Trust centre
Dividend Refund processes withholding tax exemptions and double taxation refunds for financial institutions and their clients. Here we explain how we protect the information you entrust to us, which certifications support it, and how to request our documentation for your vendor assessment.
Reviewed on 2 Oct 2026
ISO 27701Privacy
ISO 27001Security
ISO 22301Business continuity
ISO 14001Environment
ISO 9001Quality
ISO 37001Anti-bribery
UNE 19601Compliance
Security, privacy, continuity, quality and compliance
Platform and backups on AWS Ireland; AI in EU regions
Database and client documents encrypted
In production with clients since 2025
Certifications
The bar on each certificate shows its certification cycle: when it started, how long it is valid for and how much of it has elapsed.
Security, privacy and continuity
ISO/IEC 27701:2019
Privacy management
- Certification body
- Alcumus ISOQAR Limited
- Accreditation
- UKAS (0026)
- Certificate
- 23756-PIM-001
Valid until 7 Mar 2027
7 Mar 20247 Mar 2027Certificate scopeThe information security system supporting the double taxation exemption processing services. SoA v.1 2023.
ISO/IEC 27001:2022
Information security
- Certification body
- Alcumus ISOQAR Limited
- Accreditation
- UKAS (0026)
- Certificate
- 23756-ISMS-001
Valid until 7 Mar 2027
7 Mar 20247 Mar 2027Certificate scopeThe information security system supporting the double taxation exemption processing services. SoA v.1 2023.
ISO 22301:2019
Business continuity
- Certification body
- Alcumus ISOQAR Limited
- Accreditation
- UKAS (0026)
- Certificate
- 23756-BCM-001
Valid until 12 Dec 2026
12 Dec 202312 Dec 2026Recertification planned before expiry.
Certificate scopeDouble taxation exemption processing services.
Other certifications
ISO 14001:2015
Environmental management
- Certification body
- Alcumus ISOQAR Limited
- Accreditation
- UKAS (0026)
- Certificate
- 23756-EMS-001
Valid until 12 Dec 2026
12 Dec 202312 Dec 2026Recertification planned before expiry.
Certificate scopeDouble taxation exemption processing services.
ISO 9001:2015
Quality management
- Certification body
- Alcumus ISOQAR Limited
- Accreditation
- UKAS (0026)
- Certificate
- 23756-QMS-001
Valid until 12 Dec 2026
12 Dec 202312 Dec 2026Recertification planned before expiry.
Certificate scopeDouble taxation exemption processing services.
UNE-ISO 37001:2017
Anti-bribery management
- Certification body
- ADOK Certificación, S.L.
- Certificate
- 554382
Valid until 27 Jun 2027
28 Jun 202427 Jun 2027Certificate scopeDouble taxation exemption processing services. Site: Calle Zurbano, 92, 28003 Madrid.
UNE 19601:2017
Criminal compliance
- Certification body
- ADOK Certificación, S.L.
- Certificate
- 194382
Valid until 27 Jun 2027
28 Jun 202427 Jun 2027Certificate scopeDouble taxation exemption processing services. Site: Calle Zurbano, 92, 28003 Madrid.
Documentation
Our security policy is public. We share the remaining documents once a non-disclosure agreement (NDA) has been signed.
Information security and privacy policy
Approved by Management on 26 February 2026.
Download PDFValid certificates
ISO/IEC 27001, ISO/IEC 27701, ISO 22301, ISO 9001 and ISO 14001.
Under NDAStatement of Applicability
ISO/IEC 27001 and ISO/IEC 27701 controls and their implementation status.
Under NDASecurity policies
Access control, backups, incident management, suppliers, secure development and others.
Under NDAData processing agreement (DPA)
Standard model for clients.
Under NDA
Request documentation
For your vendor assessment, we share our documentation under a non-disclosure agreement (NDA).
- 01Complete the form.
- 02We send you the non-disclosure agreement.
- 03Once it is signed, we give you read access for a limited period.
What we do to protect information, grouped by area. Everything listed here has been verified.
AWS infrastructure
7 controlsThe Refunder platform and our clients’ data are hosted on Amazon Web Services, in the Ireland region (eu-west-1).
Encryption in transit
The client portal accepts only TLS 1.2 or 1.3 and redirects any unencrypted access to HTTPS. The database rejects connections that do not use TLS.
Encrypted database
The production database (PostgreSQL on Amazon RDS) is encrypted at rest, as are its automated backups.
Client documents
They are stored in Amazon S3 encrypted with AWS KMS keys, with public access blocked and versioning enabled so that any earlier version can be recovered.
Database high availability
It runs across two availability zones in Ireland: a synchronous replica takes over automatically if the primary zone fails.
Backups
The database can be restored to any point in the last 35 days. AWS Backup copies the servers and the database every day: daily copies are kept for 35 days, weekly copies for 90 days and monthly copies for one year.
Isolated database
The production database is not reachable from the internet and has deletion protection enabled.
AWS account access
The root account is protected with multi-factor authentication and has no access keys.
Platform and continuity
4 controlsArtificial intelligence in the EU
AI models run on Amazon Bedrock using European Union inference profiles, and content is not used to train models. Text recognition is performed with Amazon Textract in Ireland, with the use of content to improve AWS services disabled.
Privacy by design
We apply privacy by design and by default to platform changes, within our system certified to ISO/IEC 27701.
Controlled changes
The platform evolves following our change management procedure, within the system certified to ISO/IEC 27001.
Certified business continuity
Continuity management system certified to ISO 22301, with impact analysis, scenario-based plans and defined recovery objectives.
Organisation and people
5 controlsIndependent audits
The management system is audited internally every year and reviewed by accredited external auditors during certification audits.
Supplier assessment
Before engaging a supplier with access to information, we review its certifications and sign data processing agreements.
Incident management
Procedures to respond to security incidents and to notify personal data breaches to clients and authorities within the legal deadlines.
Team training
Annual security training and awareness plan for the whole team, including the safe use of AI tools.
Device protection
Corporate devices have managed anti-malware protection, and servers are covered by malware scanning through Amazon GuardDuty.
Platform maturity
Refunder, our claims platform, is at level 7 of the technology readiness level (TRL) scale used by the European Commission. It has been running in production with clients since 2025.
TRL 7, our current level
System demonstration in a real operational environment: Refunder processes real client claims in production.
Next levels
TRL 8 corresponds to a complete and qualified system, and TRL 9 to a system proven in continuous real operation.
Privacy and GDPR
Our privacy management system is certified to ISO/IEC 27701. This is how we apply the GDPR to the claims service.
Our role
When a financial institution engages us
We file claims on behalf of its clients as data processor (Article 28 of the GDPR), under a data processing agreement signed with the institution.
When a private investor engages us
We are the data controller for their data, under the terms of our privacy policy.
What data we process
Only what is necessary to process the claim: identification data (name and national ID or tax ID) and the banking and financial data relating to the dividends and coupons being claimed. We do not process special categories of data for the service.
Where the data is held
Service data is hosted in the European Union: the platform on AWS (Ireland), its AI services in EU AWS regions, and email and files in Google Workspace, with storage in the EU. Data leaves the European Economic Area in two cases: when a claim must be filed with a tax authority outside the EEA, and in the delivery logs of our transactional email provider, which are stored in the US. In both cases, with the safeguards required by the GDPR.
Retention
We keep data only for as long as necessary to provide the service and for the applicable legal periods. It is then securely deleted.
What our data processing agreement includes
- We process data only on the client’s documented instructions.
- All staff with access are bound by a written confidentiality undertaking.
- We engage only authorised sub-processors, bound by the same obligations as us.
- We assist the client in responding to data subjects’ rights.
- We notify security breaches without undue delay.
- We facilitate the audits and inspections the client requires.
- At the end of the service, we return or delete the data, as the client chooses.
How we manage it
- Designated Data Protection Coordinator.
- Up-to-date record of processing activities.
- Documented assessment of the need for impact assessments.
- Privacy by design and by default in platform changes.
For questions about privacy or our data processing agreement, write to us at seguridad@dividendrefund.com. To exercise your rights, see our privacy policy.
DORA
Regulation (EU) 2022/2554 on digital operational resilience (DORA) does not apply to us: we are neither a financial entity nor an ICT service provider. Our service is the processing of withholding tax exemptions and double taxation refunds.
If your institution needs additional information for its vendor assessment, request it through the documentation form or write to us at seguridad@dividendrefund.com.
Sub-processors
The providers that process our clients’ data to deliver the service. All of them host data in the European Union, except email delivery logs, which are stored in the US under standard contractual clauses and the EU-US Data Privacy Framework.
| Provider | What we use it for | Where the data is held |
|---|---|---|
| Amazon Web ServicesAmazon Web Services EMEA SARL | Refunder platform infrastructure: servers, database, documents, encryption and AI services | European Union (Ireland; AI in EU AWS regions) |
| Email, files and collaboration (Google Workspace) | European Union (Google Workspace data region) | |
| Partner firmsProfessional firms in the EU | Filing with foreign tax authorities, only when the authority requires it | European Union |
| ResendPlus Five Five, Inc. | Sending the platform’s emails (notices and access links) | Sent from the EU (Ireland); delivery logs in the US |
Report a vulnerability
If you believe you have found a security issue in our systems, write to us at seguridad@dividendrefund.com. We will acknowledge receipt within 5 working days.
- Include a description of the issue and the steps to reproduce it.
- Do not access, modify or delete data that is not yours beyond what is strictly necessary to demonstrate the issue.
- Do not carry out denial-of-service, social engineering or physical testing.
- Give us a reasonable period to fix the issue before making it public.