An EU Merchant (based in Germany) is asking me to fill up a form with credit card details in it (card number, CVV, expiry date), then print it, sign it, scan it and then send them the scanned copy. If I want to pay by credit card and not by direct bank transfer, this is the only way to purchase product from them.
Merchant name is: Enagic (euenagic.com).
Is this legal under GDPR? Please let me know,