Legal
Privacy Notice
Bik Investors Africa Ltd, trading as Extreme Clean. Written under the Kenya Data Protection Act, 2019.
Version 1 · Effective [Effective date]
This notice explains how we collect, use, share and protect your personal data when you visit our Centres, use our website, message us on WhatsApp or join our memberships and loyalty programme. The version published on our website is the one that applies.
1. Who we are
We are Bik Investors Africa Ltd, trading as Extreme Clean. Our customer brand is Extreme Spa. We are the data controller for the personal data described in this notice.
We run five Centres in the Nairobi area:
- Garden City Mall, Thika Road
- TRM Mall, Thika Road
- The Hub, Karen
- Two Rivers Mall, Kiambu
- Galleria Mall, Lang'ata Road
Registered office: [Registered office address]
Data Protection Officer: [Data Protection Officer name], [Data Protection Officer email]
We handle personal data in line with the Data Protection Act, 2019 and the Data Protection (General) Regulations, 2021.
2. How to contact us
For any question about your personal data, or to use your rights, contact us:
- Email: customerservice@extremeclean.co.ke or info@extremeclean.co.ke
- WhatsApp: +254 723 828 618
- Phone: 0800 724 448
- Website: extremeclean.co.ke
3. The personal data we collect
When you use our services
- Your name and mobile number, and your email address if you give it to us.
- Your vehicle number plate and vehicle type or size.
- The Centre you visited, the services you bought and your transaction history.
- Membership pass details and billing dates.
- Payment references. You pay by M-Pesa (Paybill 671004, using your car registration as the account number) or by card. We do not accept cash. Your card number is handled by our payment provider. We do not store it.
Messages, loyalty and accounts
- Messages you send us on WhatsApp.
- Extreme Club loyalty points balances and history, from 1 October 2026.
- Referral links between members. A member's number plate is used as their referral code, so we record who referred whom.
- Household accounts. Up to four cars can sit under one primary mobile number. We link those vehicles to that number.
Businesses and job applicants
- Corporate and fleet enquiries: company name, contact person, number of cars, vehicle types and branches.
- Job applications you send to careers@extremeclean.co.ke, including your CV and anything else you choose to include.
At our Centres and online
- CCTV images recorded at our Centres. [Confirm: CCTV in use at Centres]
- Website usage data collected through cookies from Google Analytics 4 and the Meta Pixel, if you allow them.
- Data collected by Google Maps and YouTube when you view maps or videos embedded on our website.
4. How we use your data and our lawful basis
We only use your personal data where the law allows it. The table below sets out each purpose and the lawful basis we rely on.
| Purpose | Lawful basis |
|---|---|
| Taking bookings and providing car care and detailing services | Performance of a contract with you |
| Running memberships and sending billing reminders | Performance of a contract with you |
| Running Extreme Club loyalty points and referrals | Performance of a contract with you |
| Responding to corporate and fleet enquiries | Steps you ask us to take before entering a contract |
| Handling complaints and customer service queries | Performance of a contract with you, and our legitimate interest in resolving issues |
| Sending marketing messages and offers | Your consent |
| Website analytics and advertising cookies | Your consent for non-essential cookies |
| Keeping accounting, tax and legal records | Legal obligation |
| Preventing fraud and misuse of referrals and loyalty points | Legitimate interest |
| Keeping our Centres, staff and customers' vehicles secure through CCTV [Confirm: CCTV in use at Centres] | Legitimate interest |
| Assessing job applications | Steps you ask us to take before entering a contract |
Marketing
We only send you marketing messages if you have agreed to receive them. You can stop them at any time by replying STOP to any message, or by contacting us. Stopping marketing does not affect service messages, such as booking confirmations or membership billing reminders.
7. Transfers outside Kenya
Some of our service providers, including Google and Meta, store data on servers outside Kenya. When your data is transferred abroad, we apply the safeguards required by sections 48 to 50 of the Data Protection Act, 2019. This means we only transfer data where there are appropriate protections in place for its security and use.
8. How long we keep your data
We keep personal data only for as long as we need it for the purpose we collected it, or as the law requires.
- Transaction and tax records: [7 years, confirm].
- Marketing consent: until you withdraw it.
- CCTV recordings: [CCTV retention period, confirm], unless needed to investigate an incident.
- Job applications: [Job application retention period].
When we no longer need your data, we delete it or make it anonymous.
9. Your rights
Under section 26 of the Data Protection Act, 2019, you have the right to:
- be informed about how we use your personal data;
- access the personal data we hold about you;
- object to us processing all or part of your personal data;
- have false or misleading data corrected;
- have false, misleading or unlawfully held data deleted.
You also have the right to data portability under section 38, which means receiving your data in a commonly used format or having it sent to another organisation. You have the right not to be subject to a decision based only on automated processing that significantly affects you.
How to make a request
Email customerservice@extremeclean.co.ke or send us a WhatsApp message on +254 723 828 618. Tell us what you are asking for and the mobile number or number plate linked to your account. We may ask you to confirm your identity before we act. We will respond within the time the law requires.
Withdrawing consent
Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.
Complaints
If you are unhappy with how we handle your data, please contact us first so we can try to resolve it. You also have the right to complain to the Office of the Data Protection Commissioner (ODPC) at www.odpc.go.ke.
10. Children
Our services are for vehicle owners. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us their data, contact us and we will delete it.
11. Keeping your data secure
We use technical and organisational measures to protect your personal data from loss, misuse and unauthorised access. These include limiting access to staff who need it and working only with service providers who protect data appropriately.
If a data breach occurs that is likely to put your rights at risk, we will notify the ODPC within 72 hours of becoming aware of it where the law requires. Where needed, we will also tell you.
12. Changes to this notice
We may update this notice from time to time. The version number and effective date at the top show when it last changed. The version published on our website is the one that applies.