Emergency services for raf sports and wellness games – 31 july 2026

The service provider must comply with the Protection of Personal Information Act (POPIA) and implement appropriate measures to protect confidential, private, personal, or sensitive information entrusted by the Road Accident Fund (RAF).

Service providers must demonstrate capability in: emergency medical services; secure handling of confidential RAF documents; implementing physical and cybersecurity measures compliant with POPIA; maintaining proper access controls and audit trails; and having appropriate insurance and incident response plans.

• The service provider must implement comprehensive technical and organisational security measures to protect RAF confidential, private, personal, or sensitive information (files, data, documents).
• Document handling and transportation: secure protocols for transfer, lockable containers/packaging, secure transportation system (lockable).
• Record keeping: accurate records of each document stored, including location, access history, retention schedule; organised for easy tracking.
• Document retrieval and handling: secure retrieval with identity verification; detailed logs of retrieval activities (date/time, requester identity, reason).
• Secure storage: physical documents in lockable cabinets to prevent unauthorised access or tampering.
• Access control: documents accessible only to authorised personnel; policies and procedures to control and monitor access.
• Fire suppression: premises must have fire suppression system or similar, including CO2 fire extinguishers.
• Physical security: secure perimeter with controlled access and/or surveillance; secure doors, locks, alarms; 24/7 security monitoring; controlled access points, surveillance cameras.
• Breach notification: any real, attempted, or suspected physical security breach must be reported to RAF with CCTV footage, police report, alarm system records.
• Network security: digital storage systems must have firewalls, intrusion detection, encryption to protect against unauthorised access.
• Access control principles: grant access on need-to-know basis; strong authentication; regular review and update of permissions.
• Data protection obligations: comply with POPIA and applicable data protection laws; safeguard data against unauthorised access, disclosure, alteration, destruction; immediate breach notification to RAF; impose confidentiality obligations on agents, subcontractors, third parties; vet third-party providers handling PII; RAF reserves right to security screen directors and resources.
• Cybersecurity standards: robust measures against malware, phishing, unauthorised access; encryption for data in transit and at rest using industry-standard protocols; regular system updates and patching.
• Incident reporting and response: documented incident response plan; timely reporting of security incidents/data breaches to RAF.
• Subcontractor and third-party oversight: subcontractors must adhere to same data protection and cybersecurity standards; service provider responsible for their compliance.
• Audit and monitoring: RAF reserves right to audit and monitor compliance; service provider must cooperate with audits/assessments.

• Compliance with the Protection of Personal Information Act (POPIA) and all applicable data protection laws and regulations.
• Implementation of measures to safeguard personal and sensitive data against unauthorised access, disclosure, alteration, and destruction.
• Immediate notification to RAF of any data breaches or incidents impacting information security.
• Confidentiality obligations extended to all agents, subcontractors, and third parties receiving records.
• Third-party service providers handling personally identifiable information (PII) must be screened/vetted for data protection policies and required to sign a data protection agreement.
• RAF reserves the right to conduct security screening or vetting of company directors and resources provided.
• Adherence to cybersecurity standards: protection against malware, phishing, unauthorised access; encryption for data in transit and at rest using industry-standard protocols; regular system updates and patching.
• Documented incident response plan for data breaches; timely reporting to RAF.
• Subcontractors must comply with the same data protection and cybersecurity standards; service provider remains responsible for their actions.
• Cooperation with RAF audits and assessments to evaluate compliance with data protection and cybersecurity standards.
• Physical security compliance: secure perimeter, controlled access, surveillance, 24/7 monitoring, secure doors/locks/alarms, breach reporting with evidence.
• Fire safety compliance: fire suppression system and CO2 extinguishers on premises.
• Network security compliance: firewalls, intrusion detection, encryption.
• Access control compliance: need-to-know basis, strong authentication, regular permission reviews.

• Fire safety: Premises must have a fire suppression system or equivalent, including carbon dioxide fire extinguishers, to prevent damage or loss of documents and records in the event of fire.
• Physical security: Secure perimeter with controlled access and/or surveillance systems; secure doors, locks, and alarms to prevent unauthorised access.
• Access control: Policies and procedures to ensure access to documents and storage facilities is controlled and monitored; only authorised personnel permitted to handle, view, or transport documents.
• Secure storage: Physical documents and records stored in lockable cabinets to prevent unauthorised access or tampering.

• Security measures: The service provider must implement and maintain technical and organisational security measures to protect RAF confidential information throughout the contract period.
• Data protection obligations: Compliance with POPIA and applicable data protection laws; safeguard data against unauthorised access, disclosure, alteration, destruction; immediate breach notification to RAF; impose confidentiality obligations on agents, subcontractors, third parties.
• Third-party oversight: Subcontractors handling PII must be vetted for data protection policies and sign data protection agreements; service provider responsible for subcontractor compliance.
• Security screening: RAF reserves the right to conduct security screening/vetting of company directors and resources.
• Cybersecurity standards: Robust measures against cyber threats (malware, phishing, unauthorised access); encryption for data in transit and at rest using industry-standard protocols; regular system updates and patching.
• Incident reporting and response: Documented incident response plan; timely reporting of security incidents/data breaches to RAF.
• Subcontractor and third-party oversight: Subcontractors must adhere to same data protection and cybersecurity standards; service provider liable for their actions.
• Audit and monitoring: RAF reserves right to audit and monitor compliance; service provider must cooperate with audits/assessments.
• Physical security: Secure perimeter, controlled access, surveillance, 24/7 monitoring, secure doors/locks/alarms; breach reporting with CCTV footage, police report, alarm records.
• Fire suppression: Premises must have fire suppression system and CO2 extinguishers.
• Network security: Firewalls, intrusion detection, encryption for digital storage systems.
• Access control: Need-to-know basis, strong authentication, regular permission reviews.
• Document handling: Secure transportation (lockable containers), accurate record keeping, secure retrieval with identity verification, detailed retrieval logs, lockable cabinet storage, access limited to authorised personnel.

• Document handling and transportation: Secure protocols for transfer of files to/from service provider premises; lockable containers/packaging; secure transportation system (lockable).
• Record keeping: Accurate records of each document stored, including location, access history, retention schedule; organised for easy and accurate tracking.
• Document retrieval and handling: Secure retrieval with identity verification of requester; secure transport of documents; detailed logs of retrieval activities (date/time, requester identity, reason).
• Secure storage: Physical documents in lockable cabinets to prevent unauthorised access or tampering.
• Access control: Documents accessible only to authorised personnel; policies and procedures to control and monitor access.
• Physical security: Secure perimeter, controlled access points, surveillance cameras, 24/7 security monitoring; breach reporting obligations.
• Network security: Firewalls, intrusion detection, encryption for digital document storage systems.
• Access control principles: Grant access on need-to-know basis; strong authentication; regular review and update of permissions.

Any person (natural or juristic) may make an offer or offers in terms of this invitation to bid. In line with the principles of transparency, accountability, impartiality, and ethics as enshrined in the Constitution of the Republic of South Africa and further expressed in various pieces of legislation, it is required for the bidder to make this declaration in respect of the details required hereunder.

Returnable Documents: The bidder must complete and submit the SBD 4 form (Declaration of Interest).

Open to any person (natural or juristic) not listed on the Register for Tender Defaulters or List of Restricted Suppliers. Must not have directors/partners employed by the state without disclosure. Must comply with all declaration requirements and certify independent bidding. Joint ventures/consortiums permitted with proper disclosure.

Any person (natural or juristic) may make an offer or offers in terms of this invitation to bid. In line with the principles of transparency, accountability, impartiality, and ethics as enshrined in the Constitution of the Republic of South Africa and further expressed in various pieces of legislation, it is required for the bidder to make this declaration in respect of the details required hereunder.

No specific requirements found

• The Road Accident Fund (RAF) requires a service provider to deliver emergency medical services for its Sports and Wellness Games event.
• The event will take place on 31 July 2026 at the Harlequins Rugby Club in Pretoria.

• Closing date and time: 20 July 2026 at 12:00.
• RFQ validity period: 30 days from the closing date.
• Expected service date: 31 July 2026 from 08:00 to 15:00.
• No compulsory briefing session, site visit, or site inspection is scheduled.

• For quotation submissions: [email protected].
• For enquiries: [email protected].

• Submit your quotation by email only to: [email protected].
• Use the RFQ number PR10117187 as your reference.
• Late submissions will not be accepted.
• You must complete and sign all Annexures (Standard Bidding Documents and Mandatory Evaluation documents).
• Failure to follow these instructions will result in disqualification.

1. Must be registered on Central Supplier Database (CSD) with valid registration number. 2) Tax matters must be declared in order by SARS. 3) Paramedics must hold current HPCSA registration as paramedics (proof required). 4) No collusive behavior - cannot submit multiple proposals from entities with common directors/shareholders. 5) Must not offer gifts/hospitality to RAF officials. 6) If claiming disability points, must provide valid medical certificate from registered practitioner. 7) Must comply with all terms in Annexures A, B, and Standard Bidding Documents.

• Service required: Emergency Services for Sports and Wellness Games.
• Date: 31 July 2026.
• Time: 08:00 – 15:00.
• Venue: Harlequins Rugby Club, Totius Street, Groen Kloof, Pretoria.
• Required resources:
• One (1) fully equipped ambulance on site for the duration.
• Two (2) qualified paramedics on site for the duration.
• A fully stocked first aid kit, including muscle sprays (cold/hot).
• Paramedics must be registered with the Health Professions Council of South Africa (HPCSA). Valid proof of registration must be submitted by the closing date.

• All prices must be quoted in South African Rand (ZAR) and must be VAT inclusive if you are VAT registered.
• If you are VAT registered and fail to include VAT, your quoted price will be deemed all-inclusive and no VAT will be added later.
• If you are not VAT registered but charge VAT, you will be automatically disqualified.
• You must complete the pricing table in the Cost Break Down section. Failure to do so leads to disqualification.
• No price changes are accepted after an official Award Letter or Purchase Order is issued.

• You must be registered on the Central Supplier Database (CSD). RAF will only conduct business with CSD-registered suppliers.
• Your tax matters must be declared in order by SARS.
• Points claimed for Preferential Procurement Specific Goals will be verified through the CSD.
• Suppliers with a disability must provide a valid medical certificate from a registered practitioner.
• Collusive behaviour is prohibited and leads to disqualification. Submitting multiple proposals from linked companies is not allowed.
• The prohibition of gifts and hospitality applies. Branded marketing material is considered a gift. Unsolicited requests must be reported to the fraud line 0800 005919.