Last updated: 4 September 2026
The School Gallery is operated by JAM IT & Design Ltd ("JAM", "we", "us"). For most of the personal data described below, the school your child attends is the data controller — they decide why photos are taken and shared, and hold the underlying relationship with your family. JAM acts as the school's data processor, running the platform on their behalf under a data processing agreement. For a small number of things — the marketing website you're reading now, trial sign-ups, and our own staff accounts — JAM is the controller in its own right.
If you have a question about how your school specifically uses this platform, your school is usually the fastest place to ask. For anything about the platform itself, contact us at support@jamitd.co.uk.
Sharing a photo of your child, and letting you download the full-resolution original, only happens once you grant consent — that consent is the legal basis for that specific processing. Running your account itself (logging in, remembering your preferences) is necessary to perform our contract with the school on your family's behalf. Security logging and fraud prevention rely on our legitimate interest in keeping the platform safe, weighed against your right to privacy. Where the law requires us to keep certain records (e.g. audit trails, billing records), we rely on that legal obligation.
Every photo you can view or download is watermarked in a way unique to your account — this lets a leaked image be traced back to who downloaded it, and is a security measure, not a way of identifying you to third parties. Full-resolution originals are never handed out through a public or guessable link; every download goes through an authenticated, logged request.
We recognise that pupil photos are especially sensitive. A photo is only shared with a family once every tagged pupil's family (or the pupil themselves, once old enough to decide for themselves under our consent rules) has been asked, and a single denial removes that photo for every family, not just the one that denied it. Your school remains responsible for ensuring their use of the platform meets their own safeguarding obligations; we provide the tools that make consent auditable and enforceable.
We share data only with the sub-processors needed to run the service, each under contractual data protection terms. The full list, what each one receives, and where they process it, is kept up to date on our sub-processor register — in summary:
Some of these providers process data outside the UK/EEA. Where that happens, we only use providers who commit contractually to the UK's International Data Transfer Addendum (or the equivalent EU Standard Contractual Clauses) as their transfer safeguard. Full detail on where each sub-processor holds and processes data is kept current on the sub-processor register.
Photos are kept for the retention period your school's plan configures, after which they're permanently deleted — you'll get a reminder email before that happens if you haven't yet downloaded a consented photo. Account and consent-decision records are kept for as long as your account exists, and audit/security logs are pruned on a rolling schedule.
You have the right to ask for a copy of the personal data we hold about you or your child, ask us to correct anything inaccurate, and ask us to erase your own account (this can't be requested on your child's behalf — see below). You can log any of these requests from the "Privacy requests" page in your parent portal once signed in, or by emailing support@jamitd.co.uk. We aim to respond within one month, as required by UK GDPR. You also have the right to complain to the Information Commissioner's Office if you believe your data has been mishandled.
A pupil's record belongs to the school relationship rather than any one parent account, so it can't be erased on a single parent's request alone — please contact your school directly for anything concerning your child's own record.
The parent and staff portals use a single essential session cookie to keep you signed in — nothing tracking or advertising-related. Our public contact and trial-signup forms use Cloudflare Turnstile to filter out automated spam, which may set its own cookie for that purpose.
We'll update the date at the top of this page whenever we make a material change, and where a change significantly affects how we use your data we'll aim to let schools know directly.
JAM IT & Design Ltd — support@jamitd.co.uk