The GDPR does not put specific limits on what information can be saved, or what it must be associated with. But an address can fairly easily be related to a particular natural person, and so it is PI, and probably PII. Therefor, under article 6, there must be a lawful basis for saving it, and there must be a purpose (or purposes) for saving and processing it. The basis might be consent, or one of the other permitted lawful bases. It would be improper to use it beyond the original purpose without properly notifying the Data Subject, and in many cases obtaining consent to the revised purpose.
A one-way hash created with a good hashing function, that cannot be associated back to the address (or name or whatever PI) is not normally PI, and the GDPR does not put limits on its processing, unless there is a way to associate it with a natural person, or the data is already associated (such as by being part of the same DB record)
(PI is "Personally Information, PII is "Personally Identifiable In formation.)