The Ember Community (also known as “The Ember Map”, the “Platform”) is an interactive website where fans of Within Temptation (the “Band”) can share a personal story and see it appear as a point of light (an “ember”) on a globe. The Platform is operated by Within Temptation Entertainment BV, residing at Verrijn Stuartweg 30, (1112 AX Diemen), The Netherlands (“we”, “us”, “our”).

We are the controller of your personal data under the EU General Data Protection Regulation (GDPR) and, where applicable, the UK GDPR. You can reach us at office@within-temptation.com.

This policy explains what personal data we collect when you visit the Platform or submit a story, why we do so, who sees it, and what rights you have. Please read it before you submit a story.

• You share two things: what burned and what still glows, and optionally a song that helped you.
• You choose whether your story is shown under your name or anonymously.
• We do use automated decision-making by using Haiku (an AI-model from Anthropic) to check submitted stories according our Terms of use. We do not use AI to rank, select or rewrite stories. We do not sell your personal data. We do not allow visitors to comment on stories.
• Your story may contain information about your health, including mental health. This is sensitive data. We only process it with your explicit consent, which you give separately when you submit.
• We only show an approximate location on the globe, never your exact address.
• You can withdraw your consent and ask us to delete your story at any time.
• You must be at least 16 years old to submit a story.

3.1 Data you give us when submitting a story
 

Data	Required?	Purpose
Story text (“what burned” and “what still glows”)	Yes	To publish your story and show it on the 3D-object
Song selection	Optional	To display the song you chose
Display name	Yes	To display your name next to your story
Email address	Yes	To publish your submission you need to confirm your email. We may need to contact you about your story (e.g. moderation questions) and handle withdrawal requests. Never published.
Location (see section 6)	Yes	To display your location next to your story
Confirmation that you are 16 or older	Yes	Age check
Social Link	Optional	To display a link to your sociamedia-profile next to your story

3.2 Data we collect automatically

Technical data: IP address, browser type, device type, language, time of visit, pages viewed. We use this to keep the Platform secure, prevent abuse and spam, and understand how the Platform is used.

Kudos: when you give a kudos to a story, we record that a kudos was given. To prevent repeated kudos we may use a cookie. Kudos are not linked to your identity and the author is not told who gave them.

Cookies: see section 12.


3.3 Data created by us

Moderation notes (for example, the date a story was approved or rejected and the reason), and records of requests you make to us.


3.4 What we do not do

We do use automated decision-making by using Haiku (an AI-model from Anthropic) to check submitted stories according our Terms of use. We do not use AI to rank, select or rewrite stories. We do not sell your personal data. We do not allow visitors to comment on stories.

Purpose	Legal basis (GDPR)
Processing and publishing your story, including any health-related information it contains	Explicit consent (Art. 6(1)(a) and Art. 9(2)(a))
Showing your name next to your story (if you chose to share under your name)	Consent (Art. 6(1)(a))
Using your story in the Band’s campaign, such as social media, press and Band content (see section 5)	Automatic consent (Art. 6(1)(a), and Art. 9(2)(a) where health information is included)
Email verification and communication about your submission	Performance of the service you requested / our legitimate interest in operating the Platform (Art. 6(1)(b) and (f))
Moderation, security, fraud and abuse prevention	Legitimate interest (Art. 6(1)(f))
Aggregated statistics on submissions (e.g. number of stories per country)	Legitimate interest (Art. 6(1)(f)); statistics contain no direct identifiers
Keeping records of consent and of requests you make; legal claims	Legal obligation and legitimate interest (Art. 6(1)(c) and (f))

4.1 Explicit consent for sensitive information

Stories may reveal data about your health, mental health, or other sensitive topics such as beliefs, sexual orientation, or ethnic origin. This is “special category data” under Article 9 GDPR. You decide what you share. We do not ask for such information, but we recognise your story may contain it.

Before you can submit, you will be asked to accept our Terms of use confirming that you understand your story may contain sensitive information, that it will be made public on the internet if approved, and that you explicitly consent to this. If you do not consent, you cannot submit a story.

This consent is freely given, specific and informed. You can withdraw it at any time (see section 9). Withdrawal does not affect the lawfulness of processing before withdrawal.


4.2 What we do and do not publish

Because stories are public, we apply additional care:

• We do not publish contact details, exact addresses, full names of third parties, or details that make other people identifiable (for example, a named family member, partner, employer or doctor).
• We do not publish descriptions of methods of self-harm or suicide, or content that could encourage them.
• We may reject a story that contains the above, or contact you to ask whether you want to change it. We do not change the meaning of your story. Where we remove a small identifying detail with your agreement, we will tell you.
• Reviewers may be exposed to difficult content. They are bound by confidentiality and only see what is needed to review.

5.1 On the Platform

Approved and published stories are visible to anyone on the internet, appear as an ember on the 3D-object, and may be indexed or copied by third parties outside our control.


5.2 Campaign use (automatic consent)

We would like to use selected stories in the campaign around the Band’s album, for example in social media posts, press materials, and Band content such as videos, visuals or live shows. If you do not want this: Don't submit your story!

We will only use your firstname and shortened lastname (first letter) in campaign materials.

The terms on which you grant us permission to use your story are set out in the Terms of Use.


5.3 Who can access the data
 

Recipient	What they can see
Our moderation team	Full submission, including email, to review and approve
Our team and the Band, in a restricted environment	Stories and statistics. Email addresses are not shared with the Band.
Press	Only stories selected by us, in anonymised form: firstname and shortened lastname (first letter). Press never receives your email address or exact location.
Service providers (processors)	Only what they need, under a data processing agreement: Hosting & Email-provider: transip.nl Analytics provider: google-tag-manager Cookiebanner: cookiebot.com Geocoding provider: ip-api.com Moderation tool: anthropic.com/claude/haiku
Authorities	Only where legally required

 

• Our Geo-detection tries to estimate your location, based on your IP-address , but you can enter a city and country manually.
• We store your location only at city level, together with the country. We do not store your exact address or GPS coordinates.
• You can choose a different location than where you live by entering city and country manually.

The Platform is aimed at fans worldwide. Your data is processed primarily in the European Economic Area. When we use providers outside the EEA/UK (for example in the United States), we ensure an adequate level of protection, through an EU adequacy decision (such as the EU–US Data Privacy Framework for certified providers), or Standard Contractual Clauses together with additional safeguards where needed. You can request a copy of the safeguards via the contact details above.

Please note that once your story is published, it is accessible worldwide, including in countries without data protection laws comparable to the GDPR. By consenting to publication, you accept this.

Data	Retention
Rejected or unfinished submissions	Deleted within [30] days
Approved stories and related data	Until you withdraw consent or ask for deletion, or until the site gets deleted.
Email address	Same as the story it belongs to
Consent records	[3] years after the story is deleted, as proof, then deleted
Server and security logs	[12] months
Aggregated statistics	Kept, as they contain no personal data

Under the GDPR you have the right to:

• access your data and receive a copy;
• rectification of incorrect data;
• erasure (“right to be forgotten”);
• restriction of processing;
• data portability for data you provided to us;
• object to processing based on legitimate interests;
• withdraw consent at any time, for the whole story, for campaign use only, or for the use of your name.

To exercise your rights, email office@within-temptation.com and tell us which story is yours (for example the link to your story provided upon your email-confirmation or by the email address used and a part of the text). We may ask you to verify that you are the author, so that nobody can remove or obtain someone else’s story. We respond within one month.


9.1 What happens when you withdraw consent or ask for deletion

• We remove your story from the Platform and the 3D-object within [7] days and delete it from our systems, except for the limited records mentioned in section 8.
• We stop all further campaign use and remove the story from channels we control, such as our social media accounts and website.
• We will ask recipients we passed your story to (for example press contacts and processors) to delete it, where reasonable.
• Limits: we cannot recall printed materials, content that has already been broadcast or published offline, or copies made by third parties outside our control (for example screenshots or reposts). We will always tell you what we have done.

9.2 Complaints

If you are unhappy with how we handle your data, please contact us first. You also have the right to lodge a complaint with a supervisory authority, for example in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the authority in your country of residence.


9.3 Residents of the UK, California and other regions

If you live outside the EU, you may have additional rights under local law, such as under the UK GDPR or the California Consumer Privacy Act. We honor these rights on request. We do not sell or share your personal information for cross-context behavioral advertising.
 

The Platform is for people aged 16 or older. We do not knowingly collect data from anyone under 16. If we learn that a story was submitted by someone under 16, we will not publish it, or will remove it immediately, and delete the associated data. If you believe a child has submitted data, please contact us at: office@within-temptation.com.

We use appropriate technical and organizational measures, including encrypted connections (HTTPS), encryption of stored data [confirm], role-based access to the restricted environment, confidentiality obligations for everyone with access, logging of access to submissions, and regular review of access rights. No system is perfectly secure. If a data breach is likely to put you at risk, we will notify you and the authorities as required by law.

The Platform only uses strictly necessary cookies as well as optional analytic and performance cookies. You can manage cookies in your browser settings and with the cookiebanner when first visiting our site. You can change your cookie-settings anytime by clicking the respective cookie-icon on the lower left side of our website.

Google Analytics 4

With your consent, we use Google Analytics 4 (“GA4”), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). GA4 uses cookies and similar technologies to analyse how visitors use the Platform, for example which pages are visited, how long visitors stay, which device and browser are used and the approximate location (country/city). IP addresses are not logged or stored in GA4. We use this information in aggregated form to improve the Platform. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has issued an adequacy decision. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR [and § 25(1) TDDDG]. Data is retained for [14] months. You can withdraw your consent at any time with effect for the future via the cookie settings. Further information: https://policies.google.com/privacy

Meta Pixel

With your consent, we use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). The Meta Pixel helps us measure the effectiveness of our advertising on Facebook and Instagram and show relevant ads to visitors of the Platform (custom audiences). When you visit the Platform, the pixel transmits information such as your IP address, browser and device information, the pages you visited and actions taken on the Platform to Meta. If you are logged in to a Meta account, Meta may link this information to your account. We are jointly responsible with Meta for collecting and transmitting this data (Art. 26 GDPR, see https://www.facebook.com/legal/controller_addendum). Meta alone is responsible for any further processing. Data may also be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-U.S. Data Privacy Framework. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR [and § 25(1) TDDDG]. You can withdraw your consent at any time with effect for the future via the cookie settings. Further information: https://www.facebook.com/privacy/policy. You can manage your ad settings at https://www.facebook.com/adpreferences.

Some stories may include a link to a external websites like "Instagram.com". We are not responsible for the contents of these external sites – visit them at your own risk.

We may update this policy. We will publish the new version with a new date. If a change affects how we use stories you have already shared, we will ask for your consent again where required.

Within Temptation Entertainment B.V.
Verrijn Stuartweg 30
1112 AX Diemen
The Netherlands

General and reports: office@within-temptation.com
Privacy and withdrawal requests: office@within-temptation.com