Federal Contractor Index

    Privacy Policy

    This policy explains who operates Federal Contractor Index, what data the site publishes and collects, and what rights apply under the EU General Data Protection Regulation (GDPR) — which applies to this site's processing regardless of where a visitor or data subject is located (GDPR Article 3(1)).

    Data controller

    Ökrös László EV., Hungary, is the data controller for this site. Contact is currently through the contact form only.

    What this site publishes about businesses, and why

    Contractor profile pages on this site are built entirely from U.S. Department of the Treasury (usaspending.gov)'s USAspending Award Data Archive — Contracts, a public-domain U.S. federal government dataset. Only a fixed set of fields is ever read from that source: award identifiers, dates, dollar amounts, the recipient's legal name, Unique Entity ID (UEI), CAGE code, city and state (never a street address), parent-company name and UEI, business size, NAICS and PSC codes, and contract type — never a phone number, e-mail address, individual's name, or free-text award description. Full detail is on the data sources and methodology page.

    Sole proprietorships and other records that name or resolve to an individual, rather than a registered business entity, are excluded before publication. See the methodology page for the exact exclusion rules.

    Legal basis

    Publishing already-public federal contract award data, attributed to the business entities that received the awards, relies on legitimate interest (GDPR Article 6(1)(f)) — informing businesses, journalists, and the public about U.S. federal contracting activity. A written legitimate interest assessment is available on request through the contact form.

    Retention

    Contractor data is kept for as long as the source (USAspending.gov) continues to publish the underlying award. A removal request is added to this site's suppression list and honored for as long as the site operates, regardless of what the source later does. Contact-form submissions are kept for 12 months after the request is closed, then deleted.

    Your rights

    Under the GDPR you may request access (Article 15), correction (Article 16), erasure (Article 17), restriction of processing (Article 18), or object to processing (Article 21). Exercise any of these through the contact form — select "Data correction" or "Removal request." Removal requests for a contractor profile are honored within 30 days and do not require a reason.

    Who else processes data (recipients)

    • Cloudflare, Inc. — hosting, content delivery, Cloudflare Web Analytics (cookie-less), Turnstile (bot protection on the contact form), and e-mail forwarding for messages sent through the contact form.
    • Google LLC — the operator's Gmail inbox, which receives contact-form messages forwarded by Cloudflare.

    Where these providers process data outside the EU/EEA, transfers rely on the EU-U.S. Data Privacy Framework (DPF) or equivalent standard contractual clauses.

    Cookies

    Cloudflare Web Analytics does not use cookies. The contact form's Turnstile widget may set a cookie strictly to verify you are not a bot; it is not used for tracking or advertising.

    Complaints

    You may lodge a complaint with the Hungarian data protection authority — Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11., postal address 1363 Budapest, Pf. 9., ugyfelszolgalat@naih.hu, naih.hu — or with the data protection authority in your own EU member state.