Am I actually allowed to collect the company name or is there any privacy concern around doing that?
You are technically allowed to collect any company names or identifier that identify your users as long as you notify your end-users that you are doing so. Notification in this case means adding text in your EULA to say what type of data you're collecting and also it's also recommended by GDPR to get consent from the user so you implement an opt-in opt-out mechanism to get consent from the user to allow you to collect this data, but yes overall you are allowed to do so.
