Supply of flexclip teams subscription for raf social digital media team with strict data security requirements

RFQ issued: 22 May 2026. Closing date and time: 28 May 2026 at 15:00. RFQ validity period: 30 days from the closing date. No compulsory briefing session, site visit, or inspection is required.

Enquiries: Email [email protected] or contact Ntsako Baloyi at 012 649 2023. Submission address: RAF Head Office, 420 Witch Hazel Avenue, Centurion, Eco Glades, Pretoria, 0046. Fraud line for reporting solicited bribery: 0800 005919.

Submit quotations exclusively via email to [email protected]. Use RFQ number PR10116075 as reference in all correspondence. Late submissions will be rejected. All Annexures (Standard Bidding Documents and Mandatory Evaluation documents) must be completed, signed, and submitted by the closing date and time. Failure to follow submission instructions or submit required documents will result in disqualification. If not contacted within 14 working days of the RFQ closing date, consider your quotation unsuccessful.

Evaluation follows a two-phase process: Phase 1 (Mandatory Requirements) and Phase 2 (Price and Specific Goals). Phase 1: Service providers must comply with all mandatory requirements, including providing a minimum of two (2) verifiable references for prior FlexClip Teams subscriptions (via Annexure A). Non-compliance with any mandatory requirement results in disqualification. Phase 2: Evaluation uses the 80/20 preference point system. Price accounts for 80 points. Specific Goals account for 20 points, allocated as follows: HDI ownership (51%+): 10 points (verified via CSD report); Women ownership (51%+): 8 points (verified via ID copy or CSD report); Persons with disabilities (51%+ ownership): 2 points (verified via valid medical certificate). Points claimed for Specific Goals will be verified through CSD. Only bids meeting mandatory requirements proceed to Phase 2.

Provide a 12-month FlexClip Teams subscription for the RAF Social Digital Media (SDM) Team. Requirements: Cloud-based video editing, animation, and motion-graphic tools for producing short-form social media content, internal communications, and event highlights. Must include: stock video and audio assets, brand kit management, AI-assisted editing tools, templates, and collaborative project sharing. Access must be provided for three (3) designated users. Deliverables: Supply and activation of the annual subscription, full functionality of the video editing platform, and technical support for setup and account administration.

Prices must be quoted in South African Rand (ZAR) and VAT-inclusive (if VAT-registered). VAT vendors must include VAT in their quoted prices; failure to do so will deem the quoted price as all-inclusive, and no VAT will be added later. Non-VAT-registered suppliers must not charge VAT or risk disqualification. Only prices completed in the provided cost breakdown table will be accepted for evaluation. No price changes will be permitted after the official Award Letter or Purchase Order (PO) is issued. Ad-hoc services (e.g., remote support, onsite support, travel) must specify rates, inclusive of VAT if applicable. Travel rates must align with approved AA rates by SARS.

Must be CSD-registered; RAF will only conduct business with CSD-registered suppliers. Tax matters must be in order with SARS. Suppliers with disabilities must provide a valid medical certificate issued by a registered medical practitioner. Complete and sign all Standard Bidding Documents (SBD 4, SBD 6.1) and Mandatory Evaluation documents. Prohibition of gifts, hospitality, or other benefits to RAF officials; branded marketing material is considered a gift. Report any solicited bribery to the RAF fraud line at 0800 005919. Failure to report may result in being barred from conducting business with all Organs of State.

Evaluation will focus on the following key areas:

• Compliance with the Protection of Personal Information Act (POPIA) and other applicable data protection laws.
• Secure premises: controlled access, surveillance systems, secure doors, locks, and alarms.
• Robust cybersecurity protocols: firewalls, intrusion detection, encryption, regular system updates, and patch management.
• Ability to handle confidential RAF data: secure document handling, transportation, storage, and retrieval processes.
• Policies for subcontractor oversight: ensuring third parties adhere to the same security and data protection standards.
• Willingness to undergo RAF security audits, vetting, and cooperation with compliance assessments.

The service provider must implement technical and organisational security measures to protect RAF's confidential, private, personal, or sensitive information (files, data, documents).

Document Handling and Transportation:

• Establish protocols for proper handling and transport of files to and from the service provider’s premises.
• Use a secure, lockable transportation system.
• Keep files in lockable containers during handling and transport to prevent loss, theft, or damage.
• Maintain accurate records of each document stored, including location, access history, and retention schedule.

Document Retrieval and Handling:

• Use secure protocols for retrieving documents, including verifying the identity of the requester.
• Maintain detailed records of all retrieval activities: date, time, requester identity, and reason.
• Store physical documents in lockable cabinets.
• Restrict access to documents to authorised personnel only.
• Implement policies and procedures to control and monitor access.
• Equip premises with a fire suppression system (e.g., carbon dioxide fire extinguishers).

Security and Facility Requirements:

• Secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks, and alarms to prevent unauthorised access.
• Implement physical security measures: controlled access points, surveillance cameras, and/or 24/7 security monitoring.
• Report any real, attempted, or suspected physical security breach to RAF immediately, providing CCTV footage, police reports, and alarm records.
• Control and monitor access to documents and storage facilities.

Network and Digital Security:

• Implement network security measures: firewalls, intrusion detection, and encryption.
• Access control: grant access on a need-to-know basis, use strong authentication methods, and regularly review permissions.

Data Protection and Cybersecurity:

• Handle personal and sensitive data in compliance with POPIA and other applicable data protection laws.
• Safeguard data against unauthorised access, disclosure, alteration, and destruction.
• Report any data breaches or security incidents to RAF immediately.
• Impose confidentiality obligations on agents, subcontractors, or third parties handling records.
• Vet third-party service providers handling personally identifiable information (PII) for their data protection policies and require signed data protection agreements.
• RAF reserves the right to conduct security screening of company directors and resources.
• Implement robust cybersecurity measures against threats such as malware, phishing, and unauthorised access.
• Use encryption for data in transit and at rest, complying with industry standards.
• Regularly update and patch systems, software, and applications to address vulnerabilities.
• Maintain a documented incident response plan for prompt breach mitigation.

Subcontractors and Oversight:

• Ensure subcontractors adhere to the same data protection and cybersecurity standards.
• The service provider is responsible for the compliance of any subcontractors or third parties.

Audit and Monitoring:

• RAF reserves the right to audit and monitor compliance with this policy.
• The service provider must cooperate with any audits or assessments conducted by RAF.

The service provider must comply with all applicable data protection laws and regulations, including:

• The Protection of Personal Information Act (POPIA).
• RAF-specific requirements for handling confidential, private, personal, or sensitive information.
• Legislative and regulatory frameworks governing the processing of personal information.
• Data protection agreements for third-party service providers handling PII.
• Security screening or vetting processes as required by RAF for company directors and resources.