Taking Payments Online: The Rules Behind the Checkout

Four separate obligations

They get treated as one thing and they come from four different places.

Card data handling, which is a contractual requirement from the card networks rather than legislation.

How the price is displayed, which is advertising law.

Refunds and cancellation, which is provincial consumer protection.

What you keep afterwards, which is privacy law.

Knowing which is which matters, because the answer to a question about surcharges is not in the same place as the answer to a question about storing card numbers.

Card data, and the easy way out

The payment card industry sets security standards for anybody who stores, processes, or transmits card data. They are contractual, enforced through your acquirer and your merchant agreement, and they apply regardless of size.

The scope depends entirely on how the payment is taken. A checkout where the card number never touches your server, because the fields belong to the payment provider or the customer is redirected to their page, keeps almost all of it out of your hands.

A checkout that collects the number on your own page and passes it along puts you squarely in scope, with obligations most small businesses are not equipped to meet.

Which is the practical rule: use a hosted payment page or the provider's embedded fields, and do not build your own card form. That single decision removes most of the exposure.

The rest is simple and absolute. Do not store full card numbers anywhere, in any form. Not in a database, not in a spreadsheet, not in an email somebody sent you, not on a paper order form in a drawer.

Displaying the price

Advertising rules address prices that cannot actually be paid because obligatory fixed fees are added later.

Which means a mandatory charge belongs in the advertised figure. A service fee everybody pays, a booking fee, a disposal fee, or a compulsory handling charge are not optional and should not appear only at the final step.

Genuinely optional extras are different, as are taxes and shipping where the rules treat them separately, but the safe position is that anything the customer cannot avoid should be visible before they commit.

The commercial argument points the same way. Costs appearing late are the largest single cause of abandoned checkouts, so early disclosure is both the compliant choice and the one that sells more.

Surcharging

Adding a fee for paying by credit card is permitted in Canada within limits set by the card networks as part of a settlement, and the conditions are specific.

They cover how much may be added, the requirement to notify your acquirer and the networks in advance, and the disclosure the customer must see before and at the point of payment.

Quebec is treated differently, and a business operating there should confirm its own position rather than assume the general rules apply.

Because the details sit in network rules that change, the durable approach is to check with your payment provider before adding a surcharge rather than following what another business does.

Refunds and cancellation

There is no general legal right to a refund for a change of mind in Canada. What exists is a patchwork.

Provincial consumer protection legislation gives cancellation rights for certain contract types, including some distance and remote agreements, with prescribed periods and required disclosures.

Beyond that, your own published policy is what governs, and once published it is a representation you have to honour.

Which makes the policy worth writing deliberately: what is refundable, in what period, in what condition, who pays return shipping, what is excluded, and how long a refund takes to appear. A vague policy generates disputes; a clear one prevents them.

Digital goods and services deserve their own line, since customers assume a refund is available and the position differs once something has been delivered or accessed.

What the receipt has to say

Frequently overlooked and simple to get right.

Your legal business name, contact details, an itemised breakdown, taxes shown separately with your registration number where you are registered, the date, and a transaction reference.

The descriptor that appears on the customer's statement matters too. A descriptor that does not resemble your business name produces chargebacks from customers who genuinely do not recognise it, which costs money and counts against you.

What you keep afterwards

Transaction records have to be retained for tax purposes, and personal information has to not be retained beyond its purpose. Those pull in opposite directions and both apply.

The workable split: keep the transaction record, which is a financial document, for the required period. Do not keep the payment instrument details, which you should never have held.

Where your provider stores a card for repeat billing, it is stored with them under their obligations rather than yours, which is another argument for that arrangement.

The short version

1. Never build your own card form. Use the provider's.
2. Never store a card number, anywhere, in any medium.
3. Put every mandatory charge in the advertised price.
4. Check with your provider before surcharging.
5. Publish a refund policy you can actually honour.
6. Make the statement descriptor recognisable.

This is general information rather than legal advice, the network rules and provincial requirements change, and your payment provider and a lawyer are the right sources for your own position. The practical side of choosing what to accept is covered in which payment methods to offer.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.