Skip to content
GatewayChanger

Consent and shop terms

A customer buying from Shop A may end up paying Shop B. That is allowed, it is common in company groups — and it is only acceptable if the customer is told, agrees, and can prove later what they agreed to. This page is what your checkout and your legal pages have to do about it.

What the customer sees

The route response contains the sentence to display, with the real legal names and the real amount already substituted:

I agree that my payment of €24.99 is processed by Shop B Ltd on behalf of Shop A GmbH. See Terms.

The plugin renders it as a required checkbox next to the card form. The order cannot be placed without it. You may translate it and adjust its wording to fit your tone, but three elements must survive: who charges, on whose behalf, and for how much.

Why a checkbox and not a footnote

Three separate reasons, and any one of them is enough:

  1. Card schemes. The cardholder must be able to recognise the name on their statement. An unrecognised descriptor is the most common cause of "I don't know this charge" chargebacks.
  2. Consumer law. In most jurisdictions, who you contract with and who takes your money are material facts.
  3. Disputes. When a customer says they never agreed to pay another company, you want a stored hash and a timestamp rather than an argument.

What gets stored

When the box is ticked, the evidence is written to the seller's order and, after the charge, to the charger's mirror order:

{
  "text": "I agree that my payment of €24.99 is processed by Shop B Ltd on behalf of Shop A GmbH.",
  "version": "2026-09-16",
  "text_hash": "sha256:7b41c0…",
  "accepted_at": "2026-09-16T10:04:11Z",
  "ip": "203.0.113.24",
  "user_agent": "Mozilla/5.0 …"
}

The hash is over the exact text shown, so a later change to the template cannot rewrite history. Both shops keep a copy, which means either side can answer a question without calling the other.

What your terms of service must say

Your seller shop's terms need a clause stating that payment may be processed by an affiliated company on the seller's behalf, naming the entities or describing them precisely enough to be identified. A workable skeleton:

Payment processing. Payments for orders placed in this store may be processed by an affiliated company acting on our behalf. The company that processes your payment is named at checkout before you pay and appears on your card statement. Your contract for the goods is with us; refunds are arranged through us and are paid by the company that took the payment.

Link that page from the consent line — the plugin has a setting for exactly this. Say the same thing in your privacy notice, because your customer's payment data reaches a second company: name the category of recipient and why.

What the charger shop must do

  • Make sure the descriptor on the statement is its own name, and that it is recognisable.
  • Handle refunds and disputes for what it charged, and be able to find the seller's order number from its mirror order — the plugin puts it on the order.
  • Tell its acquirer or PSP that it processes payments for the named affiliated entities. This is not optional; see compliance.

The consent template is versioned. When you change it, new decisions carry the new version, and existing evidence keeps pointing at the text that was actually shown. Do not edit the sentence to remove the charger's name or the amount: the plugin will show it, the evidence will record it, and a support agent reading a dispute six months later will need it.