Public procurement notice: Contract Notice
Published: 2025-05-14
Buyer: Danske Spil A/S
Country: DK
Region: DK011
Contract type: Services
Procedure: Open procedure
CPV classification: 72220000: Systems and technical consultancy services | 72222300: Information technology services | 72254100: Systems testing services
Estimated value: 4500000 DKK
Submission deadline: 2025-06-13
Award criteria: price, quality

Technical requirements: Is the economic operator bankrupt? This information needs not be given if exclusion of economic operators in this case has been made mandatory under the applicable national law without any possibility of derogation where the economic operator is nevertheless able to perform the contract.
Has the economic operator itself or any person who is a member of its administrative, management or supervisory body or has powers of representation, decision or control therein been the subject of a conviction by final judgment for corruption, by a conviction rendered at the most five years ago or in which an exclusion period set out directly in the conviction continues to be applicable? As defined in Article 3 of the Convention on the fight against corruption involving officials of the European Communities or officials of Member States of the European Union, OJ C 195, 25.6.1997, p. 1, and in Article 2(1) of Council Framework Decision 2003/568/JHA of 22 July 2003 on combating corruption in the private sector (OJ L 192, 31.7.2003, p. 54). This exclusion ground also includes corruption as defined in the national law of the contracting authority (contracting entity) or the economic operator
Has the economic operator itself or any person who is a member of its administrative, management or supervisory body or has powers of representation, decision or control therein been the subject of a conviction by final judgment for participation in a criminal organisation, by a conviction rendered at the most five years ago or in which an exclusion period set out directly in the conviction continues to be applicable? As defined in Article 2 of Council Framework Decision 2008/841/JHA of 24 October 2008 on the fight against organised crime (OJ L 300, 11.11.2008, p. 42).
Has the economic operator, to its knowledge, breached its obligations in the field of environmental law? As referred to for the purposes of this procurement in national law, in the relevant notice or the procurement documents or in Article 18(2) of Directive 2014/24/EU.
Has the economic operator itself or any person who is a member of its administrative, management or supervisory body or has powers of representation, decision or control therein been the subject of a conviction by final judgment for money laundering or terrorist financing, by a conviction rendered at the most five years ago or in which an exclusion period set out directly in the conviction continues to be applicable? As defined in Article 1 of Directive 2005/60/EC of the European Parliament and of the Council of 26 October 2005 on the prevention of the use of the financial system for the purpose of money laundering and terrorist financing (OJ L 309, 25.11.2005, p. 15).

Eligibility requirements: The tenderer shall submit the ESPD indicating the following information:

As a minimum requirement, a positive equity is required in the most recent available annual report/financial statement.

The tenderer may, in connection with this procurement procedure, rely on the economic and/or financial capacity of other entities in order to fulfil the suitability requirements. The entity or entities making their economic and/or financial capacity available to the tenderer must provide a declaration of support, as further specified in the tender specifications. A template for such declaration is attached as an appendix to the tender specifications.

Where the tenderer relies on the economic and financial capacity of other entities to fulfil the suitability requirements, as set out below, the contracting authority requires that the tenderer and the relevant entities assume joint and several liability for the performance of the contract.

The ESPD (European Single Procurement Document) serves as preliminary evidence that the tenderer meets the minimum requirements concerning economic and financial capacity. 

Prior to the contract award decision, the tenderer to whom the contracting authority intends to award the contract shall provide documentation verifying the accuracy of the information submitted in the ESPD.

If the tenderer relies on the capacities of other entities, the equity capital shall be calculated as the combined equity of the company and such other entities in the most recent available  annual report / financial statement.
In the case of a group of companies (e.g., a consortium), the equity capital shall be calculated as the total equity of the companies in the most recent available annual report / financial statement.
The information shall be provided in section IV.B of the ESPD.
The tenderer shall submit the European Single Procurement Document (hereinafter referred to as the ESPD) indicating the following information:

The tenderer must hold valid accreditation or approval in compliance with the requirements for testing organisations, as set out in the most recent version of the Danish Gambling Authority’s Certification Programme for betting and online casino.

As a minimum requirement, testing organisations shall attain minimum one of the following accreditations/approvals:
- CREST Accredited Penetration Testing
- ISO/IEC 17025-accreditation with reference to the Danish Gambling Authority’s certification programme for betting and online casino SCP.04.00.DK, or
- ISO/IEC 17065-accreditation with reference to the Danish Gambling Authority’s certification programme for betting and online casino SCP.04.00.DK, or
- Approved Scanning Vendor (ASV) approval.

Accreditation shall be documented through presentation of certification issued by credible and independent bodies confirming that the tenderer meets the minimum requirements concerning accreditation.
The tenderer shall submit the ESPD indicating the following information:

The Tenderer shall provide evidence of at least two references from the past two (2) years, counted from the expiry of the tender submission deadline, and relating to the performance of penetration testing services, which are comparable in scope and substance to the penetration testing described in the latest versions of the Danish Gambling Authority’s documents, SCP.04 and SCP.05.

Only references pertaining to services completed at the time of submission of the tender will be taken into consideration in assessing whether the minimum requirements regarding technical and professional capacity are fulfilled, cf. below. If the reference concerns an ongoing assignment, only the part of the services already completed by the time of tender submission will be included in the assesment.

Each reference should contain a brief description of the delivered service. The description should clearly outline the specific content and methodology applied in the performance of the service, as well as the role(s) of the tenderer in its delivery. Furthermore, the reference should include the financial value (amount) of the delivery, the date(s) of performance, and the name of the client (recipient).

When indicating the date(s) of the service, the tenderer must state the start and end dates of the performance. If this is not possible – for example, if the services were rendered on an ongoing basis under a framework agreement – the tenderer must describe how the dates have been specified in the description of the delivery.

A maximum of three (3) references may be submitted, regardless of whether the tenderer is a single entity, relies on the technical capacity of other entities, or is a consortium or other grouping of operators. Any additional references beyond this number shall be disregarded. 

The tenderer may, in this procurement procedure, rely on the technical and/or professional capacity of other entities in order to fulfil the suitability requirements. The entity or entities making their technical and/or professional capacity available to the tenderer must sign a declaration of support, as further specified in the tender specifications. A template for such declaration is included as an appendix to the tender specifications.

The ESPD shall serve as preliminary evidence that the tenderer meets the minimum requirements concerning technical and professional capacity.

Before the award decision is made, the tenderer to whom the contracting authority intends to award the framework agreement must provide documentation proving that the information in the ESPD is correct.

The tenderer will not be required to submit further documentation regarding technical and professional capacity as it relates to the provided references. However, the contracting authority reserves the right to contact the tenderer or the customer specified in the reference to verify the information provided, including the dates stated.
Reference is made to Appendix A for further details.
Pursuant to the Act on the Danish Complaints Board for Public Procurement (Act No. 492 of 12 May 2010 as amended), complaints must be submitted to the Complaints Board for Public Procurement within the following time limits:

A complaint regarding not being selected must be submitted to the Complaints Board for Public Procurement within 20 calendar days, cf. Section 7(1) of the Act, from the day after the contracting authority has sent a notification to the affected candidates regarding who has been selected, provided that the notification includes a statement of reasons for the decision in accordance with Section 2(1)(1) of the Act and Section 171(2) of the Public Procurement Act.

In other cases, complaints concerning procurement procedures, cf. Section 7(2) of the Act, must be submitted to the Complaints Board for Public Procurement within:

45 calendar days from the day after the contracting authority has published a contract award notice in the Official Journal of the European Union.

30 calendar days from the day after the contracting authority has notified the affected tenderers that a contract based on a framework agreement with reopening of competition or a dynamic purchasing system has been awarded, provided that the notification included a statement of reasons for the decision.

6 months from the day after the contracting authority has entered into a framework agreement, from the date on which the contracting authority has notified the affected candidates and tenderers, cf. Section 2(2) of the Act and Section 171(4) of the Public Procurement Act.

20 calendar days from the day after the contracting authority has communicated its decision, cf. Section 185(2) of the Public Procurement Act.

At the latest concurrently with the submission of the complaint to the Complaints Board for Public Procurement, the complainant must notify the contracting authority in writing that a complaint has been submitted, and whether the complaint has been submitted within the standstill period, cf. Section 6(4) of the Act. In cases where the complaint is not submitted within the standstill period, the complainant must also state whether a request for suspensive effect has been made, cf. Section 12(1) of the Act.

The email address of the Complaints Board for Public Procurement is klfu@naevneneshus.dk.

The Complaints Board’s guide to complaints can be found at:
https://naevneneshus.dk/start-din-klage/klagenaevnet-for-udbud/vejledning/
Secure IT solutions are essential to the business operations of the Danske Spil Group. Danske Spil therefore maintains a high level of security and is certified according to several international standards for information security. In addition, the subsidiaries of Danske Spil A/S are subject to the certification program of the DGA, which includes requirements for periodic penetration testing and vulnerability scanning. 

Danske Spil desires to enter into a Framework Agreement with a certified and professional supplier of IT security services at a high technical level. In cooperation with Danske Spil, the Supplier shall contribute to maintaining a high level of security and preventing IT security-related incidents within the Danske Spil Group. 

The services to be delivered by the Supplier under the Framework Agreement include the following: 

- Annual penetration testing in accordance with the Danish Gambling Authority’s certification programme, Cf. Appendix 1c (SCP.04) 
- Quarterly vulnerability scanning in accordance with the Danish Gambling Authority’s certification programme, Cf. Appendix 1d (SCP.05) 
- Security testing of new products and IT solutions

Winner: Danske Lotteri Spil A/S