I'd suggest that in your example, the purchaser isn't having all details about himself being recorded and monetized by the supplier, just simply for contacting

I'd suggest that in your example, the purchaser isn't having all details about himself being recorded and monetized by the supplier, just simply for contacting the supplier: no agreements of trade have been entered into, but even if they had, there's little cause for selling the information to other 3rd parties. Surely the purchaser has some rights to sovereignity?