Data
How Passage collects, uses, and protects the personal data you share with us across the Site and the stores.
Last updated: 2026-05-26
This Privacy Policy covers personal data collected through gccpassage.com (the “Site”) and through the Passage regional Boutiques.
The store acts as a separate data processor for checkout; the store's privacy notice applies in parallel to its own services.
Contact data: name, email, phone number, and shipping address, provided when you place an order or contact us.
Order data: products purchased, delivery preferences, and gift notes.
Technical data: IP address, browser, device type, and pages visited on the Site, collected via cookies and standard server logs.
To fulfill your order, including shipping, returns, and customer care.
To answer your questions when you contact the press, wholesale, careers, or general hospitality desks.
To send order-related communications (confirmations, tracking, returns).
To send marketing communications only where you have opted in. You can unsubscribe at any time from the footer of any marketing email.
Performance of a contract: to deliver an order you have placed.
Legitimate interest: to operate the brand, secure the Site, and improve our service to you.
Consent: for marketing communications and certain non-essential cookies.
The regional store, for checkout, payment processing, and boutique operations.
Couriers (Aramex, SMSA, DHL, and regional partners), for shipping fulfillment.
Service providers (analytics, email delivery), under contract and confidentiality.
Authorities, only where required by law.
Order data is retained for the period required by tax and commercial law in the relevant jurisdiction (typically five years).
Marketing data is retained until you unsubscribe. Press, wholesale, and careers correspondence is retained for two years after the last interaction.
You may request access to, correction of, or deletion of your personal data. Write to privacy@gccpassage.com from the email address on the account.
Where your data is processed under consent, you may withdraw consent at any time. This does not affect the lawfulness of processing carried out before withdrawal.
Personal data is held on encrypted infrastructure operated by Vercel and our supporting service providers. We use access controls, audit logs, and least-privilege practices on the brand side.
No system is perfectly secure. We notify affected customers without undue delay where a breach is reasonably likely to affect their rights.
Privacy queries: privacy@gccpassage.com.
General hospitality desk: hello@gccpassage.com.
