A company may retain information to comply with legal obligations, exercise legal claims or rights, or defend legal claims. Maintaining the ability to charge and refund on a credit card is within the scope of their right to retain information. I would not assume that "removing payment method" deletes the data from their database, it means that you ...
I will assume that your business is presently compliant with the law - you have the right licences, insurances, report and pay the correct taxes etc.
Depending on the arrangement between you and the people you pay they might be:
You need to work out which because different laws give different rights and ...