IT Security & Data Privacy Information FAQs
Review our security and data privacy FAQs covering customer data protection, secure galleries, roster uploads, and information handling standards.
(Updated February 2026)
Note: The following responses are provided from the perspective of Candid Color Systems (CCS). Responses may differ from those of individual photographers.
Company Ownership & Governance
Q: Is the vendor privately held?
Answer: Yes
Explanation:
Candid Color Systems, Inc. is a privately held U.S. company. It is not owned by venture capital, private equity, or external investment groups. This ownership structure allows CCS to operate with a long-term focus on serving schools, organizations, and families rather than pursuing data monetization strategies.
Q: Is the vendor owned or controlled by venture capital or private equity firms?
Answer: No
Explanation:
CCS is not venture capital–backed and is not subject to investor-driven data reuse, resale, or monetization requirements.
Company Location & Data Jurisdiction
Q: Is the vendor a U.S.-based company?
Answer: Yes
Explanation:
Candid Color Systems is headquartered and operated in the United States. The company’s main office is located in Oklahoma City, Oklahoma, and CCS provides photography services primarily to U.S. schools and organizations.
Q: Is student data subject to foreign ownership, control, or jurisdiction?
Answer: No
Explanation:
CCS is U.S.-owned and operated. Student data is handled in support of U.S. school photography services and governed by applicable U.S. federal and state privacy laws.
Student Data Collection
Q: Does the vendor collect student academic or educational records?
Answer: No
Explanation:
CCS does not collect academic records, grades, testing data, or educational performance information.
Q: What student data may be processed by the vendor?
Answer: Limited directory-level data and images for the limited purpose of photography
services
Explanation:
CCS may process the following types of data as authorized by the school or organization:
- Student images (photographs)
- Student names or identifiers associated with images
- School or event information
- Parent/guardian contact information provided for order fulfillment
In limited cases, additional student information (such as a student ID number) may be processed if required by the agreement between the photographer and the school or organization in order to produce service items (e.g., student IDs or yearbooks).
Purpose Limitation
Q: Is student data used only for authorized school purposes?
Answer: Yes
Explanation:
Student data and images are used solely to provide authorized school photography
services, including portraits, yearbooks, student IDs, order fulfillment, and related
customer support.
Q: Is student data used for marketing, advertising, profiling, or unrelated commercial
purposes?
Answer: No
Explanation:
CCS does not use student data or images for advertising, marketing, profiling, artificial
intelligence training, or unrelated secondary commercial purposes without appropriate
authorization. Student and parent contact information may be used only to fulfill
obligations to the school or organization, such as enabling families to view and select
images and produce service items (e.g., yearbooks).
Data Reuse & Sale
Q: Does the vendor sell student data or images?
Answer: No
Explanation:
CCS does not sell or license student data or images. Data and images are used only for
their intended photographic purpose. Unless otherwise provided by law, images remain the
property of the photographer customer who submits them to CCS systems.
Q: Is student data reused across customers, schools, or products?
Answer: No
Explanation:
Student data is not reused or repurposed outside of the specific school, organization, or
authorized photography program for which it was collected.
Third-Party Data Sharing
Q: Is student data shared with third parties?
Answer: Limited and Controlled
Explanation:
Student data and images may be shared only with authorized service providers when
necessary to fulfill school photography services. All such service providers are subject to
confidentiality and security obligations consistent with CCS policies.
CCS does not share student data for marketing or resale purposes. Limited sharing may
occur in connection with optional photography-related services selected by the
photographer, such as image editing or production services.
Data Security Controls
Q: Where is data physically stored?
Answer: The United States
Explanation:
All data is stored either on secure servers located in Oklahoma or on U.S.-based cloud
infrastructure utilizing industry-best security protocols
Q: Does the vendor maintain safeguards to protect student data?
Answer: Yes
Explanation:
CCS maintains administrative, technical, and physical safeguards designed to protect
student data from unauthorized access, disclosure, alteration, or destruction.
Safeguards include, but are not limited to:
-
Firewalls
-
Web Application Firewall (WAF) protection
-
Two-factor authentication
-
VPN-required remote access
-
Domain-restricted system access
-
Access limited to authorized personnel with a legitimate business need
Q: Is access to student data role-based or otherwise limited?
Answer: Yes
Explanation:
Access to student data is restricted to authorized systems and personnel who require
access to perform approved school photography services. Role-based access controls are
implemented where appropriate.
Data Retention & Deletion
Q: Is student data retained indefinitely?
Answer: No
Explanation:
Student images and related data are retained only as long as reasonably necessary to fulfill
school photography services, meet contractual obligations, and comply with applicable
legal requirements.
Data may be securely deleted or anonymized when requested or when no longer required.
Because photographers maintain the direct relationship with the school or organization,
the retention period may also depend on contractual and operational needs
communicated by the photographer.
Legal & Regulatory Alignment
Q: Does the vendor support FERPA-aligned practices?
Answer: Yes
Explanation:
CCS’s data handling practices are designed to support schools’ obligations under FERPA
and other applicable U.S. student privacy laws. CCS limits data collection to what is
necessary to perform required services and provides secure data transfer methods for
photographers working with schools and organizations.
Q: Does the vendor comply with applicable U.S. privacy laws?
Answer: Yes
Explanation:
CCS’s policies and practices are aligned with applicable federal and state privacy
requirements, including data protection, data removal capabilities, and the prohibition on
selling student data.
Artificial Intelligence & Biometric Use
Q: Is student data used to train artificial intelligence models?
Answer: No
Explanation:
CCS does not use student images or personal data for AI training, model development, or profiling purposes.
Q: Is biometric data sold or reused?
Answer: No
Explanation:
Student images and any associated processing are used only for authorized school photography workflows and are not sold, reused, or repurposed.
Additional Privacy & Access Rights
Q: Can schools or districts opt out of AI-based processing?
Answer: Yes
Explanation:
Schools or districts may work with their photographer (the CCS customer) to request adjustments to processing, such as opting out of automated color correction, facial recognition workflows, or automated retouching, and requesting human-based alternatives where available.
Q: What rights do parents have to request deletion of student data?
Answer: Parents may request deletion, subject to applicable legal and contractual requirements.
Explanation:
Requests for deletion should be directed through the school or photographer managing the relationship. CCS supports deletion requests consistent with contractual obligations and applicable laws.
Q: What is your policy regarding law enforcement or third-party requests for images?
Answer: CCS complies with applicable law.
Explanation:
CCS will respond to valid legal processes, such as court orders or warrants, as required by law. CCS does not provide student data to third parties outside of lawful and authorized requests.
Q: Can the school or district receive a full data inventory report annually?
Answer: Yes
Explanation:
Upon request, CCS can provide information regarding the categories of data processed in support of the school’s photography program.
Please contact us with questions or concerns.
Candid Color Systems®
www.candid.com
ccssupport@candid.com
1-800-750-0494