Credit cards and PCI compliance

With PCI Booking, a service provider assessed as compliant with the PCI DSS standard at level 1, the most demanding, in the European Union. The privacy laws that apply there are among the strictest and inspired Canadian and Quebec laws.

A card is always entered in a secure form provided by PCI Booking, whether your client enters it in their client portal or a user of your organisation enters it in the contact’s Info tab, through an information block or a quick entry. meo never holds the card number or its security code (CVC): they do not pass through its servers. So that you can recognise the card, meo keeps only its type, its last four digits, the expiry date printed on the card and the cardholder’s name.

Entrusting the cards to PCI Booking greatly reduces what your organisation has to cover, without releasing it from its own obligations: see What do you need to do on your side?

Authorised users in your organisation display it in a secure area served by PCI Booking: its number does not pass through meo.

Every display is counted, and meo keeps a record of who displayed the card and when. A card can be displayed at most 50 times. After that, delete it and ask for it again if needed.

As long as you choose, 12 months at most. You set this period for each card, when you add the card question to a request or when you enter the card yourself. meo suggests 30 days.

On the date shown under the card (Kept until), meo deletes the card automatically, security code included. You can also delete it sooner. See Ask your client for a credit card.

Adopt two habits, because the PCI standard asks that a card be kept only as long as needed, then deleted:

• Never keep a card anywhere but in meo: no email, paper, file or note. In meo, enter it only in a credit card field.
• Delete the card as soon as the booking or the file is invoiced, without waiting for its deletion date.

Not if it already says that you collect your clients’ information through meo and keep it only as long as needed to process it. To check yours, open Privacy, then Privacy officer & privacy policy: meo analyses your policy and shows which common privacy topics it covers.

This is provided for information and does not replace legal advice.

Use the paragraph below, which describes meo’s part, in the questionnaire from your supplier or your financial institution.

Our clients' credit cards are collected through our meo portal and kept by PCI Booking, a provider compliant with the PCI DSS standard. We keep no copy of them. They are deleted no later than 12 months after they are received, or as soon as the file is invoiced.

The rest of the questionnaire covers your organisation’s own practices. Adapt the paragraph if you also receive cards another way, for example by phone.