Privacy Policy – MJ Thomas Photography

Last Updated: September 4, 2026

MJ Thomas Photography (“MJ Thomas,” “we,” “us,” or “our”) is committed to protecting the privacy and security of the students, families, schools, school districts, organizations, and other individuals we serve.

This Privacy Policy explains how we collect, use, disclose, protect, retain, and delete personal information in connection with our school photography, sports photography, yearbook, online ordering, and related services, as well as our public website at www.mjthomasphoto.com.

We recognize that schools and school districts may entrust us with information relating to students. We use that information only for authorized school-related, educational, photography, yearbook, identification, ordering, fulfillment, security, or related service purposes.

1. Information We Collect

Depending on the services being provided, MJ Thomas may receive or collect the following categories of information.

Information Provided by Schools and School Districts

Schools or school districts may provide information reasonably necessary for us to perform contracted or authorized photography, yearbook, identification, ordering, fulfillment, or related services.

This information may include:

Student name
School name
Grade
Teacher or classroom
Student identification number or other school-assigned identifier
Student photograph
Parent or guardian contact information when provided by the school
Yearbook-related information
Team, activity, or organization information
Other information reasonably necessary to perform services requested by the school or district

We refer to information provided by or on behalf of a school or school district concerning students as “Student Data.”

MJ Thomas seeks to collect and retain only the Student Data reasonably necessary to provide the services authorized by the applicable school or school district and to satisfy applicable legal, security, contractual, and operational requirements.

Information Provided by Customers

When parents, guardians, students, or other customers interact directly with MJ Thomas or our service providers, we may collect information such as:

Name
Email address
Telephone number
Mailing or shipping address
School or organization
Order information
Customer service communications
Information voluntarily submitted through website forms or ordering systems

Payment and Order Information

Customers may purchase products through ordering and commerce platforms used by MJ Thomas, including services provided through Captura.

Payment information may be processed by third-party payment processors in connection with those transactions.

MJ Thomas does not use payment card information for targeted or behavioral advertising.

Payment processors and commerce providers may process payment and transaction information in accordance with their applicable privacy, security, contractual, and legal requirements.

Website and Technical Information

When someone visits our website, certain technical information may be processed automatically as necessary to operate, secure, and maintain the website.

This may include:

IP address
Browser and device information
Date and time of access
Pages or resources requested
Security and fraud-prevention information
Cookies or similar technologies necessary for website functionality, forms, security, fraud prevention, or session management

MJ Thomas does not use this information to create advertising profiles of students.

2. How We Use Information

MJ Thomas uses personal information for legitimate educational, school-authorized, contractual, operational, customer-service, security, business, and legal purposes.

These purposes may include:

Providing school photography services
Providing sports and activity photography services
Producing yearbooks and related school products
Associating photographs with the appropriate student, school, team, classroom, activity, or organization
Creating and fulfilling customer orders
Delivering photographs, yearbooks, and other products
Communicating with schools, districts, parents, guardians, and customers regarding our services
Providing customer support
Operating and securing our website, systems, accounts, devices, and networks
Preventing fraud, abuse, malware, unauthorized access, and cybersecurity threats
Maintaining business and transaction records
Managing photography workflow, image processing, production, ordering, and fulfillment
Complying with contractual and legal obligations

MJ Thomas does not use identifiable student photographs or Student Data to train, develop, test, validate, or improve artificial intelligence or machine-learning models as described further in Section 8.

3. Student Data

MJ Thomas recognizes the heightened privacy interests associated with student information.

Student Data received from a school or school district is used only for purposes reasonably related to services authorized by that school or district and for applicable administrative, security, legal, or contractual purposes.

We Do Not Sell Student Data

MJ Thomas does not sell Student Data.

We Do Not Use Student Data for Targeted Advertising

MJ Thomas does not use Student Data for:

Targeted advertising
Behavioral advertising
Cross-site advertising
Advertising profiling
Creating advertising audiences
Selling advertising based on student characteristics or behavior

We do not authorize third-party advertising networks to use Student Data for these purposes.

We Do Not Build Commercial Advertising Profiles of Students

MJ Thomas does not create commercial advertising profiles of students based upon Student Data received from schools or school districts.

Information received from a school or district is not used to build unrelated commercial advertising profiles of students.

School-Authorized Purpose

When a school or district provides Student Data to MJ Thomas, we process that information for purposes related to services authorized by the school or district.

MJ Thomas does not claim ownership of Student Data supplied by a school or school district.

4. FERPA and School-Provided Education Records

When a school or school district discloses education records or personally identifiable information from education records to MJ Thomas pursuant to the Family Educational Rights and Privacy Act (“FERPA”), including pursuant to the school-official exception or another applicable FERPA exception, MJ Thomas will process that information subject to the requirements applicable to that disclosure and the terms of its agreement with the school or district.

Where applicable, MJ Thomas uses such information only for the purposes for which it was disclosed and does not redisclose it except as authorized by the educational institution, permitted by applicable law, or necessary for approved service providers assisting MJ Thomas in providing the authorized services.

Schools and school districts remain responsible for determining the appropriate legal basis under FERPA or other applicable law for providing information to MJ Thomas.

MJ Thomas will reasonably cooperate with schools and districts regarding FERPA-related access, correction, return, deletion, security, and documentation requests associated with Student Data in our possession or control.

5. Children’s Privacy

Our services frequently involve photographs and information relating to school-aged children.

MJ Thomas does not knowingly use children’s personal information for targeted advertising, behavioral advertising, or unrelated commercial advertising profiling.

MJ Thomas does not knowingly collect personal information online directly from children under 13 except as permitted by applicable law.

Where the Children’s Online Privacy Protection Act (“COPPA”) applies, MJ Thomas will provide required notices and obtain verifiable parental consent or other legally sufficient authorization before collecting, using, or disclosing personal information as required by COPPA.

Where a school is legally permitted to provide authorization on behalf of a parent, MJ Thomas will use information collected pursuant to that authorization only within the scope of the school-authorized purpose and applicable law.

6. Photography Technology Provider — Captura

MJ Thomas uses Captura, formerly ImageQuix, as a third-party photography technology provider supporting functions such as photography workflow, image management, image processing, online ordering, production, fulfillment, and related services.

In providing these services, Captura may process personal information, customer information, photographs, Student Data, order information, and related information on behalf of and at the direction of MJ Thomas.

Under Captura’s current privacy practices, the photography studio generally acts as the controller or business with respect to customer and student personal information, while Captura acts as a processor or service provider when processing such information on behalf of the studio.

Captura uses third-party infrastructure and service providers, including Amazon Web Services (AWS), in connection with certain hosting, storage, processing, and platform functions.

Those infrastructure providers are subprocessors or service providers of Captura and are not necessarily companies with which MJ Thomas directly shares information independently of Captura.

Captura maintains its own privacy and data-protection practices governing information processed through its services.

Additional information regarding Captura’s privacy practices is available in the Captura Privacy Policy.

Facial Recognition, Face Matching, and Biometric Technology

MJ Thomas does not currently use Captura’s facial-recognition, Selfie-Match, face-search, face-matching, or other biometric identification functionality.

Accordingly, MJ Thomas does not currently use those Captura features to collect or process biometric identifiers or biometric information.

If MJ Thomas elects to implement biometric, facial-recognition, or face-matching technology in the future, we will review applicable legal and contractual requirements before deployment and update our privacy notices and practices as appropriate.

Where required by applicable law, this may include providing additional notice, obtaining appropriate consent or authorization, establishing applicable retention and deletion requirements, and implementing additional protections governing biometric information.

MJ Thomas will not begin using such technology solely on the basis of this Privacy Policy where additional notice, consent, contractual approval, or other legal requirements apply.

7. Printing and Fulfillment Provider — H&H Color Lab

MJ Thomas performs most printing and photographic production internally. Certain products or orders, however, may be produced or fulfilled by H&H Color Lab.

When H&H Color Lab is used, MJ Thomas provides only the photographs and information reasonably necessary to produce or fulfill the applicable products or services.

Depending on the service being provided, this information may include a student’s photograph, name, grade, teacher or homeroom, student identification number, or other information reasonably necessary for production or fulfillment.

H&H Color Lab has represented to MJ Thomas that:

Student names and identification information are used only for the specific purpose of providing school and parent photography services
It does not sell student data or photographs
It does not use student data for marketing, analytics, commercial gain, or unrelated secondary purposes
It does not gather, store, or transmit biometric or facial-mapping information
It does not use student photographs or Student Data to develop algorithms or train artificial intelligence models
Applicable image and data storage used for these services is located in the United States
Photography studios retain ownership of the photographs uploaded to its systems
Studios are provided tools to manage and delete applicable data

For print work submitted by MJ Thomas, H&H Color Lab has advised us that completed orders generally remain in its production systems for approximately 9 to 14 days in total, and that original order files are generally archived for approximately one month following production to assist with troubleshooting and customer service.

H&H Color Lab may use service providers of its own in providing certain services. For example, it has identified SendGrid and Twilio for certain email and text communications and third-party payment processing providers for applicable transactions.

The involvement of those services depends upon the particular H&H service being used and does not mean that every student photograph or Student Data record is provided to each such provider.

8. Artificial Intelligence and Machine Learning

MJ Thomas Photography does not use identifiable student photographs or Student Data to train, develop, test, validate, or improve artificial intelligence or machine-learning models.

MJ Thomas has not opted in to Captura’s program that permits specifically designated photographs to be treated as “Work Product” for artificial intelligence or machine-learning training or development.

MJ Thomas does not designate student school photographs as Work Product for that purpose and does not authorize student school photographs to be used through that program for AI or machine-learning model training, development, testing, validation, or improvement.

MJ Thomas does not authorize service providers processing identifiable student photographs or Student Data on our behalf to use that information for their independent artificial intelligence or machine-learning model training or development.

H&H Color Lab has represented to MJ Thomas that it does not use student photographs or Student Data to develop algorithms or train artificial intelligence models.

This restriction does not prohibit the use of automated technologies or software features solely as necessary to provide photography-related services requested by MJ Thomas or a school, provided such use does not authorize identifiable student photographs or Student Data to be used to train or improve a service provider’s general-purpose or proprietary AI or machine-learning models.

A service provider may separately use information that has been aggregated or de-identified so that it does not identify and cannot reasonably be used to identify an individual where permitted by applicable law and the applicable service-provider agreement.

9. Cookies and Similar Website Technologies

MJ Thomas uses a limited number of cookies and similar technologies necessary or useful for the operation, functionality, and security of our public website.

These technologies may support functions such as:

Website security
Fraud and bot prevention
Session management
Website forms
CAPTCHA verification
Browser compatibility and functionality
Remembering necessary website preferences

Some website functionality may be provided by third-party service providers, such as website hosting, security, or CAPTCHA providers. Those providers may place or access cookies or similar browser storage where necessary to provide their services.

Advertising and Analytics Technologies

MJ Thomas does not currently use Google Analytics, Google Tag Manager, Google Ads remarketing, Meta/Facebook Pixel, DoubleClick, or similar cross-site behavioral advertising technologies on www.mjthomasphoto.com.

MJ Thomas does not currently use cookies on its public website to track visitors across unrelated websites for targeted advertising.

If our use of analytics, advertising, cookies, or tracking technologies materially changes in the future, we will update this Privacy Policy and implement appropriate notice or consent mechanisms where required.

Visitors may configure their browsers to block, delete, or restrict cookies. Disabling necessary cookies may affect certain website functions.

This section applies to www.mjthomasphoto.com. Third-party services and ordering platforms, including Captura, may maintain their own cookie and analytics practices as described in their respective privacy policies.

10. How We Share Information

MJ Thomas does not sell Student Data.

We may disclose personal information in limited circumstances necessary to provide our services, protect our systems, fulfill transactions, or comply with legal obligations.

Schools and School Districts

Information may be shared with the school or school district associated with the photography, yearbook, identification, or related service when necessary to provide the authorized services.

Parents, Guardians, and Customers

Photographs, orders, and related information may be made available to parents, guardians, customers, or other authorized users as necessary to provide photography and ordering services.

MJ Thomas takes reasonable measures designed to limit access to student photography and related information to appropriate users.

Service Providers and Subprocessors

MJ Thomas uses third-party service providers to perform certain functions on our behalf.

Depending on the services involved, these providers may include companies that assist with:

Photography workflow and image management
Online ordering
Website hosting and infrastructure
Cloud or data storage
Cybersecurity
Payment processing
Printing and production
Shipping and fulfillment
Email and communications
Website security
Software and information technology services
Business operations

Direct service providers used in connection with student photography may include Captura and, for certain printing and production work, H&H Color Lab.

Some service providers use subprocessors or infrastructure providers of their own. For example, Captura uses cloud infrastructure providers including AWS in connection with certain services.

Service providers receive access to information only as reasonably necessary to perform their services for MJ Thomas.

MJ Thomas does not authorize service providers processing Student Data on our behalf to sell Student Data, use it for unrelated targeted advertising, create unrelated commercial advertising profiles of students, or use identifiable student photographs or Student Data for independent AI/ML model training.

11. Cybersecurity Service Providers

MJ Thomas uses specialized cybersecurity technologies and service providers, including Huntress, to help protect our systems, networks, accounts, endpoints, and information against cybersecurity threats.

These providers may process technical and security-related information as reasonably necessary to detect, investigate, prevent, and respond to cybersecurity threats and security incidents.

MJ Thomas currently uses Huntress services that include managed endpoint detection and response (EDR), identity threat detection and response (ITDR), and security awareness training.

Additional information regarding Huntress’s privacy practices is available in the Huntress Privacy Policy.

12. Data Security

MJ Thomas maintains administrative, technical, and physical safeguards designed to protect personal information and Student Data against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Depending on the system and information involved, our security measures may include:

Access controls
User authentication
Endpoint security
Managed endpoint detection and response
Identity threat detection and response
Network security controls
Firewalls
Malware protection
Security monitoring
Employee security awareness training
Data backup and recovery procedures
Employee access restrictions
Vendor and service-provider controls
Secure transmission methods where appropriate
Security incident detection and response procedures

No information system can guarantee absolute security. MJ Thomas nevertheless maintains safeguards designed to be appropriate to the nature and sensitivity of the information we process and reviews those safeguards as technology and risks evolve.

13. Data Breach and Security Incident Response

MJ Thomas maintains procedures for responding to suspected or confirmed security incidents involving personal information.

If MJ Thomas determines that personal information or Student Data has been accessed, acquired, used, or disclosed without authorization, we will investigate the incident, take appropriate measures to contain and remediate it, and provide notifications to affected schools, districts, individuals, regulators, insurers, law enforcement, or other parties when required by applicable law or contract.

When Student Data provided by a school or district is involved, MJ Thomas will reasonably cooperate with the educational institution in investigating and responding to the incident.

14. Data Retention

MJ Thomas retains personal information for periods reasonably necessary to provide our services and meet applicable customer-service, operational, contractual, security, accounting, and legal requirements.

Retention periods vary according to the type of information and the system in which it is maintained.

The retention periods below are general maximum or customary retention periods and do not prevent an appropriate request for earlier deletion where the information is no longer necessary for the applicable school, order, contractual, legal, or operational purpose.

Student Roster Data

Student roster data maintained directly by MJ Thomas is generally retained for up to one year, unless a different period is reasonably necessary or required by contract or applicable law.

Original Student Photographs

Original student photographs maintained directly by MJ Thomas may generally be retained for up to five years.

Retention of photographs allows MJ Thomas to support photography operations, customer service, order fulfillment, replacement orders, archival needs, and other legitimate purposes associated with the photography services we provide.

A parent, legal guardian, eligible student, school, or district may request earlier deletion as described in Sections 15 and 16.

Captura Data and Customer Orders

MJ Thomas uses Captura for online ordering, photography workflow, and related services.

Personal information, photographs, customer contact information, completed order records, and related information stored within Captura are retained and deleted through the Captura platform in accordance with MJ Thomas’s applicable instructions, our agreements with Captura, Captura’s Data Processing Addendum, applicable law, and Captura’s applicable retention and deletion processes.

Because Captura maintains and operates the platform, certain technical retention, archival, backup, and deletion processes are controlled by Captura.

Additional information regarding Captura’s retention practices is available in the Captura Privacy Policy.

H&H Color Lab Production Files

For print work submitted to H&H Color Lab, H&H has advised MJ Thomas that completed orders generally remain within its production systems for approximately 9 to 14 days in total.

H&H has further advised that original order files are generally archived for approximately one month to assist with troubleshooting and customer service.

Accounting and Business Records

Accounting records and related business records maintained by MJ Thomas may generally be retained for up to ten years, or longer where required by applicable law or reasonably necessary for tax, audit, legal, insurance, or dispute-resolution purposes.

Customer Contact Information

Customer contact information stored within Captura may remain associated with customer accounts, transactions, photographs, or order history in accordance with applicable Captura platform settings, MJ Thomas’s instructions, contractual requirements, and Captura’s retention practices.

Individuals may contact MJ Thomas regarding requests to access, correct, or delete applicable personal information.

Server Backups

MJ Thomas maintains versioned backups for business continuity, disaster recovery, security, and system restoration.

When information is deleted from MJ Thomas’s active systems in accordance with an applicable retention period or valid deletion request, it is removed from the active production environment.

Due to the nature of versioned backup systems, historical backup copies may continue to contain deleted information for a limited period until the applicable backup versions expire through MJ Thomas’s normal backup-rotation process.

Information retained solely within historical backups is not used for ordinary business purposes and remains subject to MJ Thomas’s security protections. Such information is automatically removed as historical backup versions expire according to the applicable backup-retention schedule.

Exceptions to Retention Periods

The periods above represent MJ Thomas’s general retention practices and may vary when:

A school or district contract requires a different retention period
Applicable law requires a different retention period
Information is subject to litigation, investigation, audit, insurance claim, or legal hold
Information is reasonably necessary to prevent fraud or address a security incident
Technical backup or disaster-recovery processes require temporary continued retention
An authorized school, district, parent, guardian, eligible student, customer, or individual requests deletion and the request can appropriately be honored sooner

When information is no longer reasonably necessary and no applicable legal, contractual, security, or operational requirement requires continued retention, MJ Thomas may securely delete, destroy, or de-identify it.

15. Data Deletion and School Requests

Schools and school districts may contact MJ Thomas regarding the correction, return, deletion, or destruction of Student Data provided to us.

Upon a valid request and subject to applicable contractual, legal, security, technical, and operational requirements, MJ Thomas will take reasonable steps to correct, return, delete, or securely destroy applicable Student Data under our control.

Deletion From Service Providers

When MJ Thomas honors a valid deletion request involving photographs or Student Data that have been provided to a service provider, MJ Thomas will take reasonable steps to:

Delete applicable information from active systems under MJ Thomas’s control; and
Direct applicable service providers, such as Captura or H&H Color Lab where applicable, to delete the corresponding information in accordance with their contractual obligations, established deletion procedures, technical capabilities, and applicable law.

Because third-party service providers operate their own systems, MJ Thomas cannot guarantee instantaneous deletion from every technical, archival, security, or backup system maintained by those providers.

Information retained temporarily within a service provider’s backup, archival, or disaster-recovery system may remain until it expires or is deleted through that provider’s normal retention process. Such continued technical retention does not authorize the information to be used for unrelated purposes.

Information Contained in MJ Thomas Historical Backups

Deletion of information from active MJ Thomas systems may not result in immediate deletion from historical, versioned backup copies.

Information remaining solely in historical backups will not be used for ordinary business purposes and will remain protected until the applicable backup version expires through MJ Thomas’s normal backup-rotation process.

16. Parent, Guardian, Student, and Individual Privacy Requests

Parents, legal guardians, eligible students, customers, and other individuals may contact MJ Thomas with questions or requests concerning personal information held by MJ Thomas or processed by service providers on our behalf.

Requests for Earlier Deletion

The general retention periods described in this Privacy Policy do not require MJ Thomas to retain a student’s photograph or Student Data for the full retention period in every circumstance.

A parent or legal guardian may request deletion of a minor child’s photograph and associated Student Data once applicable photography orders, school deliverables, yearbook production, identification requirements, or other authorized school-related purposes have been completed.

MJ Thomas will evaluate and honor appropriate deletion requests where continued retention is not required for a legitimate contractual, legal, security, operational, transactional, or school-authorized purpose.

Because certain Student Data may have been provided to MJ Thomas by a school or school district, a request concerning that information may need to be coordinated with or verified through the applicable educational institution.

Depending on the request, MJ Thomas may need to verify the identity or authority of the person making the request before providing access to, modifying, returning, or deleting personal information.

Where applicable information is maintained through Captura, H&H Color Lab, or another service provider, MJ Thomas will take reasonable steps to coordinate an appropriate privacy or deletion request with that provider as described in Section 15.

Privacy requests may be submitted to:

privacy@mjthomasphoto.com

Nothing in this Privacy Policy is intended to limit rights provided under applicable privacy law.

17. Data Location and Transfers

MJ Thomas primarily provides services within the United States.

Information may be processed or stored by MJ Thomas or by service providers in locations where those providers maintain facilities or infrastructure, subject to applicable contractual and legal requirements.

H&H Color Lab has represented to MJ Thomas that applicable storage for the school-photography services described in this Policy is located in the United States.

MJ Thomas takes reasonable measures designed to ensure that Student Data remains appropriately protected when processed by third-party service providers on our behalf.

18. Business Transfers

If MJ Thomas is involved in a merger, acquisition, reorganization, sale of assets, financing, or similar business transaction, personal information may be transferred as part of that transaction.

Student Data transferred as part of such a transaction will remain subject to applicable contractual and legal restrictions.

A business transfer does not authorize Student Data previously collected for school-authorized purposes to be converted into information for unrelated targeted advertising or commercial advertising profiling.

19. Links and Third-Party Services

Our website or services may contain links to websites or services operated by third parties.

MJ Thomas is not responsible for the independent privacy practices of third-party websites that are not acting as service providers on our behalf.

Third-party platforms used to provide MJ Thomas services, such as Captura, may also maintain their own privacy policies governing aspects of their platforms and services.

We encourage individuals to review applicable third-party privacy policies.

This provision does not diminish MJ Thomas’s responsibilities for personal information or Student Data processed by service providers on our behalf where applicable law or contract places those responsibilities on MJ Thomas.

20. Changes to This Privacy Policy

MJ Thomas may update this Privacy Policy periodically to reflect changes in our services, technology, service providers, legal requirements, or privacy and security practices.

When we make material changes, we will update the “Last Updated” date at the beginning of this Policy and provide additional notice where required by applicable law or contract.

If MJ Thomas begins using facial recognition, face matching, biometric identification, or similar technology in the future, we will review and update our privacy practices and applicable notices before or in connection with deployment as required by applicable law.

MJ Thomas will not make a material change that permits Student Data previously collected for school-authorized purposes to be used for unrelated targeted advertising, commercial advertising profiling, or identifiable AI/ML model training without appropriate authorization and any notice or consent required by applicable law.

21. Contact MJ Thomas

Questions regarding this Privacy Policy, our privacy practices, cybersecurity practices, Student Data, service providers, or requests to access, correct, return, or delete applicable personal information may be directed to:

MJ Thomas Photography
Privacy Contact: privacy@mjthomasphoto.com
Website: www.mjthomasphoto.com

Schools and school districts may also contact their MJ Thomas representative regarding student privacy, security, data deletion, vendor documentation, or contractual privacy requirements.

When submitting a privacy request, please provide sufficient information for MJ Thomas to identify the applicable records and verify the identity or authority of the person making the request.

Please do not send passwords, payment card numbers, Social Security numbers, or other unnecessary sensitive information by email.