For every action, there is an equal and opposite reaction. If a customer can ask anything then a company asked can ask anything in return and if you send those out "en masse" you just become a subject to GDPR yourself.