Renewal of connect direct services and support — road accident fund, 12-Month contract

The Road Accident Fund requires the renewal of Connect Direct services and support for a period of twelve (12) months. No further scope details are provided in the available document.

Returnable documents: the completed and signed SBD 4 (Bidder's Disclosure) form must be submitted with the quotation. The form requires disclosure of any relationship with state employees or the procuring institution, and certification that the bid was prepared independently. Bidders listed on the Register for Tender Defaulters or the List of Restricted Suppliers are automatically disqualified.

The bid will be evaluated on the basis of the completed SBD 4 disclosure. Bidders on the Register for Tender Defaulters or the List of Restricted Suppliers are automatically disqualified. No further evaluation criteria are stated in the available document.

The procurement is for the renewal of Connect Direct services and support for a period of twelve (12) months, for the Road Accident Fund. No further technical specifications are provided in the available document.

Bidders must complete and submit the SBD 4 (Bidder's Disclosure) form, which includes declarations regarding employment by the state, relationships with the procuring institution, and independent bid preparation. Bidders on the Register for Tender Defaulters or the List of Restricted Suppliers are disqualified.

Quotations must be emailed to the correct RAF procurement address; responses sent to any other address will not be considered.

RFQ issued: 08 September 2026

Closing: 14 September 2026 at 12:00

Validity period: 30 days from the closing date

Compulsory briefing or site visit: none

Contract period: twelve months from the date of the last signatory

Enquiries

• Contact: Ntsako Baloyi
• Email: [email protected]
• Telephone: 012 649 2023

Submission

• Method: email
• Submission email: [email protected]

Delivery address

RAF Head Office

420 Witch Hazel Avenue

Centurion

Eco Glades

Pretoria, 0046

Submission method: email only

• Submission email: [email protected]
• Quote RFQ number PR10118736 as the reference on the quotation and all supporting documents.
• Quotations received after the closing time are not accepted for consideration.
• Every annexure must be completed and signed, including the Standard Bidding Documents and any mandatory evaluation documents.

Returnable documents

• SBD 4 (Bidder's Disclosure): discloses the bidder's interests; must be completed and signed.
• SBD 6.1 (Preference Points Claim, PPR 2022): claims preference points for specific goals.
• Annexure A: Security Measures.
• Cost breakdown table: prices must be entered in the prescribed table; a quotation without prices in that table is disqualified.

Disqualification risks

• Quotation submitted after the closing time.
• Prices not entered in the prescribed cost breakdown table.
• More than one proposal from companies sharing a director or shareholder, or more than one entity responding to this invitation.
• Collusive behaviour.
• A supplier that is not VAT-registered charging VAT.

Preference point system: 80/20 under the Preferential Procurement Policy Framework Act, 2022

• Price: 80 points
• Specific goals: 20 points
• Total: 100 points
• Applies to quotations with a rand value from R2 000.01 up to R1 000 000.00, all applicable taxes included. RAF may elect to apply the 80/20 system to quotations below R2 000.01.
• Points claimed for preferential procurement specific goals are verified through the CSD.

Scope

• Renewal of Connect Direct services and support for twelve months.
• Connect Direct licences required for twelve months: Production Server (1), Test Server (1), DR Server (1) and Secure+ (1).

Support services

• Onsite and remote support, capped at a maximum of 30 hours.
• File transfer investigations.
• First-line application support and any changes.
• Knowledge transfer and training.
• Configuration or installation of the Connect Direct service or application.
• Upgrades to the latest versions and packages, and migrations.

Ad hoc services

• Remote support: charged per occurrence.
• Onsite support: charged per occurrence.
• Travelling: charged per kilometre at approved AA rates published by SARS.

Pricing

• All prices must be quoted in South African Rand and be VAT inclusive for VAT-registered suppliers.
• VAT vendors must include VAT in their proposed prices; if VAT is omitted, the quoted price is treated as all-inclusive and no VAT will be added after award.
• A supplier that is not VAT-registered and charges VAT is automatically disqualified.
• Only prices entered in the prescribed cost breakdown table are accepted for evaluation; failure to price the table leads to disqualification.
• No price changes are accepted after the official Award Letter or Purchase Order is issued.

Cost breakdown (quantities)

• Connect Direct Production Server licence, twelve months: 1
• Connect Direct Test Server licence, twelve months: 1
• Connect Direct DR Server licence, twelve months: 1
• Secure+, twelve months: 1
• VAT (if registered) and grand total to be shown.

Ad hoc rates

• Remote support: per occurrence
• Onsite support: per occurrence
• Travelling: per kilometre at approved AA rates by SARS

Registration and tax

• CSD registration is mandatory; RAF only conducts business with CSD-registered suppliers.
• Tax matters must be declared in order by SARS.

Returnable forms

• SBD 4 (Bidder's Disclosure).
• SBD 6.1 (Preference Points Claim, PPR 2022).
• Annexure A: Security Measures.
• All annexures, including the Standard Bidding Documents and mandatory evaluation documents, must be completed and signed.

Disqualification

• Collusive behaviour.
• Submitting more than one proposal from more than one registered company with a common director or shareholder, or responding to this invitation with more than one entity; all entities involved are disqualified.
• Late quotations.
• A supplier that is not VAT-registered charging VAT.
• Failure to price the prescribed cost breakdown table.

Disability claims

• Suppliers claiming disability must submit a valid medical certificate from a registered medical practitioner; RAF may verify the information.

Gifts and hospitality

• Suppliers must not offer any gift, hospitality or other benefit to RAF officials; branded marketing material counts as a gift.
• Any request by an RAF official for a gift, hospitality or benefit must be reported to the toll-free fraud line 0800 005919; failure to report solicited bribery makes the supplier an accomplice and bars it from doing business with all organs of state.

Technical and organisational security measures attached to the appointment: the provider will be entrusted with RAF confidential, private, personal and sensitive records and must hold policies that meet RAF requirements and the Protection of Personal Information Act.

Scope of this annexure: security, confidentiality and data-protection obligations the appointed provider must meet while holding RAF confidential, personal and sensitive records during the contract period.

Document handling and transport

• Documented protocols for moving files between RAF and provider premises.
• Lockable transport system and lockable containers or packaging to prevent loss, theft or damage.
• Records of each document's location, access history and retention schedule, kept so that any document can be tracked accurately.

Retrieval and handling

• Requester identity verified before documents are released.
• Log of every retrieval: date, time, who requested it and why.
• Physical documents kept in lockable cabinets, accessible only to authorised staff.
• Fire suppression capability on the premises, including carbon dioxide extinguishers.

Facility and physical security

• Secure perimeter with controlled access and/or surveillance; secure doors, locks and alarms.
• Controlled access points, surveillance cameras and/or round-the-clock monitoring.
• Any actual, attempted or suspected breach of physical security must be reported to RAF, together with CCTV footage, a police report and linked alarm records.

Access control

• Access granted on a need-to-know basis only, using strong authentication, with permissions reviewed and updated regularly.
• Digital storage protected by firewalls, intrusion detection and encryption.

Data protection

• Personal and sensitive data handled in line with the Protection of Personal Information Act and other applicable data protection law.
• Safeguards against unauthorised access, disclosure, alteration and destruction; breaches reported to RAF immediately.
• Confidentiality obligations imposed on agents, subcontractors and any third party that receives records.
• Third-party processors screened for their data-protection policies and required to sign a data protection agreement.

Cybersecurity

• Measures against malware, phishing and unauthorised access.
• Encryption of data in transit and at rest using industry-standard protocols and algorithms.
• Systems, software and applications patched and updated regularly.

Incident response

• A documented incident response plan to address and contain data breaches quickly.
• Security incidents and data breaches reported to RAF without delay.

Subcontractors

• Subcontractors must apply the same data-protection and cybersecurity standards, and the provider remains accountable for their conduct and compliance.

Audit

• RAF may audit and monitor compliance with these measures, and the provider must cooperate with any assessment.

Legal framework

• The Protection of Personal Information Act governs the handling of RAF personal, confidential and sensitive information, alongside other applicable data-protection law.
• Confidentiality undertakings must extend to the provider's agents, subcontractors and any third party that receives records.

Third parties

• Any processor handling personal information on the provider's behalf must be screened and must sign a data protection agreement.

RAF rights

• RAF may conduct security screening or vetting of company directors and of the personnel supplied.
• RAF may audit and monitor the provider's compliance and may require cooperation with its assessments.

Breach duties

• Actual, attempted or suspected security breaches must be reported to RAF, with supporting CCTV footage, a police report and alarm records where physical security is involved.

Premises and fire safety

• Fire suppression system or equivalent on the premises, with carbon dioxide fire extinguishers, to limit damage or loss of records in a fire.
• Secure perimeter with controlled access and/or surveillance systems.
• Secure doors, locks and alarms to keep unauthorised persons out.
• Controlled access points and surveillance cameras, and/or round-the-clock security monitoring, for the safety of documents in the provider's possession.
• Storage facilities must at all times be protected against unauthorised access.

Obligations carried by the provider for the duration of the contract

• Protect the confidentiality of personal, confidential and sensitive data and apply controls against unauthorised access, disclosure, alteration and destruction.
• Notify RAF without delay of any data breach or security incident affecting the information.
• Pass equivalent confidentiality obligations to agents, subcontractors and third parties holding records, and sign a data protection agreement with any third-party processor.
• Apply cybersecurity measures covering malware, phishing and unauthorised access, encrypt data in transit and at rest using industry-standard protocols, and keep systems and software patched.
• Maintain a documented incident response plan and report incidents and breaches to RAF promptly.
• Remain answerable for the data-protection and cybersecurity compliance of any subcontractor or third party used in delivering the service.
• Submit to RAF audits and monitoring, and cooperate with RAF assessments of compliance.
• Accept RAF's right to screen or vet company directors and personnel supplied.

Security conditions attached to the appointment

• The provider handles RAF files, data and documents as confidential, private, personal or sensitive information under the Protection of Personal Information Act.
• Document handling and transport must use lockable containers and a secure lockable transport system, with records of each document's location, access history and retention schedule.
• Retrieval requires identity verification of the requester, with a log of the date, time, requester and reason; physical records are kept in lockable cabinets and reachable only by authorised staff.
• Digital storage must use firewalls, intrusion detection and encryption, with need-to-know access, strong authentication and periodic review of permissions.
• Physical security breaches must be reported to RAF with CCTV footage, a police report and alarm system records.
• Third-party processors must be screened and must sign a data protection agreement; the provider answers for subcontractor compliance.
• RAF reserves the right to screen or vet directors and supplied personnel and to audit and monitor compliance, with the provider obliged to cooperate.