Rental of secure office space for raf venda cec office with popia-compliant security measures

RFQ issued: 21 May 2026. Closing date and time: 27 May 2026 at 15:00. RFQ validity period: 30 days from closing date. Expected service start: 01 July 2026 for a 6-month lease. If not contacted within 14 working days of RFQ issuance, consider your bid unsuccessful.

Submission email: [email protected]. Enquiries email: [email protected]. RAF fraud hotline (for reporting solicited bribery): 0800 005919.

Submit quotations and all supporting documentation exclusively via email to [email protected]. Reference the RFQ number PR10116217 in your submission. Late submissions will be rejected. Complete and sign all Annexures, including Standard Bidding Documents (SBD 4, SBD 6.1) and Mandatory Evaluation documents. Failure to use the correct email address or submit required documents will disqualify your bid. Hard copies are not accepted.

Evaluation follows a 3-phase process: Phase 1 (Mandatory Requirements) - Disqualification if any mandatory requirement is unmet (e.g., no lease agreement, floor plan, property proof, or confirmation of availability from 01 July 2026). Phase 2 (Site Visit) - Only compliant bidders proceed; building must meet all site visit criteria (e.g., Grade B office space, accessibility, parking, safety). Phase 3 (Price and Specific Goals) - Scored on 80/20 preference point system: 80 points for price, 20 points for Specific Goals (HDI: 10 points, Women-owned: 8 points, Disability-owned: 2 points). Proof required: CSD report for HDI, ID/CSD report for women-owned, valid medical certificate for disability-owned. Non-compliance with pricing tables or VAT rules (e.g., non-VAT-registered suppliers charging VAT) will disqualify the bid.

Scope: Provide 400m² Grade B office space (SAPOA definition) for RAF Venda CEC Office for 6 months from 01 July 2026. Location: Vhembe District (Thulamela Local Municipality: Thohoyandou, Sibasa, Shayandima, Makwarela), preferably in Central Business District, near public transport, and easily accessible. Building: Existing Grade B structure, preferably ground floor, with 19 secure parking bays (2 for disabled). Must include: open plan/enclosed offices, reception area, meeting rooms, storeroom (30m²), ablution facilities (with disabled access per floor), pause area, kitchen (hot/cold water, electrical appliances), backup power (generator/UPS) and water supply. Compliance: OHS and National Building Regulations, fire detection/prevention, double-tier cable trays, electrical COC, SANS 10400 standards. Safety: Controlled access, security measures (burglar proofing, alarms, guards, electric fences), emergency evacuation. Landlord responsibilities: Draft layout drawings, submit for approval, maintain air-conditioning, lifts, backup systems, windows, gardens, and ensure Grade B standard. Exclusions: RAF pays no levies, taxes, or rates. Tenant installation allowance and maintenance options must be provided. Parking: Right of first refusal for additional parking.

Pricing must be in ZAR, VAT-inclusive if VAT-registered. Non-VAT vendors must not charge VAT. Submit detailed pricing in provided tables: Part A (Rental of 400m² office space and 30m² storage) and Part B (Parking and operational costs). Include variable costs (refuse, sewerage, water, electricity) and ad-hoc services (diesel for generator with % mark-up). Operational costs: Generator maintenance, aircon maintenance, fire equipment servicing, backup water maintenance, plumbing, carpentry, window washing. No price changes after Award Letter/PO issuance. Rental rates must align with market rates.

Must be CSD-registered. Tax matters must be in order with SARS. Submit Standard Bidding Documents (SBD 4, SBD 6.1) and Mandatory Evaluation documents. Preference points: HDI (10 points, 51%+ ownership, CSD report), Women-owned (8 points, 51%+ ownership, ID/CSD report), Disability-owned (2 points, 51%+ ownership, valid medical certificate). Disabled suppliers must provide a valid medical certificate. Prohibition: No gifts, hospitality, or benefits to RAF officials; report solicited bribery to 0800 005919. RAF reserves the right to verify all claims.

Evaluation will focus on the following criteria:

• Legal compliance: Must fully comply with POPIA and other relevant data protection laws.
• Security standards: Must demonstrate capability to implement physical, organisational, and cybersecurity measures as outlined in the tender.
• Vetting: Company directors and resources may be subject to security screening or vetting by RAF.
• Subcontractor oversight: Must ensure subcontractors or third parties adhere to RAF’s security and data protection requirements.
• Incident reporting: Must have a documented process for reporting security incidents or data breaches to RAF.

Scope: Provide office space for rental for RAF Venda CEC Office for a period of 6 months starting 01 July 2026.

Security and compliance requirements:

• Implement policies to comply with RAF requirements and the Protection of Personal Information Act (POPIA).
• Document handling and transportation: Use lockable containers or packaging to prevent loss, theft, or damage. Maintain accurate records of document location, access history, and retention schedule.
• Secure retrieval: Verify requester identity and ensure secure transport of documents. Maintain detailed retrieval activity records (date, time, requester identity, reason).
• Secure storage: Store physical documents in lockable cabinets. Ensure access is restricted to authorised personnel only.
• Physical security: Secure perimeter with controlled access, surveillance systems, secure doors, locks, and alarms. Protect against unauthorised access. Report any security breaches to RAF with CCTV footage, police reports, and alarm records.
• Fire suppression: Premises must have fire suppression systems or CO2 fire extinguishers to prevent document loss or damage.
• Network security: Implement firewalls, intrusion detection, and encryption for digital document storage systems.
• Access control: Grant access on a need-to-know basis. Use strong authentication methods and regularly review/update permissions.
• Data protection: Handle personal/sensitive data in compliance with POPIA. Safeguard against unauthorised access, disclosure, alteration, or destruction. Report data breaches immediately to RAF. Impose confidentiality obligations on agents, subcontractors, or third parties.
• Cybersecurity: Implement robust measures against malware, phishing, and unauthorised access. Use encryption for data in transit and at rest. Regularly update and patch systems.
• Incident reporting: Maintain a documented incident response plan. Report security incidents or data breaches to RAF promptly.
• Subcontractors: Ensure subcontractors adhere to the same data protection and cybersecurity standards. Service Provider is responsible for subcontractor compliance.
• Audit and monitoring: RAF reserves the right to audit compliance. Service Provider must cooperate with audits or assessments.

Compliance requirements:

• Full compliance with the Protection of Personal Information Act (POPIA).
• Adherence to data protection and cybersecurity standards as per RAF requirements.
• Third-party service providers handling personal information must be vetted and required to sign a data protection agreement.
• RAF reserves the right to conduct security screening or vetting for company directors and resources provided.