That depends entirely on the terms of the engagement. If this service (or others) had agreeable data retention/use terms, then the pentester and the client could include that as an acceptable use of their data.