(Direct quotes from their privacy policy below)

"Consistent with the permissions you give us to collect the information, we may use the information we collect, including your personal information:

1. to provide, personalise, and improve your experience with the Service and products, services, and advertising (including for third party products and services) made available on or outside the Service (including on other sites that you visit), for example by providing customised, personalised, or localised content, recommendations, features, and advertising on or outside of the Service;"

....

And here are some of the parts about data collection:

"We may also collect other information available on or through your Third Party Application account, including, for example, your name, profile picture, country, hometown, email address, date of birth, gender, friends’ names and profile pictures, and networks.

You may also choose to voluntarily add other information to your profile, such as your mobile phone number and mobile service provider.

...

"When you use or interact with the Service, we may use a variety of technologies that collect information about how the Service is accessed and used. This information may include:

information about your type of subscription and your interactions with the Service, such as interactions with songs, playlists, other audiovisual content, other Spotify users, Third Party Applications, and advertising, products, and services which are offered, linked to, or made available on or through the Service;

The details of the queries you make and the date and time of your request; User Content (as defined in the Terms and Conditions of Use) you post to the Service including messages you send and/or receive via the Service; technical data, which may include URL information, cookie data, your IP address, the types of devices you are using to access or connect to the Spotify Service, unique device ID, device attributes, network connection type (e.g., WiFi, 3G, LTE) and provider, network and device performance, browser type, language, information enabling digital rights management, operating system, and Spotify application version. motion-generated or orientation-generated mobile sensor data (e.g., accelerometer or gyroscope).

You may integrate your Spotify account with Third Party Applications. If you do, we may receive similar information related to your interactions with the Service on the Third Party Application, as well as information about your publicly available activity on the Third Party Application. This includes, for example, your “Like”s and posts on Facebook. We may use cookies and other technologies to collect this information; you can learn more about such use in the section Information about cookies and other technologies of this Privacy Policy."