There’s a third party between the payment system (website, point of sales systems, card terminals, etc) and the card’s provider who also has access to the transaction data in the latter example. These payment systems don’t interact with visa/mc/whatever directly.