As of August 24, 2026. This Shopify Services Data Processing Addendum ("Addendum") forms part of the Shopify Services Terms and the applicable written agreement between HansonCore, LLC DBA Five Acre Code ("Five Acre Code") and the Client. It applies only to the extent Five Acre Code processes Client Personal Data as a processor or service provider to perform the services.
If the parties sign a project-specific data-processing agreement, that signed agreement controls conflicting data-processing terms. Terms such as "controller," "processor," "business," "service provider," "personal data," "personal information," "process," and "data subject" have the meanings given by applicable privacy law.
Processing roles
The Client controls its Shopify store and determines the purposes, lawful basis, content, collection, and use of store, employee, customer, order, company, and other personal data. The Client acts as the controller or business for Client Personal Data. Five Acre Code acts as the Client's processor or service provider when it processes Client Personal Data only to perform the Client's documented instructions.
Each party acts independently for personal data it controls for its own business contacts, contracts, invoices, security records, legal obligations, and abuse prevention.
Processing details
- Subject matter and duration: Shopify consulting, theme customization, development, migration, launch, implementation, and support for the term of the written agreement, plus the limited retention period described below.
- Nature and purpose: Accessing, viewing, organizing, creating, modifying, testing, transmitting, storing, returning, or deleting Client Personal Data only as needed to scope, deliver, secure, document, and support the agreed services.
- Data subjects: Client owners, representatives, staff, contractors, customers, prospective customers, shoppers, company contacts, and other individuals whose information is present in the authorized Shopify store or project materials.
- Data types: Business contact and account information; Shopify identity and permission information; storefront content; product, collection, market, company, customer, order, fulfillment, discount, and configuration information; technical logs and device/browser details; support communications; and project files supplied or exposed through authorized access.
- Special data: The services are not designed to receive payment-card data, account passwords, government identifiers, health information, biometric information, children's data, or other regulated or highly sensitive data. The Client must not provide that data unless the parties expressly agree in writing on the need and safeguards before access.
The written scope, authorized Shopify configuration, Client-provided access, and subsequent documented directions constitute the Client's instructions. Five Acre Code will notify the Client if an instruction appears to violate applicable privacy law and may suspend the affected processing while the parties establish a lawful approach.
Five Acre Code commitments
When acting as a processor or service provider, Five Acre Code will:
- Process Client Personal Data only for the specific services and documented instructions, unless applicable law requires other processing. Where legally permitted, we will notify the Client before processing required by law.
- Ensure people authorized to process Client Personal Data are bound by confidentiality obligations and receive access only as needed for their role.
- Maintain administrative, technical, and organizational safeguards appropriate to the nature of the data and engagement, as further described in the Services Security Policy.
- Taking into account the nature of the processing, reasonably assist the Client with verified data-subject requests and applicable security, breach-notification, impact-assessment, or regulator-consultation obligations. Work beyond the ordinary scope can require a written change and additional fees.
- Notify the Client without undue delay after confirming a breach of Client Personal Data in systems controlled by Five Acre Code and provide available information reasonably needed for the Client's response. Notice is not an admission of fault or liability.
- At the end of the applicable services, delete or return Client Personal Data at the Client's written choice, unless law or the written agreement requires retention. Data in provider backups, security records, invoices, or legal records can remain for the applicable retention cycle and will remain protected from unrelated use.
- Make information reasonably necessary to demonstrate compliance with this Addendum available to the Client, subject to confidentiality, security, and protection of other clients' information.
Five Acre Code will not sell or share Client Personal Data, use it for cross-context behavioral advertising, retain/use/disclose it outside the direct business relationship, or combine it with personal data received from another client or collected from Five Acre Code's independent interactions, except as the Client instructs or applicable law permits a processor or service provider to do. Five Acre Code will notify the Client if it determines it can no longer meet an applicable obligation and will cooperate in reasonable steps to stop and remediate unauthorized processing.
Client responsibilities
The Client will provide lawful instructions and all required notices, consents, permissions, and legal bases. The Client will limit access and data to what the services require, maintain accurate authorized contacts, and respond to decisions or requests needed to protect Client Personal Data.
The Client may take reasonable steps to verify Five Acre Code's compliance with this Addendum. Unless an incident, regulator, or law reasonably requires more, review is limited to once in a twelve-month period and begins with available policies, written responses, or relevant third-party documentation. Any on-site or technical audit must be legally required or mutually agreed, use an independent qualified reviewer, avoid access to other clients' information or systems, and occur at the Client's expense without unreasonably disrupting operations.
Service providers
The Client gives general written authorization for Five Acre Code to use the providers below and project-specific providers necessary for the agreed services. Five Acre Code remains responsible for requiring providers that process Client Personal Data on its behalf to protect that data consistently with applicable obligations.
Provider use depends on the engagement:
| Provider | Purpose | Information involved |
|---|---|---|
| Shopify | Merchant platform, authorized collaborator/staff or Theme Access, themes, apps, checkout/accounts, APIs, previews, and project delivery | Store identity, authorized admin identity, theme/configuration data, storefront content, and store data visible through granted permissions |
| Cloudflare | fiveacrecode.com hosting/delivery, TLS, security, bot/form protection, request routing, and limited web analytics when configured | Request metadata, IP/network information, security signals, form-protection signals, and website routing data |
| Formspree | Contact and project-inquiry form processing when configured | Name, email, store URL, selected service, engagement context, and message |
| GitHub | Source control, issue/change history, code review, and optional Shopify theme integration when included | Theme/app source, commits, authorized user identity, technical project records, and non-secret configuration |
| Email and communications providers | Project communication, support, approvals, notices, and file exchange | Business contact details, messages, attachments, approvals, and support information |
The Client can select or require additional themes, apps, repositories, design tools, hosting, analytics, consent, translation, search, subscription, or other providers. Client-selected providers are governed by the Client's agreements and instructions.
Where applicable law requires advance notice, Five Acre Code will provide reasonable notice through the Client's project contact before adding a provider that will process Client Personal Data. The Client may object promptly on reasonable data-protection grounds. The parties will work in good faith on a commercially reasonable alternative; if none is available, either party may terminate the affected processing, subject to payment for services performed and non-cancellable commitments.
Data minimization and instructions
Grant only the access needed for the deliverables. Do not send full production exports, payment data, customer passwords, owner passwords, access tokens, or unrelated personal information when representative or synthetic data can reproduce the need.
Five Acre Code can refuse instructions that are unlawful, insecure, outside the agreement, or likely to expose data unnecessarily. We will notify the Client when practical and can require a safer test or access method.
Confidentiality and security
Personnel and providers receive access only as needed for the engagement and are subject to contractual or professional obligations appropriate to their role. Security practices are described in the Services Security Policy.
International processing
Five Acre Code is based in the United States. Providers can process information in the United States and other locations where they operate. The Client will identify transfer restrictions that apply to Client Personal Data, and the parties will execute a legally required transfer mechanism before restricted processing when one is necessary.
Compliance review and changes
Provider names, ownership, products, and processing locations can change. Five Acre Code will update this page when the service-provider list or processing terms change materially. Changes do not retroactively reduce protections promised in a signed agreement.
The liability limitations and remedies in the Shopify Services Terms apply to this Addendum except where applicable law prohibits that limitation.
Contact
Questions, deletion requests, or data-processing requests can be sent to support@fiveacrecode.com.
Five Acre Code
HansonCore, LLC
127 Cochran Poole Rd
Lucedale, MS 39452
support@fiveacrecode.com