You do not have to request permission to e-mail customers; however, you must provide them with an option to opt-out of receiving your electronic communications, in addition to the other requirements to remain in compliance with the CAN-SPAM Act. Here's an excellent resource for your reference: https://www.ftc.gov/tips-advice/business-center/guidance/can-spam-act-compliance-guide-business

The first question is to define what the customer flow was, and the nature of your customer relationship. Did the prior transaction form include any mention of future email marketing at the point of purchase? Did they receive any sort of welcome email after purchase informing them about future marketing emails? Was the type of purchase something that would seem like future marketing emails would be expected? While express consent is always the best practice, in some cases an informed or passive consent can be effective if it works alongside other verification and relevancy efforts.

To invite them to the mailing list, yes. Typically, providers let you do this for customers who have purchased in the last year, asking them to join the list. Simply placing an order is not permission, but a one-time mailing after they've ordered appears to be appropriate.