If you are collecting the data for any other business purpose that you would already collect, then you are able to market to your customers if they approve of the GDPR request. If this is not data that you would normally collect for another business purpose, and are just doing it for the track and trace then you can’t.
That’s why we recommend that you have all your clients pre-register or check-in using a RapidReg form for any activity, appointment or class they might be attending. This will allow you to gather that information for any other business purpose 