While the page itself isn't loaded over HTTP, the order display is an Iframe that's loaded over HTTP, but posts to an HTTPS page.
While the form itself posts to an HTTPS page, the loaded frame itself is HTTP.
This is insecure due to the fact that the content of the iframe has no integrity. The page itself could be modified by a MITM to post the form to a rogue service. If you inspect the form, you can see it's sending the payment to "spreedly", which upon searching is a credit card processor.
However, there is a click handler and submit handler for the forms.
These handlers have the ability to hijack that URL, and change it right before it actually posts. Creating another avenue for your card information to be stolen.
The ordering form itself is hosted on another site, http://onlineorders.wawio.com/menu/535fe1caf61e46ae172330d8 however when I try to put https I get an invalid name error, instead identifying itself as a site called "OpenDining". If you accept the error, it'll show you the page you requested.
Don't order through them. If you want to complain to them, go here http://www.wawio.com/es/contact-us