It is not uncommon to log the fact that an authentication attempt has failed and which user it was for. This can prove very useful in forensic troubleshooting. It is extremely uncommon and irresponsible from a security perspective to log what the password was that was rejected. This information serve no useful purpose and can be used against you.
EDIT
You should hopefully be able to expect that a reputable and well-organized company would not be selling your password information since this would really be bad for them if it was found out. But in the interest of your own security, you should always be prepared for information you give out to be used against you because it is always a possibility. This goes double for any organization whose reputation you can't reliably establish.