Customers must be notified when you are collecting their data (do that through a Privacy Policy agreement hosted and linked from your online store pages)

Personal data should only be collected for specific (and lawful) purposes

The data collected should be adequate for the purpose

Personal data should be accurate and kept up to date

Personal data should not be kept for longer than necessary

Appropriate security measures should be put in place to protect customer data