The enrolment contract
You write your own instrument. Almost nobody in education does.
A public school inherits a district form it did not draft, administered by an office it does not manage, revised on a schedule it does not set. You wrote yours, you can revise it, and you explain it to a family across a desk. That is a real advantage — and it makes its clarity entirely your responsibility.
Three tiers, and the contract only owns the first
Tier one: uses within your community. A family seeing their own child, imagery in a report to parents, a display in a corridor, the school magazine that goes to enrolled families. Here the contract is genuinely the instrument, and a well-drafted one settles almost everything.
Tier two: uses that need their own agreement. Anything with money attached, anything designed to outlive enrolment, and anything shown to people outside your community. A fundraising appeal featuring a particular child is the clearest case: a contract signed to enrol a child is not a licence to solicit using their face, and treating it as one is the practice most likely to produce a conversation nobody wants.
Tier three: uses no agreement reaches. Public marketing of a student under thirteen. The floor is applied before any agreement is consulted and it has no override.
Most schools we speak to have a contract that does tier one well, assumes it covers tier two, and has not thought about tier three until somebody asks.
Can agreement be a condition of enrolment?
Schools ask this, and it is a fair question rather than a cynical one: an admissions office with a viewbook to fill would obviously prefer a yes from everybody.
Whether you may is a question for your counsel, not for us, and it will depend on your jurisdiction and how the requirement is framed. What we can offer is two observations from the operational side.
The first is that it would not get you the thing most schools want it for. The age floor is not reachable by any contract term, so a required agreement would still leave your under-thirteen students unusable in public marketing. You would have obtained the difficult thing and not the useful one.
The second is that an agreement a family felt unable to refuse is the one most likely to be regretted — by them, later, loudly, and frequently at exactly the moment the school least wants a conversation about it. Schools with a genuinely optional and clearly explained agreement tend to get a higher real yes rate than schools with a mandatory one, because the families who say yes actually mean it.
What fee-paying changes in practice
Not the mechanism. The mechanism is identical to a public school’s: a permission held per student, defaulting closed, re-checked at the moment of use.
What changes is everything around it. Your families chose you and can leave, so they raise things directly and quickly. They compare your delivery to consumer products rather than to the school down the road. And a complaint about a photograph arrives with the weight of a paying customer rather than a constituent.
The rule that meets that force most often is the group one: a class or team photograph is only shown where every child in it may be shown, so one refusal takes it away from everybody. In a public school that produces a phone call. In a fee-paying setting it produces a phone call from somebody who is quite clear about what they are paying for.
We are not going to soften the rule, and it is worth being ready with the reason. The alternative — cropping or blurring the child whose family declined — is a judgement made once by whoever is in a hurry, and a promise about software that the family has no way of checking. Withholding is the only version a head can honestly describe to the family who asked.
A school that spans the age line
A great many independent schools run from four to eighteen on one site, under one contract, with one admissions office. That means carrying two regimes in one institution.
Your lower school sits under a floor with no override. Your senior school does not, and there the family’s own permission decides. Practically, that means a piece of collateral drawn from across the school is governed by the strictest position of anybody in it — a whole-school photograph, a joint production, a spread about a family with children in three sections.
None of it is hard to operate once you know. It is hard to discover in the week a prospectus is being signed off, which is why the sensible first exercise is to mark which of your existing collateral crosses the line. Schools are frequently surprised by how much of it does.
How a photograph reaches the right student
A permission-checked lookup against your own roster: a name and an id. Deliberately dull, because your staff already know who was in the room, and the interesting alternative costs a stored biometric template for every child in the school.
Face matching exists in the wider platform. It is off unless a parent switches it on for their own child, it is never bundled into a publication permission, and where it is on the template is a set of numbers derived from a photograph rather than a saved picture of a face. It stays inside the private cloud we run ourselves and is never sent to an outside service. Withdrawal stops the matching at the point of asking.
The part we have not finished, in the same type as everything else. Destroying a stored template at the end of its retention window is not something we can demonstrate from one end to the other. So we will not tell you it happens nightly, on withdrawal, or at the end of the window.
What we can tell you is how it fails: the cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it, and that alarm stays where a school can see it. When the whole chain can be shown, this will say so.
The questions a head asks
Our contract has a broad media clause. Is that enough?
For uses that are actually within your community and for students over the age floor, frequently yes -- and the contract is doing real work there. For public marketing of children under thirteen, no clause reaches it. For anything with money attached, such as a fundraising appeal, a broad clause is the practice most likely to produce a conversation you do not want, and a specific agreement is cheap.
Fee-paying parents have more standing with us. Does that change the system?
It changes the conversation rather than the mechanism. What it does change in practice is how quickly you hear about a mistake and how much force is behind the complaint. Schools in this sector tend to be more careful for exactly that reason, which is a reasonable instinct rather than a cynical one.
A family withdrew after signing. What happens?
It applies the next time anybody looks. Access is worked out at the moment of asking rather than remembered from the moment it was granted, so a withdrawal does not depend on somebody going to edit anything. What it cannot reach is a printed viewbook already distributed.
Can we require agreement as a condition of enrolment?
That is a question for your school and its counsel rather than for us, and it is worth thinking about carefully -- an agreement that a family felt they could not refuse is the one most likely to be regretted by both sides. What we can tell you is that the age floor is not negotiable through any contract, so requiring it would not achieve the thing most schools want it for.
Will you confirm our school is meeting its obligations?
No. We describe exactly what the system blocks, when it is re-checked, and what it refuses to do. Whether that satisfies your obligations, in your jurisdiction, under your contract, is a conclusion for you and your counsel. A vendor offering that conclusion in a brochure has told you something useful about the vendor.
What have you not finished?
One thing, and it belongs here rather than in a footnote. Where a parent has switched face matching on, the system stores a template -- a set of numbers derived from a photograph, not a saved picture of a face. Destroying that template at the end of its retention window is not something we can demonstrate from one end to the other. The cleanup stops and raises a standing alarm rather than marking a template gone when it cannot actually destroy it. When the whole chain can be shown, this will say so.