This depends on how the data is being transferred.
Here's the thing: unless the attacker forces the client to use a weak cipher-suite SSL is supposedly unbreakable for something like a bazillion years. So as long as there are not unencrypted connections in this chain you're all set, regardless of how often your data is encrypted.
So that's the upside. Here's the downside: if, as you say, "their site/service doesn't have a good security layer for data being transmitted," then no, your data is not truly secure. If they don't support a strong encryption you can pretty much expect to be screwed (if someone decides to screw you, that is). Of course, it's probably in the eCommerce company's contracts to be responsible for the security of transactions, etc., so you're legally pretty safe (Although I doubt your clients will be particularly happy with you).
Like I said though, it depends on how the setup works. If this is a simple
<iframe> or something similar, they're actually connecting directly to the eCommerce site, so you can't guarantee any kind of security. On the other hand you have a degree of stability if the information is routed through you, because there is an excellent defense against sniffing attacks: using wired connections. Unless someone physically penetrates your company it will be impossible for them to sniff your connection. So yeah, it doesn't matter how you transmit the information to the eCommerce company because you can be rather confident that an attacker never sees it (he can't connect to your network).
But here's the bottom line: if any sender or receiver of data in a chain of communications does not support strong encryption, the privacy of the information sent along the aforementioned chain cannot be guaranteed.