Data loss prevention solution

Call for tenders Data loss prevention solution 14 july 2025 2 Table of contents Page 1 Introduction 4 1.1 Profile of the UPU 4 2 Terms and conditions 4 2.1 Confidentiality 4 2.2 Legal status of the Vendor 5 2.3 Scope of the call for tenders 5 2.4 Background 5 2.5 Objectives 5 2.6 Use of subcontractors 5 2.7 Use of the emblem, name and initials of the UPU 5 2.8 Collusive bidding, anti-competitive practices and any other similar conduct 6 2.9 Intellectual property 6 2.10 Privileges and immunities 6 2.11 Tax exemption 6 2.12 Language 7 2.13 Signature 7 2.14 Participation notification 7 2.15 Contact persons 7 2.16 Further inquiries and questions 7 2.17 Delivery of tenders and deadline 7 2.18 Evaluation procedure 7 2.19 Modification, suspension or cancellation of the call for tenders 8 2.20 Tentative schedule 8 3 Tender structure – Response format 8 3.1 Cover letter 9 3.2 Executive summary 9 3.3 Bidder information 9 3.4 Subcontractor information 9 3.5 Technical proposal 9 3.6 Pricing structure 9 3.7 Delivery and payment schedule 10 3.8 UPU General Terms and Conditions 10 4 Service requirements 10 4.1 Description of the services 10 4.2 Bidder requirements 12 4.3 Consultant requirements 12 4.4 Assessment criteria 13 4.5 Duration of services 13 4.6 Location of the services 13 3 Table of contents (cont.) Page 4.7 Reporting 13 4.8 Other requirements 13 4.9 Additional information 13 4 1 Introduction 1.1 Profile of the UPU The Universal Postal Union (UPU) was founded in 1874 in Berne, Switzerland, with the main goals of estab- lishing a single postal territory for the reciprocal exchange of letter-post items and adopting common principles for the international postal service in a non-discriminatory manner. Currently comprising 192 member coun- tries, the UPU became a specialized agency of the United Nations in 1948. The main mission of the UPU is to stimulate the lasting development of efficient and accessible universal postal services of quality, in order to facilitate communication between the inhabitants of the world. It does this by guaranteeing the free circulation of items over a single postal territory composed of interconnected networks, encouraging the adoption of fair common standards and the use of technology, ensuring cooperation and interaction among stakeholders, promoting effective technical cooperation, and ensuring the satisfaction of customers’ changing needs. The UPU is thus expected to play a major role in the continued revitalization of postal services. Furthermore, the UPU facilitates the development of worldwide postal services by providing an information and communication technology framework that allows the designated operators1 of UPU member countries to concentrate on the delivery of postal services to their customers. In this context, the UPU provides a global network with value-added services, as well as computerized applications for the management of international mail and international postal money orders. 2 Terms and conditions Unless otherwise indicated in this call for tenders, the term “Bidder” shall refer to any person, company or legal entity submitting a proposal in response to this call for tenders. The term “Vendor” shall refer to any selected bidder. 2.1 Confidentiality Bidders shall treat in strict confidence all information contained in this call for tenders and its attached docu- ments that is not already publicly known or generally accessible, particularly any documentation marked as confidential and distributed by the UPU to Bidders as additional confidential tender documentation. Bidders shall prevent the disclosure or distribution of all such information to third parties and other entities and persons not expressly authorized herein. In case of doubt, these confidentiality provisions shall nevertheless be observed. All Bidders are obliged to observe these confidentiality provisions before, during and after the tender process. These provisions shall not affect the legal obligations of the UPU and Bidders to disclose information. Bidders shall not use such information for any purposes other than those associated with this call for tenders. The call for tenders and all attached documents may be distributed or made available only to persons directly involved in the tender process on behalf of Bidders. If external agents or subcontractors are involved in the preparation of the tender documents, this must be indicated and their names provided in the participation notification (see section 2.14). Bidders shall assume full responsibility for the compliance of their agents, consultants, employees and sub- contractors, as well as any third parties involved on their behalf in this tender process, with these rules of confidentiality, and shall be liable for any damages resulting from misconduct or unauthorized disclosure. If a Bidder violates the confidentiality provisions contained herein, it shall be liable to pay a penalty to the UPU unless it can prove that no fault is attributable to it. This penalty shall not exceed 50,000 CHF per infringement. Payment of any such penalties shall not release Bidders from their obligation to observe these confidentiality requirements. 1 In accordance with article 2.1.6 of the UPU Constitution, a designated operator is any governmental or non-governmental entity officially designated by the member country to operate postal services and to fulfil the related obligations arising out of the Acts of the Union on its territory. 5 Bidders wishing to submit a proposal in response to this call for tenders must contact the person(s) specified in section 2.15 below and may, if necessary, request additional information from the UPU in relation to this call for tenders. Without prejudice to the confidentiality provisions set out above, Bidders agree that the receipt of any such information may be subject to the prior signature of a non-disclosure agreement between the Bidder and the UPU, under conditions to be determined and communicated by the latter. 2.2 Legal status of the Vendor The Vendor shall be regarded as having, in law, the legal status of independent contractor. The Vendor and its agents, consultants, employees and subcontractors (as authorized by the UPU) shall in no way be regarded as employees of the UPU. Such agents, consultants, employees and subcontractors of the Vendor shall not be entitled to any employment benefits from the UPU. The Vendor alone shall be responsible for due payment of all compensation owed to such agents, consultants, employees and subcontractors, including payment of any employment taxes, benefits, compensation and insurance. The Vendor shall represent and warrant that it will comply with all laws, rules and regulations required by the relevant authorities, including the appropriate withholding, reporting and payment of all necessary taxes. The Vendor shall be liable for all work performed, including any acts or omissions, by its agents, consultants, employees and subcontractors. 2.3 Scope of the call for tenders This call for tenders concerns the provision of a data loss prevention (DLP) solution to protect sensitive infor- mation across all UPU digital assets for a period of four years. 2.4 Background Not applicable. 2.5 Objectives The UPU seeks proposals from qualified Bidders for the provision of a DLP solution to protect sensitive infor- mation across all UPU digital assets, which includes Windows endpoints, professional mobile devices, multiple (on-premises) file servers, multiple (on-premises and cloud) SharePoint farms and Office 365 e-mail services. The Vendor will be responsible for provision of the solution, as well as the associated installation services. 2.6 Use of subcontractors The Vendor shall not assign, sublicense, subcontract, pledge or otherwise transfer or dispose of its tender, or any of the rights and obligations contained therein or in an associated contract with the UPU, without the prior written consent of the UPU. The approval by the UPU of the engagement of any subcontractor shall not relieve the Vendor of any of its obligations or responsibilities concerning the work performed by such subcontractors. 2.7 Use of the emblem, name and initials of the UPU Bidders shall not advertise or otherwise make public the fact that they intend to provide, are providing or have provided services to the UPU, or use the emblem, name or initials of the UPU in connection with their business for purposes of commercial advantage or goodwill, without prior and explicit permission from the UPU. Bidders shall take all reasonable measures to ensure compliance with this provision by their agents, consultants, employees and subcontractors. 6 2.8 Collusive bidding, anti-competitive practices and any other similar conduct Without prejudice to the provisions in sections 3 and 4 below, Bidders (including their agents, consultants, employees and subcontractors) shall not engage in any collusive bidding, anti-competitive practices or any other similar conduct in relation to: – the preparation and submission of tenders; – the clarification of tenders; – the conduct and content of any negotiations, including final contract negotiations. For the purposes of this call for tenders, collusive bidding, anti-competitive practices and any other similar conduct may include the disclosure to, or exchange or clarification with, any other Bidder of information (in any form), whether or not such information is confidential to the UPU or to any other Bidder, in order to alter the results of the call for tenders in such a way that would lead to an outcome other than that which would have been obtained through a competitive process. In addition to any other remedies available to it, the UPU may, at its sole discretion, immediately reject any tender submitted by a Bidder that, in the UPU’s opinion, has engaged in any collusive bidding, anti-competitive practices or any other similar conduct with any other Bidder in relation to the preparation or submission of tenders, whether with respect to this call for tenders or other procurement processes conducted by the UPU. 2.9 Intellectual property This call for tenders and all its attached documents, including any content, forms, statements, concepts, pro- jects and procedures explicitly or implicitly forming part of the call for tenders, constitute the exclusive intellec- tual property of the UPU. This call for tenders is communicated to the various Bidders with the sole purpose of assisting them in the preparation of their respective tenders. Any hard copies of this call for tenders shall be destroyed or returned to the UPU by unsuccessful Bidders at the request of the UPU. 2.10 Privileges and immunities Nothing in or relating to this call for tenders, the activities described herein or any potential agreements related thereto shall be deemed as a waiver, expressed or implied, of any of the privileges, immunities and facilities that the UPU enjoys as a specialized agency of the United Nations system, pursuant to the Swiss Host State Act and the Agreement on Privileges and Immunities of the United Nations (on Swiss territory), the Convention on the Privileges and Immunities of the Specialized Agencies (outside Switzerland), and any other conventions and laws recognizing and/or granting such privileges, immunities and facilities to the UPU and its officials (such as the International Organizations Immunities Act in the case of the United States of America). Accordingly, the Vendor shall expressly acknowledge and agree that the property and assets of the UPU, including any archives, data, documents and funds belonging to the UPU or held by it (including, without limi- tation, the data/hosting environments and servers pertaining to or associated with the provision of the services, as well as any data or documents in any form belonging to or held by the UPU on behalf of UPU member countries and their designated operators), are inviolable and shall be immune from search, requisition, confis- cation, expropriation and any other form of interference, whether through executive, administrative, judicial or legislative action. The Vendor shall immediately contact the UPU in the event of any attempt to violate or any violation of the UPU’s privileges and immunities, and shall take all reasonable measures to prevent such vio- lations. In the light of the UPU’s status as a specialized agency of the United Nations (and without prejudice to the observance, by the UPU, of any sanctions established by the United Nations Security Council), Bidders shall expressly certify their legal and operational willingness and ability to provide the services on a non- discriminatory basis for the benefit of all eligible entities established and/or situated in the territory of any UPU member country, irrespective of the existence of diplomatic relations between a Bidder’s country of incorpora- tion and/or operation and any UPU member country (including its designated operators). 2.11 Tax exemption Pursuant to article III, section 9, of the Convention on the Privileges and Immunities of the Specialized Agencies, the UPU is exempt from all direct taxes and from customs restrictions, duties and charges of a similar nature in respect of articles imported or exported for its official use. 7 Furthermore, as an intergovernmental organization and a specialized agency of the United Nations, the UPU is exempt from value-added tax (VAT) in Switzerland (OLTVA, article 22; Instructions 2001 sur la TVA, arti- cles 574, 816 and others), as well as in other countries. Therefore, all prices shall be indicated in “net” form, without VAT or similar taxes. 2.12 Language Bidders must submit all tender documents entirely in English. 2.13 Signature Tender documents shall be signed by a representative (or representatives) duly designated and authorized to act on the Bidder’s behalf and with the authority to legally bind the Bidder and accept the terms and conditions of this call for tenders. 2.14 Participation notification Upon receipt of this call for tenders, Bidders shall send confirmation of participation to the contact person(s) listed in section 2.15 by the deadline indicated in section 2.20. 2.15 Contact persons Secretary of the Tenders and Procurements Committee Universal Postal Union International Bureau Weltpoststrasse 4 3015 BERNE SWITZERLAND E-mail: caa@upu.int 2.16 Further inquiries and questions Bidders must send any questions regarding the content of this call for tenders or any requests for clarification in writing to the contact person(s) listed in section 2.15 by 29 July 2025. Answers to questions submitted by Bidders, as well as any additional information and updates relevant to this call for tenders, shall be published on the UPU website at www.upu.int/en/Universal-Postal-Union/ Procurement. 2.17 Delivery of tenders and deadline All tenders must be submitted to the UPU by e-mail only at RFP-2025-027@upu.int with “RFP-2025-027 – Data loss prevention solution” as the subject line. The deadline for the submission of tenders is 8 September 2025 at 17.00 CEST. The UPU shall not take into consideration any tenders received after this date and time. Furthermore, it shall not accept any tenders sent to any e-mail address other than that specified above or sent by any other means. There shall be no charge to the UPU for the preparation and submission of tender documents by Bidders. 2.18 Evaluation procedure The objective of the UPU’s evaluation process is to ensure the selection of a qualified, reliable and experienced Vendor capable of providing the specialized services and fulfilling the objectives set out in this call for tenders. 8 The UPU shall conduct its evaluation procedure with a view to determining as objectively as possible the tender that best meets its specific requirements. All tenders submitted shall be subject to an in-depth assessment, at the UPU’s sole discretion, in order to enable the UPU to engage the most appropriate service provider. Due consideration will be given to Bidders’ specific backgrounds, qualifications and experience in relation to the required services. The prescribed structure of tenders, as set out in section 3, is mandatory for all Bidders. The UPU shall not take into consideration any tenders that do not fulfil the mandatory criteria. Tenders received by the UPU must address all aspects of this call for tenders, and Bidders should identify any aspects where they envisage modifications being necessary or consider elements to be missing. Tenders shall be evaluated on the basis of the following criteria, in descending order of importance: – Quality of the tender (according to the specifications herein); – Knowledge and experience of the Bidder and its team and/or consultant(s), as applicable to the subject matter; – Price. The winning tender will be selected based on a non-exhaustive list of criteria as set out in section 4. Bidders should therefore consider how their tender corresponds with the criteria listed and clearly indicate this in their response document. The deliberations of the UPU Tenders and Procurements Committee (TPC) are strictly confidential. The TPC shall submit a report on its evaluation of the tenders received to the Director General of the UPU International Bureau, together with its final recommendation, for his assessment and authorization. The UPU is not bound to accept the lowest tender and reserves the right to accept all or part of a tender. In awarding the contract, account will be taken of both the overall costs of the work and of the nature and quality of the services to be provided. The UPU reserves the right to negotiate prices and terms and conditions of contract after receipt of tenders. Bidders will be informed of the outcome of their tender as soon as possible after the UPU has made its final selection. 2.19 Modification, suspension or cancellation of the call for tenders The UPU reserves the right, at its sole discretion and at any time before the conclusion of the tender process (i.e. at any time prior to the signature of the relevant contract with the Vendor), to modify, suspend or cancel all or part of this call for tenders. 2.20 Tentative schedule Publication of call for tenders 14 July 2025 Deadline for submission of participation notification 29 July 2025 Deadline for submission of queries 29 July 2025 Deadline for provision of responses to queries 5 August 2025 Deadline for submission of tenders to the UPU 8 September 2025 at 17.00 CEST Estimated start of engagement December 2025 3 Tender structure – Response format All information provided by Bidders must be fully compliant with the terms and conditions set out in section 2 above, as well as the provisions of this section and the service requirements listed in section 4 below. 9 Moreover, the requirements stipulated in this call for tenders must be met in their entirety, according to the structure defined below and following the sequence and numbering provided in this section. The UPU shall evaluate all Bidder responses in accordance with the structure defined herein and shall have the right to reject any tenders that do not fulfil the requirements of this call for tenders. For each of the requirements listed in this call for tenders, Bidders shall answer with one of the following statements: – covered; – covered with limitations (explaining relevant limitations); – not covered. Where the answer is “covered” or “covered with limitations”, Bidders shall provide further details and/or exam- ples of existing implementations of their solution in the field (existing use cases). 3.1 Cover letter Bidders shall submit a cover letter including: – a statement that the Bidder has read, understands and accepts all provisions of this call for tenders; – the Bidder’s name, telephone number, postal address and e-mail address, and the name(s) of its rep- resentative(s); – a statement that the Bidder’s tender documents are valid for a minimum period of 120 days. The cover letter shall be signed by a representative (or representatives) duly designated and authorized to act on the Bidder’s behalf and with the authority to legally bind the Bidder and accept the terms and conditions of this call for tenders, and shall also include a confirmation of such authorization by the Bidder. 3.2 Executive summary Bidders shall provide an executive summary highlighting the most important aspects of their tender. 3.3 Bidder information Bidders must provide the following information: – company structure, locations/subsidiaries; – financial data (turnover, profit, etc.); – partners and equity holders of the company; – company history; – market position and share in relevant markets. 3.4 Subcontractor information A list of any subcontractors directly involved in the provision of part or all of the services set out in this call for tenders must be provided and their exact degree of involvement must be specified. 3.5 Technical proposal Bidders shall submit a technical proposal addressing all of the requirements set out in section 4 (Service requirements). This proposal should outline the methodology, processes and timelines, as appropriate, that Bidders intend to implement in order to fulfil the objectives of this call for tenders. 3.6 Pricing structure Bidders shall provide a detailed pricing structure for the proposed solution and associated services. 10 Bidders shall not include VAT in their pricing structure (see section 2.11 above). All pricing information shall be set out exclusively in Swiss francs (CHF). 3.7 Delivery and payment schedule The target dates for provision of the services are as follows: – Start date: 15 December 2025 – End date: 14 December 2029 The delivery and payment schedules should be proposed by Bidders in their pricing structures, and must be agreed with the UPU. The services provided by the Vendor shall be invoiced in arrears on an annual basis. The UPU will make payment within 30 business days of receipt of invoice, subject to its acceptance of the services provided and the Vendor’s transmission to the UPU of any and all documentation clearly detailing the services to which the invoice pertains (in a format to be established by the UPU). 3.8 UPU General Terms and Conditions Bidders shall include in their tender a statement of acceptance of the UPU General Terms and Conditions for the Provision of Services, attached hereto for reference. The final terms of any contract arising from this call for tenders shall be defined by the UPU and accepted by the Vendor. Contract negotiations shall commence only after the final selection of a Vendor by the UPU. 4 Service requirements 4.1 Description of the services The Vendor will be expected to fulfil the following requirements: – provision of the DLP solution; – installation and support during the initial deployment phase; – initial training and knowledge transfer for administrators, power users and end users; – quarterly reviews of the set-up and follow-up on policy and implementation improvements (remotely or on-site); – warranty and support for a four-year period. In the event that Bidders propose a cloud-based solution, it is strongly preferred that this be hosted in Switzerland. In the event that the solution is hosted outside Switzerland, Bidders shall indicate where the UPU data managed by the solution will be stored. 4.1.1 Purpose The primary purposes of the required DLP solution include: – protection of sensitive information at rest, in transit and in use; – prevention of unauthorized disclosure and exfiltration of information; – monitoring and control of information movement across assets; – provision of policy-based enforcement for information security; – guaranteed compliance with regulatory requirements, such as the European Union’s General Data Protection Regulation (GDPR); – protection and leak prevention specific to activities involving the handling of personally identifiable infor- mation (PII); – seamless integration with existing security infrastructure. 11 4.1.2 Scope of the services The proposed DLP solution should cover the following assets: – Endpoints: If technically feasible, the proposed DLP solution must integrate with the UPU’s existing endpoint security solution (Sophos) for unified policy enforcement. If not, the solution must protect information on 300-400 endpoints (Windows 10 and Windows 11) and 100 professional mobile devices against leaks via removable media, e-mail, cloud uploads and other channels; – Servers: If technically feasible, the proposed DLP solution must integrate with the UPU’s existing end- point security solution (Sophos) for unified policy enforcement. If not, the solution must protect infor- mation on around 500 virtual servers (Windows Server 2016/2019/2022 and higher, Linux CentOS 7/RedHat, and MAC OS) against leaks via cloud uploads and other channels; – File servers (on-premises): Scan and classify structured and unstructured data in CIFS, NFS and SMB shares (approx. 250 TB total capacity); – SharePoint (on-premises and cloud): Implement DLP controls on multiple (at least five) on-premises SharePoint farms to identify and secure sensitive content; – Office 365 (Exchange Online and Teams): Scan and enforce DLP policies on information traversing via Office 365 for 300–400 users; – Network integration (on-premises): If technically feasible, support integration with the UPU’s firewall infrastructure (Checkpoint) to monitor and block unauthorized information transfers; – E-mail infrastructure integration (on-premises): If technically feasible, support integration with the UPU’s e-mail infrastructure (Cisco) to monitor and block unauthorized e-mail transfers. 4.1.3 Functional requirements – Data discovery and classification: Ability to identify, classify based on the UPU information classification and handling policy, and tag sensitive information, including PII, across all covered assets. Provision of OCR support for text extraction from images/PDF files. The solution must have advanced capabilities for identification and classification of different types of PII; – Content filtering: The tool must have content filtering capabilities to inspect information in transit or at rest and to identify sensitive information based on predefined rules and signatures; – Policy enforcement: Granular policy controls with predefined and customizable rules. The tool must enable leak prevention policies to be defined and applied, based on the UPU information classification and handling policy, users, destinations and actions. These policies can block, alert or authorize specific actions. The tool should enable the definition and application of leak prevention policies specific to PII processing activities; – Templates: Custom and pre-built classification templates for regulatory compliance; – Real-time monitoring and alerts: Continuous monitoring with real-time incident reporting. This includes monitoring of e-mail, file sharing, transfer via removable devices (USB, etc.) and network communications; – Data encryption and masking: Support for encryption and different data masking techniques (tokeniza- tion, pseudonymization, anonymization, etc.), especially for PII protection; – User and role-based access controls: Policies should be enforceable based on user roles and permis- sions (e.g. read-only or reports-only). – Incident response and remediation: Automated response actions (e.g. block, quarantine, notify) for pol- icy violations; – Comprehensive reporting and auditing: Detailed reports for compliance tracking and forensic analysis; – Additional requirements specific to the handling of PII: • Data minimization: The tool should help to apply the principle of data minimization by identifying and flagging transfers or storage of PII that appear excessive in relation to the purpose of the processing operation; 12 • Protection of PII during physical transfers: When PII is transferred physically, the DLP tool should be integrated with tracking or logging systems to record transfers (including senders, recipients, dates and times) of physical media containing PII; • Test data protection: The DLP tool should help to prevent the use of real PII in test and develop- ment environments. It should recommend or apply pseudonymization or anonymization tech- niques for data used for these purposes; • Obligations of PII processors: As the UPU acts as a PII processor, the DLP tool is required to implement the specific controls mentioned in Annex B of ISO/IEC 27701. These controls may include specific contractual requirements and obligations incumbent upon PII controllers; • Support for data protection impact assessments: The DLP tool should provide information and reports that can be used as part of data protection impact assessments; – Information deletion: The tool should facilitate the application of procedures for the secure deletion of information (e.g. destruction of media containing PII); – Warranty and support: The proposed solution should include a four-year warranty. In the event of a subscription model, this should cover the specified four-year period; – Initial implementation phase: The proposed solution should include an adequate number of days for the initial implementation phase, including assistance with the basic configuration and optimization in accordance with suppliers’ best practices. In the event that an “adequate number of days” is difficult to quantify, Bidders are requested to specify a per-day rate for support provided by an engineer. 4.1.4 Technical requirements – Scalability: Support for 800 endpoints and potential future expansion; – Cloud and on-premises support: Hybrid deployment capabilities; – Integration with existing access control systems: The tool must be able to integrate with access control and identity management systems in use at the UPU to apply policies based on user roles and access rights; – Agent-based and agentless deployment: Flexibility in deployment methodologies; – Integration with SIEM and firewall solutions: Compatibility with existing security products; – Low performance overhead: Minimal impact on system performance. 4.1.5 Compliance and security standards – Compliance with data protection and privacy laws and regulations: Ensure compliance with national and regional laws and regulations, including, but not limited to, the GDPR; – ISO support: Ensure alignment with industry best practices for information security management (ISO 27001, ISO 27017 and ISO 27018) and privacy information management (ISO 27701). 4.2 Bidder requirements Bidders must be able to communicate in English. Bidders shall demonstrate a record of satisfactory performance in similar activities (i.e. reference letters and/or work completion certificates). The business transactions and activities carried out by the Bidder must be com- pliant with the mandates and principles of the UPU. 4.3 Consultant requirements Consultants must be able to communicate in English. 13 4.4 Assessment criteria Bidders will be assessed on the basis of a scoring system of up to 100 points for their technical proposal and pricing structure, assessed on the basis of the following criteria: Criteria Points obtainable Compliance with the needs expressed in this call for 50 tenders Quality of partnerships with security suppliers 20 Pricing structure 20 Quality of the proposal 10 Bidders shall provide evidence of their ability to meet these requirements by means of a list of references. 4.5 Duration of services The services are scheduled to commence in December 2025 for a total contract term of four years. 4.6 Location of the services The Vendor or its assigned consultant shall liaise and work closely with the UPU (as instructed by the latter) and may be required from time to time to carry out certain tasks from the headquarters of the UPU in Berne, Switzerland. Any additional expenses that would be charged to the UPU in the event that the Vendor is required to travel to Berne must be specifically stated in the pricing structure. 4.7 Reporting Not applicable. 4.8 Other requirements Bidders shall describe any relevant procedures for ensuring the continuity of the services provided and for appropriate backup and retraining, as well as any relevant procedures pertaining to project management and communication. Bidders shall also confirm that their tender covers all costs associated with the provision of the services referred to herein. Any other costs to be incurred by the Vendor, including any travel and subsistence costs incurred in the provision of the services at locations other than its own premises and specifically designated by the UPU, shall be subject to the prior written consent of the UPU. No other fees shall be paid, with the exception of reimbursement of other unavoidable costs incurred for successful delivery of the services, which shall also be subject to the prior written consent of the UPU. 4.9 Additional information Bidders may include any additional information that they deem necessary or relevant in order for the UPU to gain a clear and detailed understanding of the services being offered.