, Tennessee, Vermont, Virginia, and Washington can subscribe to the existing agreement via the General Offer of Privacy Terms (Exhibit E) without renegotiating from scratch. New York is currently excluded. Districts in other states (or outside the US) can still request a custom DPA via the same [email protected] address.

Documentation for privacy, security and procurement reviews

We support privacy and security assessments by schools, school boards, public bodies and companies. The following is published and kept current:

• our Security Overview and Certifications & Compliance pages;
• our Sub-Processors list, with each provider's location and transfer basis, also as a PDF;
• our Accessibility Statement and VPAT;
• the change log of this policy and of our Terms of Service, on each page.

On request, we provide our Data Processing Agreement, a summary of our transfer impact assessment, a summary of our incident response plan, and answers to security and privacy questionnaires. Write to [email protected].

Security incidents and data breaches

We have a written incident response plan, which we review at least once a year and after every significant incident. If we become aware of a breach of security that leads to personal data being accidentally or unlawfully destroyed, lost, altered, disclosed or accessed (a "personal data breach"), we:

• Contain it. We isolate affected systems, revoke and rotate access credentials and keys, end sessions and require new passwords on affected accounts, and block malicious traffic.
• Assess it. We establish what happened, which accounts and data are affected, over what period, and the likely consequences.
• Notify. Where an organisation such as a school, school board or company manages your account, we notify it without undue delay and, where feasible, within 48 hours of becoming aware of the breach, with updates as we learn more, so it can meet its own obligations. Where SimplyPrint is the controller of your data, we notify the Danish Data Protection Agency (Datatilsynet) within 72 hours where the law requires it, and tell you directly without undue delay if the breach is likely to result in a high risk to you.
• Remediate. We fix the cause, restore affected data from backups where needed, review the incident, and put measures in place to stop it happening again.

We keep a record of every personal data breach. Organisations receive breach notices at their account owners' email addresses and at the notice contacts they choose in SimplyPrint under Settings → Data & security.

How long do we keep your data?

We keep your personal data only for as long as we need it for the purposes described in this policy, and then we delete it. When you delete your account, we remove your personal data from our live systems, with a few limited exceptions where the law allows or requires us to keep specific records for a bounded period:

• Accounting and tax records. Where we are legally required to retain invoices and payment records (for example under Danish bookkeeping law), we keep those records for the period required by that law, which is currently up to 5 years, after which they are deleted.
• Payment dispute and fraud-prevention records. Even after you delete your account, we may keep a minimal set of transaction and security data tied to a recent payment, such as billing and transaction identifiers, the email address on the account, and the IP and usage logs associated with that payment, for up to around 13 months from the charge. We keep this only where it is necessary to defend payment disputes and chargebacks and to prevent fraud, and we automatically delete it once that window has passed. This is separate from, and shorter than, the accounting retention above. We do not retain your files, printer data, or full profile for this purpose, only the limited information needed to defend a specific charge.

Where the law requires us to keep a record for longer than the periods above, we keep it only for as long as that legal obligation applies.

Your data & third parties

We use a small number of third-party services ("sub-processors") to run SimplyPrint. We never sell your data, we keep the number of third parties to a minimum, and wherever possible we choose privacy-friendly, EU-hosted providers or services we can host ourselves.

A few principles we hold to:

• Your data is stored in the EU by default, and all of our hosting is in the EU.
• We never sell your personal data, and we don't use third-party advertising or tracking pixels.
• Optional AI features are opt-in and off by default - your data is only shared with an AI provider if you choose to enable them.
• Where a provider is outside the EU/EEA, we rely on a valid transfer mechanism - the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses (2021) - with supplementary safeguards. The one exception is Apple's push notification service, which delivers notifications to the SimplyPrint app on Apple devices under Apple's own developer terms; Apple offers neither for it.

The complete, always-current list of our sub-processors - including each provider's legal entity, address, country, what data they process, where it is processed, and the transfer basis - is published on a dedicated page:

See our full Sub-Processors list

We give account owners advance written notice before a new sub-processor that handles personal data goes live, and you may object on specific grounds. See our Data Processing Agreement (Section 8.2) for details, or email [email protected] to request our DPA or a transfer impact assessment summary.

Connected stores and marketplaces (SimplyPrint Shop)

SimplyPrint Shop is an optional feature, currently available to accounts in a closed pilot. This section applies only if you connect an online store or marketplace account (a "connected store"), such as a Shopify, WooCommerce or Etsy store, to SimplyPrint. If you never connect one, SimplyPrint receives no data from any store.

• What we read. When you connect a store, you instruct us to read your orders and the items in them (products, variants and options, quantities, order status and dates) and your product catalogue, so we can turn your orders into print jobs on your printers. Buyer details - such as a name, email address, phone number, shipping address, order notes, or personalisation text a buyer typed at checkout - are only transferred if you turn them on.
• You choose how much buyer data we receive. SimplyPrint does not need your buyers' personal data to produce your orders. For each connected store you choose one of these levels, and can adjust individual fields:
  • None: no buyer data at all. Orders are produced from the products, options and quantities alone.
  • Reference only: each order remembers which of the store's customers it came from, as the store's own customer ID or a link back to the store, without any name or contact details.
  • What you need to pack and ship: the buyer's name, email address and shipping address.
  • Everything: the buyer's contact details, company, phone number and billing address, and the store's customer list.
• Our role. For this data, you are the controller and SimplyPrint is your processor. We process it only to provide SimplyPrint Shop to you, on your instructions, under the "Connected Stores and Marketplaces" section of our Terms of Service.
• What we never do. We never sell connected-store data, use it to contact or market to your buyers, combine it across sellers, or use it - even anonymised or aggregated - to train or improve AI or machine-learning models. We share it only with our sub-processors and with services you connect yourself.
• Staff access. SimplyPrint staff can access connected-store data only when needed to support you or keep the service secure.
• Security. Connected-store data is stored in the EU like the rest of your SimplyPrint data, sent over encrypted connections, and store access credentials are encrypted at rest. If a security incident affects your connected-store data, we tell you without undue delay.
• Disconnecting. You can disconnect a store at any time, in SimplyPrint or from the store platform. We then stop reading from it straight away, ask the platform to revoke our access where it supports this, and deactivate the stored access credential so it is never used again. Orders already imported stay in your account as your production history until you delete them or your account. When a platform tells us that a buyer's or a store's data must be erased, we remove the identifying details from those orders and keep only the production record. You can ask us to delete a buyer's details, or all data from a store, at [email protected].
• If you bought from a store that uses SimplyPrint. The store you bought from decides how your order data is used, so please contact them first. You can also email [email protected], and we will pass your request on and help the store respond.

The store platform's own terms and privacy policy continue to apply to your store.

If SimplyPrint changes ownership

If SimplyPrint ApS is involved in a merger, acquisition, reorganisation, or sale of all or part of its business, personal data may be transferred to the new owner only as part of that transaction, and only so that it can keep providing SimplyPrint. We never sell personal data on its own. If this happens:

• the new owner must keep protecting your personal data under this privacy policy and any Data Processing Agreement in place, with security safeguards at least equivalent to ours, and may only use it for the purposes this policy describes;
• we tell account owners, and the notice contacts set for any Data Processing Agreement, by email before the transfer is completed; and
• before the transfer, you can export your data and ask us to delete your account and its data, in which case they are not transferred, except the limited records described under "How long do we keep your data?".

An organisation with a Data Processing Agreement can also end it under its terms.

What are your data protection rights?

Our company would like to make sure you are fully aware of all of your data protection rights. Every user is entitled to the following:

The right to access - You have the right to request SimplyPrint for copies of your personal data.
The right to rectification - You have the right to request that SimplyPrint correct any information you believe to be inaccurate. You also have the right to request SimplyPrint to complete information you believe is incomplete.
The right to erasure - You have the right to request that SimplyPrint erase your personal data, under certain conditions.
The right to restrict processing - You have the right to request that SimplyPrint restrict the processing of your personal data, under certain conditions.
The right to data portability - You have the right to request that SimplyPrint transfer the data that we have collected to another organization, or directly to you, under certain conditions.

If you make a request, we have 2 weeks to respond to you. If you would like to exercise any of these rights, please contact us at our email: [email protected].

What are cookies?

Cookies are text files placed on your computer to collect standard Internet log information and visitor behavior information. When you visit our website, we may collect information from you automatically through cookies or similar technology. For further information, visit cookiesandyou.com.

How do we use cookies?

Our company uses cookies in a range of ways to improve your experience on our website, including:

• Keeping you signed in
• Remembering your preferences
• Understanding how you found us (with your consent)

What types of cookies do we use?

We categorize cookies into three types:

• Essential - Strictly necessary cookies that enable core functionality like logging in and maintaining your session. These cannot be disabled.
• Functional - Cookies that enable enhanced features like live chat support and remembering your preferences. Some are set by third-party services we use (like Crisp). Third-party embeds (such as YouTube videos) may also set cookies when you choose to load them. Note: Arcade demos do not place any cookies in your browser.
• Marketing - Cookies that help us understand how you discovered SimplyPrint. We do not use third-party tracking pixels (no Google Pixels, Reddit Pixels, or Meta Tags). When attribution data is sent, it happens via secure server-to-server calls, not browser scripts. See "Geographic Consent Handling" below for how consent works in your region.

For a complete, transparent list of every cookie, localStorage item, sessionStorage key, and IndexedDB database we use, please see our Cookie Policy.

How to manage cookies

You can change your cookie preferences at any time by clicking "Cookie Settings" in our website footer. You can also configure your browser not to accept cookies, though some features may not function as a result.

Geographic Consent Handling

We handle cookie consent differently based on your location to comply with regional privacy laws:

• Zone A (EU/EEA, UK, Switzerland): We present a consent banner when you first visit. Marketing cookies are disabled by default and only enabled if you explicitly accept them. Essential and Functional cookies are always active as they are necessary for the service.
• Zone B (Rest of World): Marketing cookies are enabled by default, but you can opt out at any time using the "Cookie Settings" link in our footer. Essential and Functional cookies remain active.

Your preference is stored and respected across all your visits. You can change your choice at any time.

Schools & Organizations

For users under a managed organization account (such as students or employees), we enforce a strict Functional-Only cookie policy. Regardless of any consent preferences selected, we never set Marketing or Attribution cookies for these accounts. Tracking and attribution data is only ever collected for the primary Account Owner (Admin) with their explicit consent.

When a school or school board uses SimplyPrint, it is the controller of its staff's and students' personal data, and SimplyPrint processes that data on its behalf, only to provide the service. We store students' names and email addresses, or only a username where the school uses username accounts or single sign-on, to identify them and let them sign in, along with the print files and print history they create. We never send marketing emails to students, never use their data for advertising, never sell it, and don't collect grades or academic evaluations. Notices about changes to this policy, sub-processors and security incidents go to the school's account owners and notice contacts, who decide what to pass on to their users.

Privacy policies of other websites

Our company website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

Affiliate links. Some links to shops are affiliate links, through Amazon Associates, affiliate networks and shops' own affiliate programmes. When you click one, you leave SimplyPrint; the shop or network may set its own cookies to credit us for a purchase, under its own privacy policy. We don't send them any personal data. On our side, a click through SimplyPrint on a shop link, a deal or an Amazon search is recorded with what was clicked, the page it was on and your country, and, when you are signed in or clicked in one of our emails, your user and account, like the rest of your activity in SimplyPrint (see "User info" above). We don't record your IP address with it, and it is deleted when your account is deleted.

Changes to our privacy policy

We keep this privacy policy under regular review. The current version is always published on this page, with the date it was last updated and a log of what changed.

If we make a material change, meaning one that changes what personal data we collect, the purposes we use it for, or your rights, we:

• email account owners, and the notice contacts set for any Data Processing Agreement, at least 30 days before the change takes effect;
• show the upcoming change, and the date it takes effect, on this page; and
• show account owners a notice about the change in SimplyPrint.

Notices go to account owners, not to every user of an account: for an account a school or other organisation manages, its account owners receive them and decide what to pass on. Small changes that don't affect how we handle personal data, such as corrections and clarifications, take effect when published and are listed in the change log. Changes to our sub-processors are announced in advance as described under "Your data & third parties".

How to contact us

If you have any questions about our company’s privacy policy, the data we hold on you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us at [email protected]. For data protection matters, including requests under a Data Processing Agreement, you can also write to our data protection contact at [email protected].

How to contact the appropriate authority

Should you wish to report a complaint or if you feel that our company has not addressed your concern in a satisfactory manner, you may contact the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk), which supervises SimplyPrint ApS, or the data protection authority where you live.