Are you under the assumption that the GDPR requires consent for all processing of personal data? Because it doesn't. There are six legal bases for processing

Are you under the assumption that the GDPR requires consent for all processing of personal data? Because it doesn't. There are six legal bases for processing personal data in in Article 6 of the GDPR. Consent is the first one, but the second one listed (paragraph (b)) is that the "processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract". That covers your payment case.