DATA PROCESSING AGREEMENT
We are Print.com, the new generation in print. Together with you, we will create beautiful things. But before we start, there are a few things you need to know. Because we are going to process your data for you the General Data Protection Regulation (GDPR) requires a Data Processing Agreement between us.
Where we use Print.com, we, or us, it may refer to Print.com B.V. (Dutch Com. Reg. # 69059500), Print.solutions.com B.V. (Dutch Com. Reg. # 88760596), Print.com Ltd, or any other Print.com company in our family that you may deal with. Because you are responsible for the data you provide us with, the GDPR calls you the data controller, but we will call you our Customer. Together, we will be called, the Parties.
Do you have any questions about this Data Processing Agreement (or this Agreement, for short)? Please let us know. Drop us a line at info@print.com or call +31 (0)88 751 11 11. We love real mail (which is, of course, also print), so please send a note to Teugseweg 18a, 7418 AM in Deventer, the Netherlands. If you want to get to know us even better, our Chamber of Commerce number is 690 595 00.
Background
- Print.com develops widgets and other access points for customers, through which they can directly offer Print.com services on their website.
- The Customer wishes to place such access point on its website and accepts that through installing and using this access point, personal data may be shared with Print.com (the Data).
- Print.com will store, process and secure the Data (the Assignment).
- The Parties lay down how the Data is stored, processed, and secured, in this Data Processing Agreement (the Agreement).
Agreement
1. Execution of the processing
1.1. Print.com and any person acting under its authority, will handle the Data in a careful manner and only process the Data in accordance with the written instructions of the Customer and in accordance with this Agreement and the GDPR.
1.2. Print.com will not process the Data for any other purpose than as established by Customer and specified in Annex 1. Print.com has no control over the purpose and means of the processing of the Data, as these are determined by Customer.
1.3. At the request of the Customer, Print.com will provide the Customer with information about the (security) measures taken, other than set out in article 4, in order to comply with the instructions from the Customer and the obligations under the Agreement and the GDPR.
2. Warranty Customer
The Customer guarantees the processing of the Data of the data subjects, as referred to in this Agreement, is compliant with the applicable law, including the GDPR, and does not violate any rights of others.
3. Transfer of the personal data
3.1. Print.com will only process the Data within the European Economic Area and the United Kingdom. Print.com can process the Data within the United Kingdom without additional permission, based on the adequacy decision by the European Commission.
3.2. At the request of the Customer, Print.com will report in which country or which countries Print.com processes the Data on behalf of the Customer.
4. Security measures
4.1. Print.com implements all appropriate technical and organisational measures to prevent loss of personal data from or any form of unlawful processing of the Data. These measures shall guarantee an adequate level of protection of the Data being processed.
4.2. Print.com will at least take the following security measures:
a. Encryption of digital files containing the Data;
b. Security of the network connection with Secure Socket Layer (SSL) technology or a similar technology;
c. Restriction of access to the Data to authorised employees; and
d. Back-ups of the Data to restore them in time in case of physical or technical incidents.
4.3. Print.com shall provide the Customer with all available information to provide the Customer assistance in carrying out security measures, conducting audits and inspections and carrying out data protection impact assessments.
5. Data breach
5.1. Print.com will report any theft, loss, misuse or other form of data breach to the Customer as soon as possible. This report includes, as far as possible, at least the following: the nature of the breach, the categories and scope of the Data concerned, the likely consequences of the data breach, if (in the eyes of Print.com) the breach shall be reported to the Dutch Personal Data Authority, the measures Print.com has taken and contact details of (a contact person of) Print.com for the Customer to obtain more information.
5.2. If needed, Print.com will fully cooperate to inform the data subjects about such security incidents or data breaches. In addition, Print.com will fully cooperate in carrying out risk assessments, analysing the cause of the incident or breach, identifying required corrective measures and implementing those measures.
6. Duration and termination
6.1. This Agreement is an appendix to Terms and Conditions agreed between the Parties regarding the services described in the Background of this Agreement. This Agreement is effective from the moment of acceptance of the Terms and Conditions and shall end at such moment that the services agreement is terminated or cancelled.
6.2. If this Agreement is terminated, cancelled or dissolved, Parties must continue to comply with the provisions of this Agreement regarding confidentiality, liability, indemnification and all other provisions that are intended by nature to remain applicable between the parties after terminations, cancellation or dissolution of this Agreement.
6.3. If this Agreement is terminated, cancelled or dissolved, Print.com will return or delete all Data, including the Data, which are processed by Print.com based on this Agreement, to the Customer at its request. The Customer must submit this request to Print.com within two months. After this period, Print.com will safely remove or destroy all the Data, including any copies of it, unless Print.com is legally obliged to store the Data for a longer period.
7. Confidentiality and non-disclosure
7.1. Print.com will treat all of the Data and other data received by the Customer under the Assignment as confidential. Print.com will limit access to this data to persons working for Print.com, who need access to correctly process the data on behalf of the Customer.
7.2. All Data Print.com receives under this Agreement is subject to a non-disclosure obligation towards third parties. All persons employed by or working for Print.com, as well as Print.com itself, are required to remain secrecy regarding the Data.
7.3. Print.com will not provide third parties with the Data or copy, multiply or otherwise make the Data public, without permission of the Customer.
8. Requests from Data Subjects
8.1. Print.com will assist the Customer with all requests which may be received from data subjects, such as the right to access, rectification or erasure.
8.2. If Print.com receives a request from a third party (data subject) to provide access to their personal data based on an alleged (legal) obligation, Print.com will inform the Customer in writing before it provides the third party access to the specific Data. The Customer will assess and decide whether the request is legitimate and instruct Print.com how to treat such request.
9. People working under the authority of Print.com
The obligations for Print.com arising from this Agreement also apply to those who process the Data under the authority of Print.com, including but not limited to its employees.
10. Sub Processors
10.1. Print.com may sub-contract the processing of the Data to external parties (Sub Processors). Currently, Print.com has sub-contracted (part of) the processing of the Data to:
a. Microsoft Clarity (analytics and user behavior tracking);
b. Stripe.com (payment processing);
c. HubSpot (customer relationship management);
d. Supabase (user authentication and account management); and
e. Resend (email communication and notifications).
f. Anthropic, PBC (AI inference and MCP-based workflow automation). Print.com uses Anthropic’s Claude API to power its MCP connector, enabling AI-assisted tooling for customers. Data passed to the Claude API is processed in accordance with Anthropic’s privacy policy, available at https://www.anthropic.com/legal/privacy.
10.2. Print.com may appoint new Sub Processors for the processing of the Data, provided that the level of data protection by such Sub Processor is at least similar to the level of data protection by Print.com.
10.3. Print.com will publish additions and replacements of any Sub Processors on its website, through an updated Data Processing Agreement. The Customer may request an overview of all appointed Sub Processors.
10.4. If the Customer, on its own initiative, connects its Print.com account to a third-party AI assistant or other MCP client, including Claude (Anthropic) and ChatGPT (OpenAI), that third party is not a Sub Processor of Print.com. In that case Print.com solely makes data available to the client chosen by the Customer, on the Customer’s instructions and at the Customer’s risk. The Customer is itself responsible for the legal basis for that processing, for the arrangements with that provider and for any transfer outside the European Economic Area.
10.5. Print.com has no influence over the retention period of conversation data at the provider of the AI assistant chosen by the Customer, nor over any use of that data for training models. The Customer arranges this through the settings and terms of its own account with that provider.
11. Liability and indemnification
11.1. The total liability of Print.com in connection with an attributable shortcoming in the fulfillment of the Agreement, tort or any other legal ground is (cumulatively) limited to the amount that in the relevant case will be paid out under the liability insurance coverage taken out by Print.com, increased by the amount of the excess that according to the policy conditions will not be borne by the insurers. If for any reason no monies are paid out under this insurance, any liability of Print.com is limited to the height of the last invoice for the services provided by Print.com under the services agreement but is in any case limited to a maximum of EUR 1,000.
11.2. Print.com is not liable for consequential damages and/or indirect damages, including but not limited to lost sales and/or profits, missed savings, damage to reputation, reduced goodwill and loss of data.
11.3. Print.com is explicitly not liable for any damage resulting from following the written instructions of the Customer, if those instructions do not comply with the GDPR or any other applicable laws and regulations regarding privacy and the protection of personal data.
11.4. Any claim for damages by Customer must be submitted by him within ninety (90) days after the date of the event underlying the claim. Damages that have not been reported to Print.com within this period will not be considered for compensation, unless the Customer can prove that he could not reasonably have reported the damage at an earlier stage.
11.5. All claims of Customer shall expire if not submitted to the competent court within one (1) year after Customer or the third party was aware or could reasonably have been aware of the facts on which the claim is based.
12. Nullity
If a part of this Agreement is deemed void or voidable, this does not change the validity of the rest of this Agreement. Any invalid provision shall be replaced by a provision that is valid and which interpretation shall be as close as possible to the intent of the invalid provision.
13. Final provision
13.1. This Agreement can only be changed in writing.
13.2. This Agreement replaces all prior agreements between parties regarding the processing of personal data.
14. Applicable law
Dutch law.
15. Competent court
The court in Overijssel, the Netherlands.Rechtbank Overijssel, Nederland.
16. Annexes
Annex 1 – Specification of data and purposes
Annex 1 Specification of data and purposes
Personal data involved
- First and last name
- Address
- IP address
- E-mail address
- Telephone number
Data subjects concerned
- Customer
- Clients of Customer
Purpose(s) for processing
To service the Customer and clients of Customer, the execution of an agreement.
Claude / MCP Integration
The table below covers the specific processing carried out via the Claude MCP integration.
| Categories of personal data | Customer ID; user-provided inputs during a session (e.g. delivery address) |
| Purpose of processing | Resolving product, pricing, and shipping queries via the Claude MCP integration |
| Processor (MCP server) | Stateless; no persistent storage of personal data or conversation content |
| Sub-processor (Anthropic) | Retains conversation data and may cache OAuth credentials in accordance with the terms of your Claude account. See also: Anthropic Privacy Policy |
| Data not in scope | Name, company details, payment data, order history |
| Sale of personal data | Personal data is not sold to third parties |