I tried buying a bus ticket online from a bus company from Brazil and the payment failed.
However, in the history of payments the failed transaction shows the first 6 and the last 4 digits of my card number:
CARD: 123123******1234 Operator: VISA
I am now wondering if they actually store the full information about my card details (e.g. expire date and CVV code).
Is this okay from a legal point of view? Usually I know companies can store the last 4 digits, but have not seen so far storing the first 6 digits.