Just FYI, I was in the same situation and did so and they never got back to me. GDPR enforcement is almost non-existent (especially in cases where they need to investigate and potentially litigate instead of sending canned replies) in my country (and most others by the looks of it) so there's nothing you can do in practice.
Sad to hear. It's annoying when you get a bunch of new regulation that is self-selected-enforcing and only the law-abiding citizens and companies will follow it while others ignore it without consequences.
It's spotty in Germany, since it's set up at the state level and depends on where the company is located. In my experience, Hamburg's DPO is terrible, slow and mostly unwilling. Berlin's is very slow but not incompetent. Hesse's is quick and responsive and feels like they have a good understanding of tech and want to get things done.
