Dear [Director's Name],
Thank you for the conversation. Based on what you shared about Browns Co's exposure — farmer data across the supply network, milk collection systems, payment flows, and the move into traceability — this proposal scopes a 60-day engagement to get Browns Co from current state to fully registered, audit-ready, and system-risk-clarified under the Data Protection Act, 2019. Fixed fee, three milestone payments, no surprises.
What we propose
Three milestones. Three deliverables. Three payments.
Weeks 1–3
01ODPC registration
- Data audit & classification — what personal data you hold, where, lawful basis, retention
- ODPC controller registration — application, supporting filings, certificate secured
- Statutory standing — registered in the company name, annual returns scheduled
Weeks 3–6
02Policy layer + system risk review
- Privacy policy, cookie policy, data retention schedule — board-grade, ODPC-aligned
- Farmer onboarding consent forms + collection notices — used at intake, not buried
- Breach response procedure, DPIA template, ROPA — ready for an inspector
- System risk review: milk collection app, payment system, farmer database, traceability platform — access controls, consent capture, audit logging, retention automation. Reviewed, not rebuilt.
Weeks 7–8
03Sign-off & ODPC submission
- Staff training — 1 session, ops + IT teams
- Walk-through with your designated DPO and ops lead
- Final ODPC submission pack + handover
What you'll have at the end
→Audit-ready posture
- ODPC certificate current and in the company name
- Policy pack that holds up under inspection
- System risk report ranking privacy gaps by severity
- Trained ops staff who can answer an inspector's first three questions
- Estimated 60% reduction in ODPC-enforcement exposure versus current state
Anchor
!Why this is cheap insurance
- Statutory exposure: KES 5M fine or 1% of annual turnover — whichever is higher
- For Browns Co, fines alone are several multiples of this engagement fee
- ODPC enforcement in 2024–2025 has accelerated against exactly this profile of controller
- This fee is the cost of preventing the conversation we'd rather you not have with ODPC
Out of scope (priced separately)
—What's not in this engagement
- System rebuilds — we review and recommend, your dev team (or ours on a separate quote) implements
- Ongoing DPO retainer after the 60 days
- Defence of an actual ODPC investigation if one is opened before this engagement completes
- Legal counsel — we deliver the compliance artefacts, your lawyers review if needed
Pricing & payment terms — three milestone payments
- Mobilization — 40% (KES 300,000). Payable on signing. Covers data audit, ODPC application work, and project kick-off.
- Mid-engagement — 40% (KES 300,000). Payable on delivery of Milestone 2 (policy pack + system risk report). Typically week 5–6.
- Sign-off — 20% (KES 150,000). Payable on delivery of Milestone 3 (training + final ODPC submission). End of week 8.
- Total fixed fee: KES 750,000. Plus applicable taxes. No hourly billing. Scope changes priced by mutual agreement.
- Timeline: 60 calendar days from mobilization. Delays caused by Browns Co (system access, document provision, scheduling) extend timeline but not fee.
- Validity: This proposal is valid for 30 days from the date on the cover letter.
To proceed
"Sign the engagement letter, pay the mobilization invoice, and we'll start the data audit within five working days."
Reply to stephen@bitverse.co.ke with "proceed" and I'll send the engagement letter and invoice by end of day. Or book a 15-minute call to walk through any clause.
Engagement letter & invoice
Reply "proceed" to stephen@bitverse.co.ke. Engagement letter + mobilization invoice by end of day.
Questions or a walk-through?
15 minutes on a call. I'll explain any clause, scope line, or pricing decision. stephen@bitverse.co.ke · bitverse.co.ke