The customers runs over SSL encoding, payment processing suits PCI-DSS standards, therefore the webpages comes after good GDPR-lined up studies rules