Vistaprint

Other Netherlands Website Reviewed Sept. 22, 2026

Online print and design service for business marketing materials such as business cards, signage, promotional products and branded apparel.

Report an issue with this profile

Compliance Frameworks

GDPR 2016/679
Partial
A DPO exists but is not named — the Cimpress plc DPO also acts as Vistaprint’s data protection representative. No ICO registration (no UK controller entity; a UK Article 27 representative is appointed). No DPA published.

Contact & Responsible Disclosure

  • Security Contact [email protected]
  • Responsible Disclosure View policy ↗
  • Bug Bounty Platform No third-party platform; no evidence of paid bounties despite the mailbox name

Contracting entity and assurance position

**The contracting entity for UK and EEA customers is Vistaprint B.V.** (Venlo, Netherlands); ultimate parent is **Cimpress plc** (Dundalk, Ireland). The UK Article 27 representative is Cogency Global (UK) Limited, London.

**No certification evidence found** — neither vistaprint.co.uk nor cimpress.com publishes any ISO 27001, SOC 2, PCI DSS or Cyber Essentials certification, and Cimpress has no public trust centre. The UK privacy notice describes technical and organisational measures but names no standard or certifying body.

A security.txt is published and a vulnerability disclosure policy sits on the Cimpress privacy and security page.

Assess Vistaprint in your own vendor risk programme

SnapGRC lets you send security questionnaires, track DPA status, manage sub-processors, and maintain a supplier risk register — all audit-ready.

Supplier Management Free Risk Register