Hi Deb
Worldpay will not be the most competitive at that turn-over.
Consider
proxy anonymous proxys site server at Protx.com (online processor) - just as simple to implement as Worldpay (easy to integrate callback) and Pre-Authorisation is available with either (very useful to cancel any fraudulent transactions without cost

).
The promotion company will need their own Internet Merchant account from their bank (or any bank - shop around the rates vary a great deal); note an Internet Merchant account is not the same as their off-line merchant account.
Before were considering storing the credit/debit card details on your own secure server you must take into account new legislation and data protection laws which you would then need to comply with. This is as is should be: a legal nightmare (after all who wants their card details on an insecure server). Better to leave it to those that specialise in this area such as Protx, Worldpay, or Secpay, etc. Which means you keep your hands clean of the legal side of development.
You would still need to consider data protection if you are storing customer details and should not export that data outside of the EU. Which is just one reason why you should host such a site in the UK (or in its native country).
I hope your quote gets accepted and you get the work - if so I wish you every success with it
Dave.