So, if you stupidly sign up to a site using a credit card and then come to regret it and worry that said site is vulnerable to hacking what data can they legally hold without needing to be PCI compliant.
Things I know are:
- They use a PCI compliant payment gateway.
- There own server is in a secure facility.
- They claim to store only the final 4 digits of the credit card and only so that customers can quickly put more money on their account quickly without the need for entering full cc details every time.
Do you think this is all they hold? Would they also hold name and address to be able to carry out that transaction?
Sorry if I haven't been clear. This is what I received from the company when I asked if I could delete my personal data from their database:
Firstly, we are not allowed to store functional credit card data, so we don't. We do store the last four digits as on their own they are meaningless and help us authenticate you when using the quick re-purchase method. Secondly, our upstream payment provider is authorised to store your card data by VISA/MasterCard. As such they are audited annually and have to jump through all the hoops and conformity required by the PCI DSS standard. Thirdly, it is a requirement of any business to keep records of who they're dealing with. Your personal data is being stored so high up the chain that it must be kept. Other companies who claim to delete your data are most likely the first link in the chain or at an entry level. They delete it and probably shouldn't even be storing it, but their upstream provider is required to keep it.
They keep referring to this email when I ask for further clarification as to whether they themselves or only the payment gateway hold my name and address against that credit card and the account I set up with them. I have never given my address for delivery only for payments as it was a gambling website.