I just did a similar thing (custom mailform). You will have to use trackers. This thread ([solved] How to use "Contact us" feature? Activated - and now?) gives you a lot of hints and links you'll need to understand how it works. There are many possibilities with the field types, I'm sure you'll find what you need. However, I don't know how to solve the PCI DSS problem - the rest should be doable I guess.