This page is an unexecuted working draft written to describe how NexusFFL actually handles data today. It has not been reviewed or approved by an attorney, it has not been adopted by [LEGAL ENTITY NAME], and it creates no rights or obligations for anyone. Do not rely on it. Bracketed blanks marked like [THIS] are unresolved and must be completed before this document is published.
How NexusFFL handles the personal information a dealer puts into it — the ATF Form 4473 data of that dealer’s customers, in detail, with the commitments that go with it.
What this document does. It sets the rules for personal information a dealer puts into NexusFFL — above all, the ATF Form 4473 data of that dealer’s customers. The dealer decides what goes in and why (controller); NexusFFL only stores and handles it on the dealer’s instructions (processor / service provider). It forms part of the Terms of Service.
This Data Processing Addendum (“DPA”) is between [LEGAL ENTITY NAME] (“Processor”), [REGISTERED BUSINESS ADDRESS], and the NexusFFL customer identified in the applicable order or account (“Controller”). It applies to all Personal Data that Processor processes on Controller’s behalf in providing the NexusFFL service. Where this DPA conflicts with the Terms of Service on the handling of Personal Data, this DPA governs.
Controller is a federally licensed firearms dealer and determines the purposes and means of processing its records. Controller is responsible for the lawfulness of the data it enters, for the notices and disclosures it owes its own customers, and for its obligations under federal firearms recordkeeping regulations.
Processor acts only as a processor and, for U.S. state-law purposes, as a service provider / processor and not as a “third party.” Processor certifies that it understands the restrictions in section 5 and will comply with them.
Processor will process Personal Data only:
If Processor believes an instruction violates Applicable Privacy Law, it will inform Controller.
Processor will not:
Processor limits access to Personal Data to personnel who need it to operate or support the service, binds them to confidentiality, and provides them with appropriate guidance on handling firearms-transaction data. Processor’s operator console exposes business-level information and record counts, not the contents of Controller’s A&D records or Forms 4473; direct database access is restricted to [NAMED OPERATIONS PERSONNEL].
Processor implements and maintains the technical and organizational measures set out in Annex II, and will not materially degrade them during the term. Processor has no SOC 2, ISO 27001 or PCI attestation and has not completed an independent audit or penetration test; Annex II states the measures that exist rather than any certification.
Florida’s data-breach statute, Fla. Stat. § 501.171, treats a company that holds personal information on behalf of a covered entity as a third-party agent, and requires that agent to notify the covered entity of a breach no later than 10 days after the breach is determined or there is reason to believe it occurred. NexusFFL is that agent. Controller is the covered entity. This section is the operational commitment behind that clock.
Processor will:
Processor maintains a written incident response plan built around this timetable. Security contact: [SECURITY CONTACT EMAIL].
Controller gives general authorization for Processor to engage the Subprocessors listed at nexusffl.com/subprocessors.html. Processor imposes data protection obligations on each Subprocessor no less protective than this DPA and remains liable for their performance. Processor will give Controller [ADVANCE NOTICE PERIOD, e.g. 30 days] notice before adding or replacing a Subprocessor, by [NOTICE MECHANISM — e.g. email to account owners plus an update to the subprocessors page]. Controller may object on reasonable data-protection grounds, in which case [OBJECTION PROCEDURE AND CONSEQUENCE — e.g. the parties work in good faith to find an alternative; failing that, Controller may terminate the affected service.]
Payment and accounting providers process Personal Data only where Controller connects its own account with them; in that case Controller is also contracting directly with that provider.
Taking into account the nature of the processing, Processor will assist Controller, at Controller’s reasonable request:
Processor will not respond to a Data Subject on Controller’s behalf; it will redirect the individual to Controller and tell Controller it did so.
The deletion conflict is real. Federal firearms regulations require Controller to retain A&D records and Forms 4473 for long, statutorily fixed periods, and NexusFFL is deliberately built so certified forms and bound-book entries are corrected by appended entries rather than overwritten or deleted. A Data Subject’s deletion request will frequently conflict with that duty. Deciding how to answer such a request is Controller’s call on its own counsel’s advice; Processor will not unilaterally delete records subject to a retention obligation.
Processor stores and processes Personal Data in the United States only — on Railway infrastructure in a U.S. East (iad) region, with data on a persistent volume mounted at /data. This is a contractual commitment, not merely a configuration: ATF Ruling 2016-1 conditions electronic recordkeeping on U.S.-located servers. Processor will not transfer Personal Data outside the United States, or permit a Subprocessor to do so, without Controller’s prior written consent.
Throughout the term, Controller may export its data at any time (CSV bound-book export, ATF-format PDFs, attachment downloads). On termination, Processor will make the data available for export for [POST-TERMINATION RETRIEVAL WINDOW], and will then delete Personal Data within [DELETION PERIOD], except that encrypted backup archives are purged on their rolling retention cycle (currently 90 days) rather than individually, and except where retention is required by law. On Controller’s written request Processor will certify deletion.
If Controller discontinues its federal firearms license, delivering its records to the ATF National Tracing Center is Controller’s obligation as licensee (see ATF Ruling 2022-01, condition 15). Processor will assist in producing a complete and usable export for that delivery.
Processor will make available to Controller the information reasonably necessary to demonstrate compliance with this DPA, in the form of [WHAT WILL ACTUALLY BE OFFERED — e.g. a written security overview and responses to a reasonable security questionnaire, no more than once per year. NexusFFL holds no third-party audit report and must not imply one exists.] Any on-site audit right, its frequency, notice period and cost allocation is [TO BE DECIDED WITH COUNSEL].
This DPA takes effect when Controller accepts the Terms of Service and continues for as long as Processor processes Personal Data for Controller. Each party’s liability under this DPA is subject to the limitations in the Terms of Service, [SUBJECT TO ANY CARVE-OUT COUNSEL DECIDES TO ADD FOR BREACH OF SECTIONS 5, 7 OR 8].
Hosting and processing of firearms acquisition and disposition records, electronic and scanned ATF Forms 4473, and related point-of-sale records, for the duration of Controller’s subscription plus the wind-down period in section 12.
Storage, indexing and retrieval; rendering and generation of ATF-format documents; integrity hashing; backup; transmission to integrations and destinations Controller enables; support.
| Category | Fields |
|---|---|
| Identity | Full name; residence street address, city, county, state, ZIP and city-limits status; place of birth; date of birth. |
| Physical description | Height, weight, sex. |
| Government identifiers | Social Security number (Form 4473 Q16, optional); UPIN (Q17); alien or admission number (Q20); identification document type, issuing authority, number and expiration; supplemental identification; military PCS base, effective date and order number. |
| Demographic | Ethnicity and race (Q18); citizenship and country of citizenship (Q19). |
| Sensitive eligibility answers | Answers to Form 4473 Q21(a)–(n), covering matters such as actual-transferee status, indictment and criminal history, fugitive status, controlled-substance use, mental-health adjudication or commitment, dishonorable discharge, domestic-violence convictions and restraining orders, and renunciation of citizenship. |
| Biometric-adjacent | Captured signature images (buyer certification, recertification, seller). |
| Background check | NICS contact date, transaction number and response, delayed-response follow-ups, and permit information relied on in lieu of a check. |
| Firearm linkage | Manufacturer, importer, model, type, caliber and serial number of the firearm(s) linked to the individual, with acquisition and disposition dates and counterparties. |
| Documents | Scanned paper Forms 4473 and uploaded attachments, with metadata and SHA-256 file fingerprints. |
| Commercial | Point-of-sale line items, prices, tax, tender and receipts; customer name and contact typed on a sale. |
| Account and log | Staff name, email, bcrypt password hash, role and location; hash-chained audit entries attributing actions to a user and time. |
Several of these categories are sensitive by any reasonable standard — race and ethnicity, immigration-related identifiers, mental-health adjudication and criminal-history answers, and a Social Security number, all tied to a named individual and a firearm serial number. The parties acknowledge that and treat the whole set accordingly.
Continuous, for as long as Controller uses the service, subject to sections 11 and 12 and to Controller’s federal retention obligations.
httpOnly, sameSite=strict, production-secure cookies.[EXECUTION BLOCK — decide whether this DPA is click-accepted with the Terms of Service or signed separately, and add signature lines, titles and dates accordingly.]