Contractor Portal (information 3rd party provider sees)
In the contractor portal, we have identified a problem regarding the information visible to contractors. Of course, this always depends on how the customer has configured the Base-EXP configuration. However, if the available configuration options are fully utilized, contractors can see information they definitely should not have access to.
Examples:
- The total amount of service orders already placed by the exhibitor
- When accessing the account management information, contractors do not see their own company and contact information. Instead, they see the exhibitor’s account and contact details and are even able to edit them.
If this behavior is intended and should remain as is, it represents a showstopper for our current customer, Svenska Mässan (they will most likely reach out about this issue as well), regarding the use of the contractor portal.
As this is also partly a GDPR-related issue, and since the contractor portal is becoming increasingly available to customers through Crosswalks, I expect this topic to be raised more frequently in the near future, especially within Europe.
-
Shannon Wiley is this expected the way it is built today?
-
Yes. Contractor Portal is an impersonation mode. All EXP impersonation modes impersonate the exhibitor exactly as if they logged in themselves with the only difference in contractor portal being that you can mark specific tasks to display based on contractor type so one type cannot see another type's tasks but there is no control over additional visibility.
The way this was designed was that the exhibitor would denote what contractor, if any, they would want to work on their behalf (event/official and/or exhibitor defined) in a task with a Contractor Selection component and in that process they would be explicitly giving the contractor access to their portal which satisfied GDPR, at least at that time.
The contractor can see their own account details from the contractor portal list page right after they log in and before they select an exhibitor to impersonate.
Please sign in to leave a comment.
Comments
3 comments
Date Votes