MJ Thomas Photography Privacy Policy
Last Updated: August 26, 2026
MJ Thomas Photography (“MJ Thomas,” “we,” “us,” or “our”) is committed to protecting the privacy and security of the students, families, schools, school districts, organizations, and other individuals we serve.
This Privacy Policy explains how we collect, use, disclose, protect, retain, and delete personal information in connection with our school photography, sports photography, yearbook, online ordering, and related services, as well as our public website at www.mjthomasphoto.com.
We recognize that schools and school districts may entrust us with information relating to students. We use that information only for authorized school-related, educational, photography, yearbook, identification, ordering, fulfillment, security, or related service purposes.
1. Information We Collect
Depending on the services being provided, MJ Thomas may receive or collect the following categories of information.
Information Provided by Schools and School Districts
Schools or school districts may provide information reasonably necessary for us to perform contracted or authorized photography, yearbook, identification, ordering, fulfillment, or related services.
This information may include:
- Student name
- School name
- Grade
- Teacher or classroom
- Student identification number or other school-assigned identifier
- Student photograph
- Parent or guardian contact information when provided by the school
- Yearbook-related information
- Team, activity, or organization information
- Other information reasonably necessary to perform services requested by the school or district
We refer to information provided by or on behalf of a school or school district concerning students as “Student Data.”
MJ Thomas seeks to collect and retain only the Student Data reasonably necessary to provide the services authorized by the applicable school or school district and to satisfy applicable legal, security, contractual, and operational requirements.
Information Provided by Customers
When parents, guardians, students, or other customers interact directly with MJ Thomas or our service providers, we may collect information such as:
- Name
- Email address
- Telephone number
- Mailing or shipping address
- School or organization
- Order information
- Customer service communications
- Information voluntarily submitted through website forms or ordering systems
Payment and Order Information
Customers may purchase products through ordering and commerce platforms used by MJ Thomas, including services provided through Captura.
Payment information may be processed by third-party payment processors in connection with those transactions.
MJ Thomas does not use payment card information for targeted or behavioral advertising.
Payment processors and commerce providers may process payment and transaction information in accordance with their applicable privacy, security, contractual, and legal requirements.
Website and Technical Information
When someone visits our website, certain technical information may be processed automatically as necessary to operate, secure, and maintain the website.
This may include:
- IP address
- Browser and device information
- Date and time of access
- Pages or resources requested
- Security and fraud-prevention information
- Cookies or similar technologies necessary for website functionality, forms, security, fraud prevention, or session management
MJ Thomas does not use this information to create advertising profiles of students.
2. How We Use Information
MJ Thomas uses personal information for legitimate educational, school-authorized, contractual, operational, customer-service, security, business, and legal purposes.
These purposes may include:
- Providing school photography services
- Providing sports and activity photography services
- Producing yearbooks and related school products
- Associating photographs with the appropriate student, school, team, classroom, activity, or organization
- Creating and fulfilling customer orders
- Delivering photographs, yearbooks, and other products
- Communicating with schools, districts, parents, guardians, and customers regarding our services
- Providing customer support
- Operating and securing our website, systems, accounts, devices, and networks
- Preventing fraud, abuse, malware, unauthorized access, and cybersecurity threats
- Maintaining business and transaction records
- Managing photography workflow, image processing, production, ordering, and fulfillment
- Complying with contractual and legal obligations
3. Student Data
MJ Thomas recognizes the heightened privacy interests associated with student information.
Student Data received from a school or school district is used only for purposes reasonably related to services authorized by that school or district and for applicable administrative, security, legal, or contractual purposes.
We Do Not Sell Student Data
MJ Thomas does not sell Student Data.
We Do Not Use Student Data for Targeted Advertising
MJ Thomas does not use Student Data for:
- Targeted advertising
- Behavioral advertising
- Cross-site advertising
- Advertising profiling
- Creating advertising audiences
- Selling advertising based on student characteristics or behavior
We do not authorize third-party advertising networks to use Student Data for these purposes.
We Do Not Build Commercial Advertising Profiles of Students
MJ Thomas does not create commercial advertising profiles of students based upon Student Data received from schools or school districts.
Information received from a school or district is not used to build unrelated commercial advertising profiles of students.
School-Authorized Purpose
When a school or district provides Student Data to MJ Thomas, we process that information for purposes related to services authorized by the school or district.
MJ Thomas does not claim ownership of Student Data supplied by a school or school district.
4. FERPA and School-Provided Education Records
When a school or school district discloses education records or personally identifiable information from education records to MJ Thomas pursuant to the Family Educational Rights and Privacy Act (“FERPA”), including pursuant to the school-official exception or another applicable FERPA exception, MJ Thomas will process that information subject to the requirements applicable to that disclosure and the terms of its agreement with the school or district.
Where applicable, MJ Thomas uses such information only for the purposes for which it was disclosed and does not redisclose it except as authorized by the educational institution, permitted by applicable law, or necessary for approved service providers assisting MJ Thomas in providing the authorized services.
Schools and school districts remain responsible for determining the appropriate legal basis under FERPA or other applicable law for providing information to MJ Thomas.
MJ Thomas will reasonably cooperate with schools and districts regarding FERPA-related access, correction, return, deletion, security, and documentation requests associated with Student Data in our possession or control.
5. Children’s Privacy
Our services frequently involve photographs and information relating to school-aged children.
MJ Thomas does not knowingly use children’s personal information for targeted advertising, behavioral advertising, or unrelated commercial advertising profiling.
MJ Thomas does not knowingly collect personal information online directly from children under 13 except as permitted by applicable law.
Where the Children’s Online Privacy Protection Act (“COPPA”) applies, MJ Thomas will provide required notices and obtain verifiable parental consent or other legally sufficient authorization before collecting, using, or disclosing personal information as required by COPPA.
Where a school is legally permitted to provide authorization on behalf of a parent, MJ Thomas will use information collected pursuant to that authorization only within the scope of the school-authorized purpose and applicable law.
6. Photography Technology Provider — Captura
MJ Thomas uses Captura, formerly ImageQuix, as a third-party photography technology provider supporting functions such as photography workflow, image management, image processing, online ordering, production, fulfillment, and related services.
In providing these services, Captura may process personal information, customer information, photographs, Student Data, order information, and related information on behalf of and at the direction of MJ Thomas.
Under Captura’s current privacy practices, the photography studio generally acts as the controller or business with respect to customer and student personal information, while Captura acts as a processor or service provider when processing such information on behalf of the studio.
Captura maintains its own privacy and data-protection practices governing information processed through its services.
Additional information regarding Captura’s privacy practices is available in the Captura Privacy Policy.
Facial Recognition, Face Matching, and Biometric Technology
MJ Thomas does not currently use Captura’s facial-recognition, Selfie-Match, face-search, face-matching, or other biometric identification functionality.
Accordingly, MJ Thomas does not currently use those Captura features to collect or process biometric identifiers or biometric information.
If MJ Thomas elects to implement biometric, facial-recognition, or face-matching technology in the future, we will review applicable legal and contractual requirements before deployment and update our privacy notices and practices as appropriate.
Where required by applicable law, this may include providing additional notice, obtaining appropriate consent or authorization, establishing applicable retention and deletion requirements, and implementing additional protections governing biometric information.
MJ Thomas will not begin using such technology solely on the basis of this Privacy Policy where additional notice, consent, contractual approval, or other legal requirements apply.
7. Cookies and Similar Website Technologies
MJ Thomas uses a limited number of cookies and similar technologies necessary or useful for the operation, functionality, and security of our public website.
These technologies may support functions such as:
- Website security
- Fraud and bot prevention
- Session management
- Website forms
- CAPTCHA verification
- Browser compatibility and functionality
- Remembering necessary website preferences
Some website functionality may be provided by third-party service providers, such as website hosting, security, or CAPTCHA providers. Those providers may place or access cookies or similar browser storage where necessary to provide their services.
Advertising and Analytics Technologies
MJ Thomas does not currently use Google Analytics, Google Tag Manager, Google Ads remarketing, Meta/Facebook Pixel, DoubleClick, or similar cross-site behavioral advertising technologies on www.mjthomasphoto.com.
MJ Thomas does not currently use cookies on its public website to track visitors across unrelated websites for targeted advertising.
If our use of analytics, advertising, cookies, or tracking technologies materially changes in the future, we will update this Privacy Policy and implement appropriate notice or consent mechanisms where required.
Visitors may configure their browsers to block, delete, or restrict cookies. Disabling necessary cookies may affect certain website functions.
This section applies to www.mjthomasphoto.com. Third-party services and ordering platforms, including Captura, may maintain their own cookie and analytics practices as described in their respective privacy policies.
8. How We Share Information
MJ Thomas does not sell Student Data.
We may disclose personal information in limited circumstances necessary to provide our services, protect our systems, fulfill transactions, or comply with legal obligations.
Schools and School Districts
Information may be shared with the school or school district associated with the photography, yearbook, identification, or related service when necessary to provide the authorized services.
Parents, Guardians, and Customers
Photographs, orders, and related information may be made available to parents, guardians, customers, or other authorized users as necessary to provide photography and ordering services.
MJ Thomas takes reasonable measures designed to limit access to student photography and related information to appropriate users.
Service Providers and Subprocessors
MJ Thomas uses third-party service providers to perform certain functions on our behalf.
Depending on the services involved, these providers may include companies that assist with:
- Photography workflow and image management
- Online ordering
- Website hosting and infrastructure
- Cloud or data storage
- Cybersecurity
- Payment processing
- Printing and production
- Shipping and fulfillment
- Email and communications
- Website security
- Software and information technology services
- Business operations
Service providers receive access to information as reasonably necessary to perform their services for MJ Thomas and are expected to protect information appropriately and process it in accordance with applicable contractual and legal requirements.
MJ Thomas does not authorize service providers processing Student Data on our behalf to sell that Student Data or use it for unrelated targeted advertising.
9. Cybersecurity Service Providers
MJ Thomas uses specialized cybersecurity technologies and service providers, including Huntress, to help protect our systems, networks, accounts, endpoints, and information against cybersecurity threats.
These providers may process technical and security-related information as reasonably necessary to detect, investigate, prevent, and respond to cybersecurity threats and security incidents.
MJ Thomas currently uses Huntress services that include managed endpoint detection and response (EDR), identity threat detection and response (ITDR), and security awareness training.
Additional information regarding Huntress’s privacy practices is available in the Huntress Privacy Policy.
10. Data Security
MJ Thomas maintains administrative, technical, and physical safeguards designed to protect personal information and Student Data against unauthorized access, disclosure, alteration, loss, misuse, or destruction.
Depending on the system and information involved, our security measures may include:
- Access controls
- User authentication
- Endpoint security
- Managed endpoint detection and response
- Identity threat detection and response
- Network security controls
- Firewalls
- Malware protection
- Security monitoring
- Employee security awareness training
- Data backup and recovery procedures
- Employee access restrictions
- Vendor and service-provider controls
- Secure transmission methods where appropriate
- Security incident detection and response procedures
No information system can guarantee absolute security. MJ Thomas nevertheless maintains safeguards designed to be appropriate to the nature and sensitivity of the information we process and reviews those safeguards as technology and risks evolve.
11. Data Breach and Security Incident Response
MJ Thomas maintains procedures for responding to suspected or confirmed security incidents involving personal information.
If MJ Thomas determines that personal information or Student Data has been accessed, acquired, used, or disclosed without authorization, we will investigate the incident, take appropriate measures to contain and remediate it, and provide notifications to affected schools, districts, individuals, regulators, insurers, law enforcement, or other parties when required by applicable law or contract.
When Student Data provided by a school or district is involved, MJ Thomas will reasonably cooperate with the educational institution in investigating and responding to the incident.
12. Data Retention
MJ Thomas retains personal information for periods reasonably necessary to provide our services and meet applicable customer-service, operational, contractual, security, accounting, and legal requirements.
Retention periods vary according to the type of information and the system in which it is maintained.
Our current general retention practices include:
Student Roster Data
Student roster data maintained directly by MJ Thomas is generally retained for up to one year, unless a different period is reasonably necessary or required by contract or applicable law.
Original Student Photographs
Original student photographs maintained directly by MJ Thomas may generally be retained for up to five years.
Retention of photographs allows MJ Thomas to support photography operations, customer service, order fulfillment, replacement orders, archival needs, and other legitimate purposes associated with the photography services we provide.
Captura Data and Customer Orders
MJ Thomas uses Captura for online ordering, photography workflow, and related services. Personal information, photographs, customer contact information, completed order records, and related information stored within Captura are retained and deleted through the Captura platform in accordance with MJ Thomas’s applicable instructions, our agreements with Captura, Captura’s Data Processing Addendum, applicable law, and Captura’s applicable retention and deletion processes.
Because Captura maintains and operates the platform, certain technical retention, archival, backup, and deletion processes are controlled by Captura.
Additional information regarding Captura’s retention practices is available in the Captura Privacy Policy.
Accounting and Business Records
Accounting records and related business records maintained by MJ Thomas may generally be retained for up to ten years, or longer where required by applicable law or reasonably necessary for tax, audit, legal, insurance, or dispute-resolution purposes.
Customer Contact Information
Customer contact information stored within Captura may remain associated with customer accounts, transactions, photographs, or order history in accordance with applicable Captura platform settings, MJ Thomas’s instructions, contractual requirements, and Captura’s retention practices.
Individuals may contact MJ Thomas regarding requests to access, correct, or delete applicable personal information.
Server Backups
MJ Thomas maintains versioned backups for business continuity, disaster recovery, security, and system restoration.
When information is deleted from MJ Thomas’s active systems in accordance with an applicable retention period or valid deletion request, it is removed from the active production environment.
Due to the nature of versioned backup systems, historical backup copies may continue to contain deleted information for a limited period until the applicable backup versions expire through MJ Thomas’s normal backup-rotation process.
Information retained solely within historical backups is not used for ordinary business purposes and remains subject to MJ Thomas’s security protections. Such information is automatically removed as historical backup versions expire according to the applicable backup-retention schedule.
Exceptions to Retention Periods
The periods above represent MJ Thomas’s general retention practices and may vary when:
- A school or district contract requires a different retention period
- Applicable law requires a different retention period
- Information is subject to litigation, investigation, audit, insurance claim, or legal hold
- Information is reasonably necessary to prevent fraud or address a security incident
- Technical backup or disaster-recovery processes require temporary continued retention
- An authorized school, district, customer, or individual requests deletion and the request can appropriately be honored sooner
When information is no longer reasonably necessary and no applicable legal, contractual, security, or operational requirement requires continued retention, MJ Thomas may securely delete, destroy, or de-identify it.
13. Data Deletion and School Requests
Schools and school districts may contact MJ Thomas regarding the correction, return, deletion, or destruction of Student Data provided to us.
Upon a valid request and subject to applicable contractual, legal, security, technical, and operational requirements, MJ Thomas will take reasonable steps to correct, return, delete, or securely destroy applicable Student Data under our control.
Where applicable information is processed by a service provider such as Captura, MJ Thomas may work with that provider to fulfill an appropriate deletion or return request in accordance with applicable contractual and technical procedures.
Information Contained in Historical Backups
Deletion of information from active systems may not result in immediate deletion from historical, versioned backup copies.
Information remaining solely in historical backups will not be used for ordinary business purposes and will remain protected until the applicable backup version expires through MJ Thomas’s normal backup-rotation process.
14. Parent, Guardian, Student, and Individual Privacy Requests
Because certain Student Data may have been provided to MJ Thomas by a school or school district, requests concerning that information may need to be directed to or coordinated with the applicable educational institution.
Parents, guardians, eligible students, customers, and other individuals may contact MJ Thomas with questions or requests concerning personal information held by MJ Thomas or processed by service providers on our behalf.
Depending on the request, MJ Thomas may need to verify the identity or authority of the person making the request before providing access to, modifying, returning, or deleting personal information.
Where applicable information is maintained through Captura, MJ Thomas may coordinate with Captura to respond to an appropriate privacy request.
Privacy requests may be submitted to privacy@mjthomasphoto.com.
Nothing in this Privacy Policy is intended to limit rights provided under applicable privacy law.
15. Data Location and Transfers
MJ Thomas primarily provides services within the United States.
Information may be processed or stored by MJ Thomas or by service providers in locations where those providers maintain facilities or infrastructure, subject to applicable contractual and legal requirements.
MJ Thomas takes reasonable measures designed to ensure that Student Data remains appropriately protected when processed by third-party service providers on our behalf.
16. Business Transfers
If MJ Thomas is involved in a merger, acquisition, reorganization, sale of assets, financing, or similar business transaction, personal information may be transferred as part of that transaction.
Student Data transferred as part of such a transaction will remain subject to applicable contractual and legal restrictions.
A business transfer does not authorize Student Data previously collected for school-authorized purposes to be converted into information for unrelated targeted advertising or commercial advertising profiling.
17. Links and Third-Party Services
Our website or services may contain links to websites or services operated by third parties.
MJ Thomas is not responsible for the independent privacy practices of third-party websites that are not acting as service providers on our behalf.
Third-party platforms used to provide MJ Thomas services, such as Captura, may also maintain their own privacy policies governing aspects of their platforms and services.
We encourage individuals to review applicable third-party privacy policies.
This provision does not diminish MJ Thomas’s responsibilities for personal information or Student Data processed by service providers on our behalf where applicable law or contract places those responsibilities on MJ Thomas.
18. Changes to This Privacy Policy
MJ Thomas may update this Privacy Policy periodically to reflect changes in our services, technology, service providers, legal requirements, or privacy and security practices.
When we make material changes, we will update the “Last Updated” date at the beginning of this policy and provide additional notice where required by applicable law or contract.
If MJ Thomas begins using facial recognition, face matching, biometric identification, or similar technology in the future, we will review and update our privacy practices and applicable notices before or in connection with deployment as required by applicable law.
We will not make a material change that permits Student Data previously collected for school-authorized purposes to be used for unrelated targeted advertising or commercial advertising profiling without appropriate authorization.
19. Contact MJ Thomas
Questions regarding this Privacy Policy, our privacy practices, cybersecurity practices, Student Data, or requests to access, correct, return, or delete applicable personal information may be directed to:
MJ Thomas Photography
Privacy Contact: privacy@mjthomasphoto.com
Website: www.mjthomasphoto.com
Schools and school districts may also contact their MJ Thomas representative regarding student privacy, security, data deletion, vendor documentation, or contractual privacy requirements.
When submitting a privacy request, please provide sufficient information for MJ Thomas to identify the applicable records and verify the identity or authority of the person making the request. Please do not send passwords, payment card numbers, Social Security numbers, or other unnecessary sensitive information by email.