The small print

Bike is Best Privacy Policy

Version 1.2, effective 22 October 2026.

How we use your data, in brief

What we collect, and why: your name, phone number, email and date of birth to run your account and your hires; whether your identity check passed; your booking and payment records; and photos of the bike when it goes out and comes back.
Optional questions: once, after a ride, two or three quick questions (whether you had ridden a bike much before, what you do, and your gender); and, after some rides, how you would have got there without the bike. Skip any of them: your hire is exactly the same either way, and no price or reward depends on them.
Gender: optional, and counted only in totals, so we can see who rides with us and who we are not yet reaching (for example, how many riders are women). Saved only if you tick its own unticked box, never used for marketing, and you can have it deleted at any time in your profile.
What the answers are for: to decide where to add bikes, which routes and group rides to run and who our learn-to-ride sessions should reach. They are only ever counted together with everyone else's: nothing we report names or identifies anyone, and small numbers are hidden.
Never for marketing: we do not sell your data or share it with advertisers, and you get offers only if you ask for them (reply STOP to end them).
Who sees it: our staff see what they need to hand over your bike and help you, and the companies that handle payments, messages and identity checks for us see only what they need for that. Only you and our senior staff can see your gender answer; desk staff never do.
How long we keep it: your profile and answers until you delete them or close your account; booking and payment records for seven years, without your name once your account is closed.
See, change, download or delete it: all in your profile ("Your details", "Download my data", "Remove my survey answers", "Close account"), or write to info@bikeisbest.co.ke. We answer within 14 days.
Complaints: tell us first; you can also complain to the Office of the Data Protection Commissioner (www.odpc.go.ke).

The full Policy

Bike is Best Kenya Enterprise Ltd ("Bike is Best", "we", "us") is the data controller for the personal data we collect when you use our website, app, desk, SMS and USSD services. This Policy explains what we collect, why, who sees it, how long we keep it and what rights you have under the Data Protection Act 2019 (the "Act"). It forms part of our Hire Terms and Conditions.

What changed in version 1.2: the optional quick questions asked once after a ride (whether you had ridden a bike much before, what you do), where you live as part of your address (your sub-county in Mombasa, or that you are visiting), the optional question after some rides about how you would have got there without the bike, and how we report these to funders and partners in totals only; gender, asked as optional sensitive data with its own separate consent; up to five emergency contacts shared with the app; and the summary in brief at the top.

What changed in version 1.1: the photographs we take of each bike at handover and return; the record our staff system keeps of who changed what; analytics and session recording each only with your consent; marketing only if you opt in, with STOP and unsubscribe; the text our desk receives when you write to support; riders under 18; our registration with the Data Protection Commissioner.

1. Who we are

Data controller: Bike is Best Kenya Enterprise Ltd, Sote Hub, Bella Rosa House, Moyne Drive, Nyali, Mombasa, Kenya. Contact for anything in this Policy: info@bikeisbest.co.ke or WhatsApp +254 795 951 331.

Registration: the Act requires us to register with the Office of the Data Protection Commissioner (ODPC) as a data controller, and we do. Our registration number is given on request and will be shown here once our certificate is issued.

2. What we collect and why

What	Why	Legal basis under the Act
Name, email address, password (stored as a hash), mobile number	To create and secure your account, sign you in, and reach you about your bookings	Performance of a contract; our legitimate interest in account security
Date of birth, county, locality, username, profile photo, emergency contact	To confirm the hirer is 18 or over, personalise your account and know who to call if something happens on the road	Contract; your consent (photo, emergency contact)
Who is riding on a booking and their ages, where you tell us	To apply the age rules in the hire terms (riders under 18 only with a parent or guardian, ebikes 18+)	Contract; for a child, the consent of the parent or guardian making the booking
Identity verification result (passed or not) and the verification session reference	To meet our hire terms before a bike is handed over, and to prevent fraud and theft	Contract; legitimate interest; compliance with legal obligations
Biometric data (a liveness selfie) and identity document images, processed by our verification partner Didit	To confirm that the person booking is the holder of the document	Your explicit consent, given separately; you may verify in person at the desk instead
Booking details, payment references, M-Pesa transaction codes, deposits, charges and refunds	To provide the hire, keep accurate records, and handle disputes and charges	Contract; legal obligation; legitimate interest
Handover and return records: which bike went out, its condition, battery level, extras, the staff member who handed it over and took it back, and up to four photographs of the bike each way	To show the state of the bike when it left and when it came back, so a damage charge can be checked against evidence and a dispute settled fairly	Contract; legitimate interest
Messages you send to our support chat, and our replies	To help you	Contract; legitimate interest
A short text to our desk phone when you write to support: your name, your chat number and the first 80 characters of your message	So someone at the desk answers you quickly	Legitimate interest
Delivery log of SMS, WhatsApp and email messages we sent you (content with codes masked)	To show what was sent if there is a question	Legitimate interest
Device and usage information (pages viewed, booking steps, web performance), only after you allow analytics	To improve the website	Your consent
Session recordings (how the page was used, with everything typed masked), only after you allow them separately	To find and fix parts of the website that are hard to use	Your separate consent
Event registrations, guests' names, tour requests	To run rides, tours and events you join or ask about	Contract
Preferences: message channel (SMS or WhatsApp), reminders, marketing	To send messages the way you chose, and marketing only if you opted in	Consent; contract
Emergency contacts: up to five people, their mobile numbers and how they relate to you (the same list in the website and the app)	To call someone if something happens to you on the road	Your consent; your vital interests
Where you live, as part of your address (county, and your sub-county in Mombasa, or that you are visiting Mombasa), if you add it	To plan bikes and rides, and to show funders and partners, in totals only, who rides with us	Your consent, given by adding it; change or remove it in your profile
Optional quick questions, asked once after a ride: whether you had ridden a bike much before, what you do	To plan bikes and rides, and to show funders and partners, in totals only, who rides with us	Your consent, given by answering; you can skip any question
Trip purpose on older bookings (we asked "what's this ride for?" until 22 October 2026 and no longer do)	Kept only in totals in reports to funders and partners	Your consent, given when you chose one
Optional answer after some rides (about one ride in four): how you would have got there without the bike	To estimate, in totals, the trips cycling replaces and the emissions avoided	Your consent, given by answering
Gender, only if you choose to answer and tick the separate consent box	To report, in totals only, who rides with us, including to funders and partners, for example the share of riders who are women	Your explicit consent, given separately; withdraw it at any time

The optional questions. These are the quick questions we ask once, after a ride (whether you had ridden a bike much before, what you do, and gender), and the question after some rides (how you would have got there without the bike). We ask the quick questions only once: answer or skip, and we do not ask again, on the website or in the app. None of them is needed to book, and skipping them changes nothing about your hires; no reward or price depends on answering. You can delete your answers at any time in your profile ("Remove my survey answers") or by writing to us. We use the answers only to plan the service and to report, in totals, to funders, grant makers and partners, for example "28% of our riders are women" or an estimate of the emissions avoided by rides that replaced a motorised trip. These reports contain totals only and never identify anyone: counts under 10 are never shown, other counts are rounded, and no answer is ever given to anyone as yours. The answers are never used to set prices or for marketing, and they are not shown on your profile to anyone else.

Gender is sensitive personal data under the Act, and we ask it as follows.

What: "You are…" Woman, Man or Another way. It is optional: leave it and nothing changes.
Why: to report, in totals only, who rides with us, including to funders and partners who support more bikes and learn-to-ride sessions, for example the share of riders who are women.
Your explicit, separate consent: your answer is saved only if you tick a separate, unticked box: "Use this only in anonymous totals". We record when you agreed and under which version of this Policy.
Who can see it: you, in "Download my data", and our senior staff (administrators and the owner), to correct our records if you ask. Desk staff never see it. Staff cannot change it; only you can.
Never for marketing: it is never used for marketing, messages, prices, rewards or any decision about you, and it is never shown publicly.
How long we keep it: until you withdraw your consent or close your account.
How to withdraw: "Remove my survey answers" in your profile, or write to us. Your answer and the consent record are then deleted. Totals already published stay as they are.
Small numbers: in any report, counts under 10 are never shown and other counts are rounded, so no one can be picked out.

We do not collect your identity document number or keep images of your document or face. Our verification partner holds those under its own policy, in the European Union, for the time its policy states.

3. Photographs of bikes at handover and return

Our staff photograph each bike when it goes out and when it comes back. The photographs are of the bike; we ask staff to keep people out of the frame. They are private: they are not published, and they are shown only to our staff, through links that expire after an hour, and to you when we itemise a charge. We keep them with the booking record for as long as the booking record is kept (section 7).

4. The record of what our staff do

Our staff system keeps an append-only log of each action that changes a record: who did it, when, which booking, bike or setting, and the values before and after (for example a handover, a charge, a refund or a cancellation, with the reason given). It exists so that every change can be traced to a named member of staff and cannot be quietly rewritten. Only our administrators can read it. Entries are never edited, and are kept for as long as the records they describe.

5. Where your data comes from

Directly from you; from our staff at the desk (handover and return records); from your use of the website and app; from Didit (the verification result); from Paystack and Safaricom (payment references and status); from Google, if you sign in with Google (your name, email address and profile picture).

6. Who we share it with

We share personal data only with providers who process it on our instructions under written contracts, and only what each needs:

Didit (identity verification, EU): your name, phone number, the document and selfie you present.
Paystack (payments, Kenya/Nigeria) and Safaricom M-Pesa: your phone number, amount and reference.
Africa's Talking (SMS, Kenya), Infobip (WhatsApp, EU) and Resend (email, USA): your number or address and the message. The desk alert in section 2 goes to our own desk phone through Africa's Talking.
Google (Firebase hosting of our database and files, and Google Maps/Places), Vercel or our hosting provider (running the website): the data stored and served by the site.
PostHog (analytics, EU): usage events, only if you allowed analytics, and session recordings, only if you allowed those too.
Our staff at the desk, who see your name, booking, phone number, verification result, handover and return records and any notes.

We do not sell personal data and we do not share it with advertisers. We disclose it to the police, a court or a regulator only when the law requires or to protect our bikes, staff or riders, for example to recover a stolen bike.

Some providers above are outside Kenya. We transfer data to them under written agreements with safeguards equivalent to the Act, and only for the purposes listed. A copy of your records stays in Kenya.

7. How long we keep it

Account and profile, including the optional answers: while your account is open, unless you delete them sooner in your profile. When you close your account, you have 30 days in which signing in reopens it; after that your profile and answers are deleted or anonymised. Answers about what a ride replaced stay in our totals without your name.
Your gender answer and its consent record: until you withdraw your consent or close your account; then they are deleted.
Bookings, payments, charges, refunds and the handover and return records and photographs that go with them: seven years, as our business and financial records, without your name attached once your account is closed.
The staff action log (section 4) and your acceptances of our terms: for as long as the records they describe.
Identity verification result: while your account is open, and for a number with no open account, one year. Verification session references: one year.
One-time codes: two days. Message delivery logs: 90 days. Support chats: while your account is open.
Analytics events and session recordings: as set in the analytics provider, no more than 12 months.

Retention is enforced automatically by a scheduled job.

8. Marketing

We send news and offers only if you opted in; the box is never ticked for you, and a booking confirmation or reminder never carries an offer. You can stop marketing at any time, free and in one step: reply STOP to any SMS or WhatsApp message from us, use the unsubscribe link in any marketing email, or switch it off in your profile. Booking messages carry on, because they are part of the hire.

9. Your rights

Under the Act you may ask us to: tell you what personal data we hold about you and give you a copy (there is a "Download my data" button in your profile); correct it; delete it (there is a "Close account" button in your profile, which anonymises your records except those we must keep by law); restrict or object to processing; and withdraw a consent you gave, including for the selfie check, analytics, session recording, marketing and your gender answer, without affecting what was done before. We answer within 14 days. Write to info@bikeisbest.co.ke or WhatsApp the Hub.

If you are not satisfied with our answer you may complain to the Office of the Data Protection Commissioner, Nairobi (www.odpc.go.ke).

10. Security

Passwords are stored as one-way hashes. Connections are encrypted. Access to the desk is by named staff accounts with set roles, and every change is logged (section 4). One-time codes are masked in our logs. Photographs of bikes, and rider photos of bike problems, are private and visible to staff only through short-lived links. We review access and dependencies regularly. If a breach affecting your data occurs we will notify the Commissioner within 72 hours and you without undue delay as the Act requires.

11. Cookies, analytics and session recording

We use strictly necessary cookies to keep you signed in and to protect forms. Until you choose, analytics run in memory only: no cookie, nothing stored in your browser, and no recording. Analytics are switched on only if you choose "Allow analytics", and session recording only if you separately choose to allow it; each is off by default and you can change either choice at any time. Your choice is kept in your browser under two keys, bb.analytics and bb.recording, which are strictly necessary to remember it. We do not use advertising cookies.

12. Children

The hirer must be 18 or over. A rider under 18 may ride only on a booking made by their parent or guardian, who gives any consent needed for the child's data and rides with them. We record only what the booking needs about a child (their age, and their name if the parent or guardian gives it). We do not publish photographs of riders under 18 without the separate consent of their parent or guardian.

13. Changes to this Policy

We may update this Policy. The current version with its version number and effective date is published on our website, every earlier version stays readable there, and you will be asked to accept a new version before your next booking.

Bike is Best Kenya Enterprise Ltd · Sote Hub, Bella Rosa House, Moyne Drive, Nyali, Mombasa · info@bikeisbest.co.ke