We use Stripe as the payment processor.
Stripe has been audited by an independent PCI Qualified Security Assessor (QSA) and is certified as a PCI Level 1 Service Provider. This is the most stringent level of certification available in the payments industry.
You can read more about Stripe’s data protection and privacy, here: https://stripe.com/gb/ssa#data-protection-and-privacy.