Yes, if you collect buyer contacts — and without them you cannot send a receipt or arrange delivery. The site needs a personal data policy and explicit consent in the order form, rather than a pre-ticked checkbox.
What the site must have
- A personal data policy reachable from any page.
- A separate consent checkbox in the form, not ticked by default.
- A statement of who processes the data and for what purpose.
What to keep in mind
- You do not collect card data: the provider accepts it on their side.
- Do not request more than the order and the receipt need — that is extra liability.
- The policy and terms are checked when payments are connected.
What else is reviewed before onboarding is covered in why a site fails the review.
