Privacy notice

Last updated: September 20, 2026

Who is responsible

The controller and operator of Nonprofit Figures is Ökrös László EV., Hungary. The GDPR applies to this service in full (Article 3(1)), including to data subjects in the United States. The only way to reach us is thecontact form.

What this site publishes, and what it leaves out

Nonprofit Figures presents financial figures that tax-exempt organizations reported to the U.S. Internal Revenue Service, from the IRS Exempt Organizations Business Master File, the Statistics of Income extracts, Form 990 e-file data, Publication 78 and the Automatic Revocation list. All of these are public datasets. Themethodology page lists each source, its licence, its update frequency and the download date.

The pages are about organizations. The pipeline reads a fixed list of fields and does not read the names or pay of officers, directors, trustees, key employees or contractors, donors, individual grantees, or the person who signed or prepared a return, nor the "in care of" name of the Business Master File. Trusts, organizations registered under a person's name without an organizational word, and organizations on our suppression list are excluded. A street address is shown only for larger organizations; the others show city, state and ZIP code. A mission statement is published only if it contains no personal title, e-mail address or phone number. No natural person's name, address, birth date, phone number, e-mail address, pay or ownership stake appears on any page, in any URL, in the search index, in the sitemaps or in structured data.

Legal basis

Where an organization's name or public record can relate to a natural person, we rely on legitimate interests under GDPR Article 6(1)(f): public access to the tax-exempt sector's public filings, in a form that reveals no personal details. A legitimate interest assessment is available on request through the contact form. Data in the contact form are processed for the purpose of answering you, on the same basis.

Retention

• Source data: kept while the IRS continues to publish it; the site is rebuilt from the latest files.
• Suppression list: kept for as long as the service operates, so that a removed identifier does not return. It contains identifiers and an internal reference, no names or contact details.
• Contact form messages: kept for up to 12 months after the request is closed.

Your rights

You may request access (Article 15), rectification (16), erasure (17), restriction of processing (18) and object to processing (21). Use the contact form with the topic "Removal request" or "Data correction". We act on removal requests within 30 days and do not ask for a reason. Removal covers the page, the search index and the lists on which the organization appears.

Recipients and processors

• Cloudflare, Inc. – hosting and delivery (Workers and CDN), Turnstile spam protection on the contact form, e-mail routing and, if enabled, Web Analytics, which measures page views without cookies.
• Google LLC – the mailbox that receives contact form messages (Gmail).

Both providers can process data in the United States. The transfers rest on the EU–U.S. Data Privacy Framework, in which the providers are certified.

What the contact form collects

Name, e-mail address, topic and message, and the technical data needed to deliver and rate-limit the request (IP address, held briefly by Cloudflare for rate limiting). There is no registration and no newsletter. The site sets no advertising or tracking cookies.

Complaints

You can complain to the supervisory authority of your habitual residence or place of work in the EU. In Hungary this is the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11., postal address 1363 Budapest, Pf. 9., e-mail ugyfelszolgalat@naih.hu, website naih.hu.