A business *may* use for its own marketing purposes any information it receives from customers, whether such information is provided explicitly or as information to enable payment, so long as it does not violate any applicable laws in relation to "spam" or other prohibited advertising. This is, in fact, the main way that business traditionally obtained this information and created their own internal mailing lists, in the years before online ordering, which such ordering would require the prospective customer to explicitly fill out an internet form containing information usuable for marketing purposes. Obviously, the business is liable for any ill-effects, criminal usuage, etc. made of personal information which it retains in its files and uses.