The Friends & Family feature allows the lead of a group to perform several actions on behalf of the members of the group, like ordering some tickets, paying reservations, etc. It also allows the group lead to see some information about the group members like emails, or previous orders. In order to increase protection of data privacy, an explicit consent has been implemented, preventing group leads from accessing some data of the group members.
Solution
Solution overview
The solution consists in two parts described in more detail in the next sections:
- Reduce the rights of the group lead towards group members who didn't give their explicit consent
- Provide a process to allow a group member to provide the consent to the group lead so that he can benefit from the full Friends & Family features
Reduced access rights in absence of consent
This section describes the restrictions that are applied until the group member has given his consent. All Ticket Shop pages not mentioned here behave the same way with or without consent.
In the example below, Andrew Smith is buying three season tickets, one for him, one for Blaise Smith and one for Darren Smith. Andrew has just added Blaise and Darren to his group by entering their contact number and family name (this process hasn't changed). Since Blaise and Darren haven't given their consent yet to Andrew to be added to his group, Andrew can't see their email address.
In the ticket list, the group lead can only select the group members who have given their consent. As a result, Blaise and Darren don't appear in the list.
The same logic holds for the order history section:
The email addresses aren't displayed on the Friends & Family management screen:
Providing the consent
When the group lead adds a contact to his group, the contact will receive an email with a link allowing to provide the consent. The email also mentions the name of the group lead who wants to add the contact to his group as well as a link to your privacy policy that has to explain the Friends and Family feature (so that the contact knows to what he consents).
If the group member doesn't react, the group lead may resend a consent request email explicitly by clicking on the email icon:
Adding a new contact to the Friends & Family group
When a group lead adds a member to his group that doesn't exist yet, the newly created contact will receive two emails:
- An email to set the password
- An email requesting the consent to be added to the group
Getting started
This feature is directly available. As explained in above section, you will have to remove the tickets already on resale if you want to change the resale type of the resale platform.
