Yes, but …
You may continue to store data from potential customers/prospects. But you must document this processing in your processing directory (and, if applicable, in your privacy statement).
However, under Article 14, you must inform data subjects within 30 days that you are processing the data and where you got it. This also applies to data you have from public sources, but only if the processing is not yet known to the data subject.
The most effective way to comply with these information requirements is to contact new contacts within 30 days, including sending an individual email. The email can then refer to the privacy policy and the source of the data.
In addition, when contacting “not yet customers”, you must follow the rules of the Telecommunications Act.
It must also be easy for the data subject to object to this processing.