An EU Merchant (based in Germany) is asking me to fill up a form with credit card details in it (card number, CVV, expiry date), then print it, sign it, scan it and then send them the scanned copy. If I want to pay by credit card and not by direct bank transfer, this is the only way to purchase product from them.

Merchant name is: Enagic (euenagic.com).

Is this legal under GDPR? Please let me know,

  • See this question: security.stackexchange.com/questions/190707/… – Mike Scott Sep 18 '18 at 17:50
  • 1
    As I understand it, GDPR is mostly about what info they're collecting and why. Credit card info is pretty important for paying with a credit card. How exactly do you think you'd pay with a credit card without giving them your credit card info? – Kevin Sep 18 '18 at 18:36
  • Regarding the GDPR subquestion, note that GDPR only applies to personal information (like names and card numbers) but probably not e.g. the validation code. The GDPR lists various reasons that allow data to be processed. If personal information is necessary to fulfill a contract (here, payment info to fulfill your debt obligation as part of the sale contract) that is allowed by the Regulation. But just because the privacy aspect might be legally fine does not mean that this payment method is safe. It strikes me as quite unusual. – amon Sep 18 '18 at 18:50
  • Kevin, I want to pay and I understand I need to provide my credit card info to pay. What I am concerned about is they asking this info on paper and send it to them via email. I requested them to provide me an online form or way to make payment online where I do not have to share my credit card details with their employees but they do not have any other way. – Nil_R Sep 18 '18 at 18:52

GDPR is quite irrelevant here. What matters much more is best practices that credit card processor demand from the merchants. Storing the CVV, for example on paper as they ask for, will get their account cancelled if their credit card processor finds out. And if you sent your credit card I assume through email, that's totally unsafe. Any decent hacker can get your number.

Don't do it.

The normal practice is that you enter the credit card number on a website, it is stored encrypted, nobody at the merchant ever sees it, it gets immediately sent to the credit card processor who will process it safely with no chance of it getting out.

| improve this answer | |
  • Note that CVV values can be collected and stored prior to authorization. (In fact, you have to store them for an instant in any case). The violation of PCI and network rules only occurs if they don't promptly destroy their records after the transaction is authorized. – user71659 Sep 19 '18 at 22:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.