Privacy and cookies

In case of discrepancy, the French version prevails.

The controller is ASPHERE SAS, SIREN 907 876 957, which runs the Ouillage shop (registered office address in the legal notice). No data is sold or used for advertising.

Orders

Data	Name, billing and delivery addresses, e-mail, phone, wines ordered and amounts; your date of birth, your calculated age, the declaration of majority and its timestamp; the page the order starts from, the page seen just before, the site that brought you, the first page of your visit and, if they were in the address, the campaign parameters (utm, gclid). Bank card data is entered with our payment provider and never reaches us.
Why	Performing the sale (payment, invoice, delivery, customer service); proving the age check required for alcohol sales; knowing which pages bring orders.
Legal basis	Performance of the contract (article 6.1.b GDPR); legal obligations of invoicing, accounting and the ban on selling to minors (article 6.1.c); legitimate interest for measuring where orders come from (article 6.1.f).
Retention	Ten years from the order (retention of accounting documents and of contracts of €120 or more), date of birth and declaration of majority included, as proof of the age check.
Recipients	ASPHERE; Stripe Payments Europe Ltd (Ireland), payment and invoicing provider, whose parent company Stripe, Inc. is in the United States; the service that receives the forms of ASPHERE’s sites, hosted by Salesforce (Heroku) on Amazon Web Services in Ireland, which passes us the order notice; Google, for ASPHERE’s mailbox; the carrier in charge of delivery (name, address, phone).

Transfers outside the European Union: Stripe, Salesforce and Google are American companies; the transfers rely on the EU–US data protection framework or on the European Commission’s standard contractual clauses.

Contact form

Data	First name, last name, e-mail, phone and company (optional), subject and message. Each submission also records the page it starts from, the page seen just before, the site that brought you, the first page of your visit and any campaign parameters.
Why	Answering your request; knowing which pages bring requests.
Legal basis	Pre-contractual measures taken at your request and your consent ticked in the form (articles 6.1.b and 6.1.a GDPR). Sorting automatic submissions relies on our legitimate interest (article 6.1.f).
Retention	Three years from submission, then automatic deletion. You can ask for deletion before then.
Recipients	ASPHERE; Salesforce (Heroku), on Amazon Web Services in Ireland, for the service that receives the forms; Google, for ASPHERE’s mailbox; OpenAI and Cloudflare: your message, the originating page, your name and the domain of your e-mail address are analysed by an artificial intelligence model to tell customer requests from commercial solicitations. This sorting makes no decision about you.

You receive an acknowledgement by e-mail. Submissions bearing a robot’s signature are discarded automatically.

The “Notify me on arrival” requests (your e-mail and the chosen wine) and the answers to the welcome-box questionnaire follow the same rules; an arrival alert is used only to write to you once, when the wine arrives.

Prospecting of professionals

Data	Company name, professional e-mail address, town, website and a piece of public information about its activity, taken from the company’s website or a public professional directory. No data is bought.
Why	Asking professionals in short-term rentals, by e-mail, for their opinion on a project related to their activity (welcome boxes), through a short questionnaire: a first message and, at most, one reminder.
Legal basis	ASPHERE’s legitimate interest in making its offer known to professionals whose activity it relates to (article 6.1.f GDPR; article L. 34-5 of the French Postal and Electronic Communications Code).
Retention	Three years from the last contact. An address that asks not to be contacted is kept in an opt-out list, solely so as not to write to it again.
Recipients	ASPHERE; OVHcloud (France) for the sending and receiving mailbox; Anthropic (United States): the replies received are read by an artificial intelligence model that proposes a short, factual answer, with no decision about you (transfer covered by the European Commission’s standard contractual clauses).

Each message states where the address comes from and contains an unsubscribe link (stop receiving our messages); replying “STOP” is also enough.

Audience measurement (only with your consent)

Data	Pages viewed, length of visit, referring site, clicks on our buttons and on outgoing links, device and browser type, approximate location (country, town) deduced from the IP address. The tool (OpenPanel) sets no cookie; no session recording, no advertising.
Why	Knowing which pages are read and which bring orders, in order to improve the site.
Legal basis	Your consent, requested by the banner shown when you arrive. Declining is as easy as accepting; with no answer, nothing is loaded. Your choice is kept for six months, then asked again.
Retention	Twenty-five months at most.
Recipients	The tool is hosted by ASPHERE on its own servers, at Scaleway, in France. The data is not passed to any advertising network.

With measurement accepted, reading a blog article also increments a read counter for that article, with no data about you.

Change your mind

What stays in your browser

This information is necessary for the service you request; it is not sent to us and therefore does not require consent:

your cart (local storage), until you empty it or place an order;
your answer to the question “Are you 18 or older?” (local storage);
your choice on audience measurement (local storage, six months);
your choice of language (preference cookie, one year), set when you change language with the menu; it only remembers that choice and is not used to redirect you;
where your visit came from and the previous page (session storage, erased when the tab is closed), sent only with a form or an order.

The fonts are served by the site itself: your browser does not contact Google Fonts.

Hosting

The site is hosted by Vercel Inc. (United States), which keeps technical connection logs (IP address, page requested, date) for a limited time for security. Transfers rely on the EU–US data protection framework or standard contractual clauses.

Your rights

You can ask for access to your data, its rectification, erasure, restriction of processing, portability, and object to processing based on our legitimate interest. Write to us through the contact form or by post to the registered office (address in the legal notice). Data that the law requires us to keep (invoices) cannot be erased before the legal deadline. You can also lodge a complaint with the CNIL, the French data protection authority (cnil.fr).

Updated: 4 November 2026