I am not a lawyer, but I'm pretty sure that in Canada, this would be in violation of the federal "Personal Information Protection and Electronic Documents Act", as well as many provincial laws.
https://www.priv.gc.ca/leg_c/leg_c_p_e.asp
"Use or disclose personal information only for the purpose for which it was collected, unless the individual consents, or the use or disclosure is authorized by the Act."
"Keep personal information only as long as necessary to satisfy the purposes."
If the client uses one of those "points" cards, yes, they are tracked, but otherwise they shouldn't. When a retailer asks for your postcode, it is mostly just for market study to identify where their clients live, but that's it (although I rarely get asked). You can also just answer "no thanks" to this question.
