Your card information goes wherever the form you filled out submits it to. You could connect to a perfectly encrypted HTTPS page with valid SSL, but if the form submits by sending an e-mail to mybankhacker.com, then that is where it will go. Most of the time, it is submitted back to the server itself that you are connecting to and they then relay it to their merchant service provider to charge your card, only legal agreements prevent them from keeping a copy.
In other situations, they may not want the legal burdens that accepting credit cards requires, so they may submit it to a merchant service provider, such as Authorize.Net, which handles the processing. In this case, the form they display would actually be provided by Authorize.Net's server and would submit to Authorize.net directly and they would only get a confirmation code after you complete the transaction. (Though Authorize.Net could still keep a copy if they wanted.)
Another situation is that where they actually fully redirect you to the merchant service provider or payment gateway. Sites that use Paypal, Google Pay or Amazon Payments are examples of this. Authorize.net also provides an option like this. In these cases, you get redirected to the merchant service provider's website, fill out your details on that provider's site and it then redirects you back. Again, only the merchant service provider then gets your details and the vendor/site you were originally visiting only gets confirmation of payment.
PCI-DSS is the security document that governs what rules people are supposed to follow for dealing with your credit card information (formally known as payment card information or PCI) however outside of an audit by the merchant service provider or merchant bank that handles their credit card transactions, there is no guarantee that they are following the requirements.
