The law is very clear (IANAL but I was responsible once for compliance with this law)

If I collect your private information for a purpose, I may only use it for that purpose. I may not sell it

So if I have your transaction details I may use them to complete the transaction, no other purpose