Payment Card Processing and Security Policy



This policy mandates compliance with the Payment Card Industry Data Security Standards for GJ Tonewood, LLC  in order to securely protect and maintain cardholder data during payment card processing, storage, or transmission.

Effective Date:


Responsible Party:

Ownership of GJT


[email protected]

Applies To:

All Staff


Credit Card, Data Security Standards (DSS), Security, Payment Card Industry (PCI), Compliance

GJ Tonewood, LLC


Edited: 25th June, 2021


Cardholder Data   Any personally identifiable data associated with the cardholder, to include account number, expiration date, name, address, social security number, card service verification code, or any other data stored on the magnetic stripe of the payment card.

Merchants   Authorized acceptors of payment cards for the purchase of goods, services, or information.

Network members   Acceptors of payment cards for the purchase of goods, services, or information that have been granted direct authorization to perform payment card transactions by the major credit card companies. Generally, these include banking and financial institutions.

Payment Application Data Security Standards (PA-DSS)   The Payment Card Industry Security Standards Council program established to help software vendors and others develop secure payment applications that do not store prohibited data, such as full magnetic stripe, CVV2 or PIN data, and to ensure their payment applications support compliance with the PCI DSS. Payment applications that are sold, distributed or licensed to third parties are subject to the PA-DSS requirements.

Payment Card Industry Data Security Standards (PCI DSS)   A multifaceted set of comprehensive requirements and security standards developed to enhance payment account data security, security management, policies, procedures, network architecture, software design and other critical protective measures. This comprehensive standard is intended to help organizations proactively protect customer account data.

PCI Entity   Any GJT department, office, section, or affiliated association or group that has been approved to accept, process, transmit, or store credit card transactional or cardholder data as a member, merchant, or service provider operating on behalf of GJT, or in use of the GJT brand name.

Senior Management   Persons in the positions of Ownership or Managers, or persons specifically designated by Ownership or a Manager, that make executive decisions and are authorized to accept risks for the administrative unit in the area of information security.

Service Providers   Any business entity that is not a payment card brand network member or a merchant directly involved in the processing, storage, transmission, and switching of transaction data or cardholder information, or both. This includes companies that provide services to merchants, service providers, or members that control or could impact the security of cardholder data. Examples include managed service providers that provide managed firewalls, intrusion detection systems and other services as well as hosting providers and other entities. Entities such as telecommunications companies that only provide communication links without access to the application layer of the communication link are excluded.

GJT, defined as: GJ Tonewood LLC,

Verification Code   The three or four-digit value printed on the front or back of a payment card; Card Validation Code CVC2 (Mastercard), Card Verification Value CVV2 (VISA), Card Member ID (Discover), or the Card Identification Number CID (American Express).


The Payment Card Industry (PCI) Data Security Standards (DSS) are a mandated set of security standards created by the major credit card companies for the purpose of offering merchants and service providers a complete, unified approach to safeguarding cardholder data for all payment card brands.  The PCI DSS apply to all payment card network members, merchants, and service providers that process, store, or transmit cardholder data, as well as to all methods of credit card processing, whether manual or computerized.


This policy mandates compliance with PCI DSS requirements for processing, storing, transmitting, or handling payment card information. GJT is subject to examination of security measures employed to ensure cardholder data are securely maintained. As such, GJT is committed to adhering to the PCI DSS in order to ensure the protection of cardholder data, limit its liability, and maintain the ability to provide payment card transaction services.

Policy Statement

All GJT payment card processing activities and related technologies must comply with this policy and the PCI DSS in its entirety. Compliance with card processing activities must be maintained as described herein and in accordance with the policies listed in the Related Policies/Documents section of this policy. No activity may be conducted nor any technology employed that might obstruct compliance with any portion of this policy or the PCI DSS.

Payment Providers


Security standards

Collected information


Additional information

Network security and technology

Mobile devices and secure payments

Follow us on Facebook