Privacy Policy
Publication date: 1 January 2026.
This Personal Data Processing Policy sets out the procedure for the processing and protection of personal data by Individual Entrepreneur Oleg Igorevich Novikov.
1. General provisions
1.1. This Policy has been prepared in accordance with Russia’s Federal Law No. 152-FZ “On Personal Data” and other regulatory legal acts of the Russian Federation concerning personal data.
1.2. The personal data operator is:
Individual Entrepreneur Oleg Igorevich Novikov
Russian Tax ID (INN): 504230516961
Russian state registration number for an individual entrepreneur (OGRNIP): 322508100369467
Website: https://ngfinance.ru
Email for personal data enquiries: oleg@credit-brk.ru
1.3. This Policy applies to all personal data that the Operator receives from website users, clients, prospective clients, representatives of legal entities and individual entrepreneurs, counterparties and other persons interacting with the Operator.
1.4. Use of the Operator’s website, submission of an application, or contact through enquiry forms, messaging apps, email or other communication channels signifies that the data subject has read this Policy.
2. Key definitions
2.1. Personal data means any information relating directly or indirectly to an identified or identifiable natural person.
2.2. Operator means a person who, independently or jointly with other persons, organises and/or carries out the processing of personal data.
2.3. Personal data processing means any action or set of actions involving personal data, including collection, recording, systematisation, accumulation, storage, updating, use, transfer, depersonalisation, blocking, deletion and destruction.
2.4. Data subject means the natural person to whom the personal data relates.
2.5. Website means the Operator’s website at https://ngfinance.ru.
3. Purposes of personal data processing
The Operator processes personal data for the following purposes:
3.1. Receiving and handling users’ enquiries, applications and requests.
3.2. Providing advisory and intermediary services concerning the arrangement of financing for legal entities and individual entrepreneurs.
3.3. Selecting banking, leasing, microfinance and other financial products.
3.4. Carrying out a preliminary assessment of a financing application.
3.5. Interacting with clients and prospective clients.
3.6. Transferring information to banks, leasing companies, microfinance organisations and other partners involved in reviewing a financing application, where there is a legal basis for doing so.
3.7. Preparing, entering into, performing and terminating contracts.
3.8. Conducting business correspondence and communicating by telephone, email, messaging apps and other communication channels.
3.9. Complying with the requirements of the legislation of the Russian Federation, including tax, accounting and other mandatory record-keeping requirements.
3.10. Handling enquiries from data subjects.
3.11. Sending informational and advertising messages only where the data subject has provided separate consent.
3.12. Analysing the operation of the website, improving service quality, and ensuring that the website and communication tools function correctly.
4. Categories of personal data processed
The Operator may process the following categories of personal data:
4.1. Surname, first name and patronymic.
4.2. Telephone number.
4.3. Email address.
4.4. Russian Tax ID (INN).
4.5. Information about the legal entity or individual entrepreneur represented by the data subject.
4.6. The position, role or status of an organisation’s representative.
4.7. Information provided by the data subject in an application, enquiry, questionnaire or message.
4.8. Information contained in documents provided by the data subject for the review of a financing application.
4.9. The history of communications with the Operator.
4.10. Technical data automatically transmitted when using the website: IP address, browser, device and operating system details, cookies, and information about the user’s actions on the website.
4.11. Other information voluntarily provided by the data subject to the Operator for the purposes of processing.
The Operator does not intentionally collect or process special categories of personal data concerning racial or national origin, political opinions, religious or philosophical beliefs, health or intimate life, and does not process biometric personal data.
5. Categories of data subjects
The Operator processes the personal data of the following categories of data subjects:
5.1. Website users.
5.2. Clients and prospective clients.
5.3. Representatives of legal entities.
5.4. Individual entrepreneurs.
5.5. Representatives of counterparties and partners.
5.6. Persons sending enquiries, applications, messages or documents to the Operator.
6. Legal bases for personal data processing
The Operator processes personal data on the following legal bases:
6.1. The data subject’s consent to the processing of personal data.
6.2. The necessity of processing personal data to enter into, perform, amend or terminate a contract.
6.3. The necessity of processing personal data to exercise the Operator’s rights and legitimate interests, provided that this does not infringe the data subject’s rights and freedoms.
6.4. The necessity of fulfilling obligations imposed on the Operator by the legislation of the Russian Federation.
7. Procedure and methods of personal data processing
7.1. Personal data is processed using a combination of automated and non-automated methods.
7.2. The Operator may perform the following actions involving personal data: collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer, provision, access, blocking, deletion and destruction.
7.3. Personal data processing involves transmission over the Internet.
7.4. Personal data processing does not involve transmission over a legal entity’s internal network.
7.5. The Operator does not disseminate personal data, meaning that the Operator does not disclose personal data to an indefinite group of persons.
8. Transfer of personal data to third parties
8.1. The Operator may transfer personal data to third parties only where there is a legal basis, the data subject’s consent, or in cases provided for by the legislation of the Russian Federation.
8.2. For the purposes of reviewing a financing application, personal data may be transferred to the following categories of recipients:
- banks;
- leasing companies;
- microfinance organisations;
- financial organisations;
- credit brokers and partners;
- organisations involved in reviewing the financing application;
- telecommunications operators, email services, CRM systems and other technical services used to handle enquiries and communications.
8.3. The Operator does not sell personal data to third parties.
8.4. Personal data is transferred only to the extent necessary to achieve the purposes of processing.
9. Storage of personal data
9.1. Personal data is stored for no longer than required by the purposes of personal data processing, unless a different retention period is established by the legislation of the Russian Federation, a contract or the data subject’s consent.
9.2. When the purposes of processing have been achieved, the data subject has withdrawn consent, or other lawful grounds arise, personal data is subject to deletion or destruction, unless otherwise provided for by the legislation of the Russian Federation.
9.3. The primary storage of personal data uses databases located within the Russian Federation.
10. Cookies and technical data
10.1. The Operator’s website may use cookies and web analytics services to ensure that the website functions correctly, analyse traffic, and improve service quality and user experience.
10.2. Technical data may include an IP address, browser type, device and operating system details, the source of the visit to the website, the user’s actions on the website, and other similar data.
10.3. The user may restrict or disable cookies in their browser settings. If they do so, certain website features may not work correctly.
10.4. Further details of the use of cookies may be set out in a separate Cookie Policy published on the Operator’s website.
11. Measures to protect personal data
11.1. The Operator takes the necessary legal, organisational and technical measures to protect personal data against unlawful or accidental access, destruction, alteration, blocking, copying, provision, dissemination and other unlawful actions.
11.2. These measures include:
- appointing a person responsible for organising personal data processing;
- approving internal documents concerning personal data processing;
- restricting access to personal data;
- using password protection for work devices and accounts;
- identifying and authenticating users;
- using antivirus protection;
- backing up information;
- configuring access rights for email services, messaging apps, CRM systems, spreadsheets and other services;
- using a secure HTTPS connection when working with the website;
- carrying out internal monitoring of compliance of personal data processing with the requirements of the legislation of the Russian Federation.
11.3. Access to personal data is granted only to persons who need it to achieve the stated purposes of processing.
12. Rights of the data subject
The data subject has the right to:
12.1. Receive information about the processing of their personal data.
12.2. Request that their personal data be updated, blocked or destroyed if it is incomplete, outdated, inaccurate, unlawfully obtained or unnecessary for the stated purposes of processing.
12.3. Withdraw consent to the processing of personal data.
12.4. Request that personal data processing cease.
12.5. Challenge the Operator’s actions or failure to act before the competent authority for the protection of data subjects’ rights or in court.
13. Procedure for data subject enquiries
13.1. To exercise their rights, the data subject may send an enquiry to the Operator at the following email address:
13.2. The enquiry should preferably include:
- surname, first name and patronymic;
- contact details for a reply;
- the substance of the enquiry;
- information that helps confirm the interaction with the Operator.
13.3. The Operator handles data subject enquiries in accordance with the procedure and time limits provided for by the legislation of the Russian Federation.
14. Withdrawal of consent to personal data processing
14.1. The data subject may withdraw consent to the processing of personal data at any time by sending the relevant request to the Operator.
14.2. After receiving a withdrawal of consent, the Operator ceases processing and destroys the personal data in the cases and in accordance with the procedure provided for by the legislation of the Russian Federation, unless there are other legal bases for continuing processing.
15. Changes to this Policy
15.1. The Operator may amend this Policy.
15.2. A new version of the Policy takes effect upon publication on the Operator’s website, unless otherwise provided for in the new version of the Policy.
15.3. The current version of the Policy is permanently available on the website at:
https://ngfinance.ru/en/privacy
16. Operator’s contact details
Operator: Individual Entrepreneur Oleg Igorevich Novikov
Russian Tax ID (INN): 504230516961
Russian state registration number for an individual entrepreneur (OGRNIP): 322508100369467
Website: https://ngfinance.ru
Email for personal data matters: oleg@credit-brk.ru