Privacy Policy

I. Name and Address of the Data Controller

The data controller in accordance with the General Data Protection Regulation (in short GDPR = Datenschutz-Grundverordnung = DSGVO) and in accordance with other national data protection acts of the Member States as well as in accordance with further data protection regulations is:

CONSUS Real Estate AG
Kurfürstendamm 188-189
D-10707 Berlin
Germany
Phone: +49 (0) 30 965 357 90 260
E-mail: investoren@consus.ag
Website: www.consus.ag

II. Name and Address of the Data Protection Officer

The Data Protection Officer of the data controller is:

Lawyer Klaus Voigt
Augustusweg 105, D-01445 Radebeul
Data Protection Officer of Consus Real Estate AG as of April 1st, 2019

III. General Information about Data Processing

1. Scope of Personal Data Processing
In principle, we collect and use the personal data of our users only to the extent that this should be necessary for providing a well-functioning website as well as our contents and services. Collecting and using personal data of our users shall consistently only be permissible subject to the prior consent of our users. An exception shall only apply in such cases, when gathering prior consent should not be possible due to practical reasons and when processing the data is permitted due to statutory regulations.

2. Legal Basis for Processing Personal Data
Insofar as we gather the data subject’s consent for processing operations of personal data, Article 6 paragraph 1 lit. a of the EU General Data Protection Regulation (GDPR) shall serve as legal basis for processing personal data. Upon processing of personal data which are required for fulfilling a contract to which the data subject is a contractual party, Article 6 paragraph. 1 lit. b of the GDPR shall serve as legal basis. This also applies to processing operations which are required for executing precontractual measures. To the extent that processing personal data should be necessary for satisfying a legal obligation to which our company is subject, Article 6 paragraph. 1 lit. c of the GDPR shall serve as legal basis.

In case, vital interests of the data subject or of another natural person should require the processing of personal data, Article 6 paragraph. 1 lit. d of the GDPR shall serve as legal basis. If processing should be required on grounds of observing a legitimate interest of our company or of a third party and interests, basic rights and freedoms of the data subject will not override the first-mentioned interest, thus Article 6 paragraph 1 lit. f of the GDPR shall serve as legal basis for processing.

3. Data Erasure and Storage Period
Personal data of the data subject will be deleted or blocked as soon as the purpose for storing will cease to apply. Furthermore, a storage may also be implemented if European or national legislators should have provided for this within Union-law directives, within laws or other regulations to which the data controller is subject. A blockage or deletion of data shall also occur if the storage period stipulated by the mentioned standards should expire, unless there is a necessity for a continued data storage given in order to enter or perform a contract.

IV. Providing the Website and Generating of Log Files

1. Description and Scope of Data Processing
Upon every call-up of our website, our system automatically collect data and information about the computer system of the calling computer.

Thereby, the following data are collected:

(1)    information about the type and version of the browser used and of add-ons;
(2)    the user’s operating system;
(3)    the protocols used;
(4)    the user’s IP address;
(5)    date and time of access;
(6)    websites, from which the user’s system reached our website;
(7)    websites, that are called up by the user’s system via our website;
(8)    data volume transferred;
(9)    regional origin, language;
(10)    terminals as well as the graphic resolution of their displays;
(11)    source of visitors;
(12)    downloaded files;
(13)    session duration.

The data shall also be stored in the log files of our system. A storage of these data together with other personal data of the user does not take place.

2. Legal Basis for Data Processing
Article 6 paragraph 1 lit. f of the GDPR shall serve as legal basis for the temporary storage of data and of log files.

3. Purpose of Data Processing
A temporary storage of the IP address by the system is necessary in order to facilitate delivery of the website to the user’s computer. For this reason, the user‘s IP address has to be stored. A storage within log files occurs in order to secure the website’s functionality. Additionally, the data serve us for optimizing the website and for ensuring the security of our IT systems. In this context, an evaluation of data for marketing purposes does not take place. By the element „gat._anonymizeIp();“ the last eight bits of the user’s IP address shall be erased and not be transmitted to Google Analytics. Our legitimate interest in data processing shall be embedded in these purposes, i.e. in accordance with Article 6 paragraph 1 lit. f of the GDPR.

4. Duration of Data Storage
The data will be erased as soon as they will no longer be required for the purposes for which they had been collected. An extended storage shall be possible. In that case the user’s IP address is anonymized in such a manner that the personal data may no longer be attributed to the calling client.

5. Possibility to Objection and to Disposal
Collecting of data for providing the website and storing data in log files is mandatorily required for operating the website. Consequently, there is no possibility existing as to objection on behalf of the user.

V. Use of Cookies

1. Description and Scope of Data Processing
Our website is using cookies. Cookies are text files, which shall be saved in the web browser respectively saved from the web browser in the user’s computer system. If a user should call up a website, thus a cookie will be saved in the user’s operating system. This cookie contains a characteristic string, which facilitates a clear identification of the browser upon repeated calls. We are using cookies in order to create our website more user-friendly. Some elements of our website may require that the calling browser will also be identified after moving from one site to another. Thereby, the following data are saved and transmitted in the cookies:

(1)    information about the type and version of the browser used and of add-ons;
(2)    the user’s operating system;
(3)    the protocols used;
(4)    the user’s IP address;
(5)    date and time of access;
(6)    websites, from which the user’s system reached our website;
(7)    websites, that are called up by the user’s system via our website;
(8)    data volume transferred;
(9)    regional origin, language;
(10)    terminals as well as the graphic resolution of their displays;
(11)    downloaded files;
(12)    session duration.

Furthermore, we are using cookies on our website, which will allow for analyzing the user’s surfing behavior. In this manner, the following data may be transmitted:

(1)    entered search terms;
(2)    frequency of site visits;
(3)    utilizing website functions;
(4)    IP address with deletion of the last 8 bits;

Upon calling up our website, the user is informed about the use of cookies for analytical purposes and his or her consent is gathered to processing data in this context. In this context, it shall also be referred to this data privacy policy.

2. Legal Basis for Data Processing
Article 6 paragraph 1 lit. f of the GDPR shall serve as legal basis for processing personal data, while using cookies. Article 6 paragraph 1 lit. f of the GDPR shall serve as legal basis for processing personal data, while using technically necessary cookies. Article 6 paragraph 1 lit. a of the GDPR shall serve as legal basis for processing personal data, while using cookies for analytical purposes, once the user’s consent to this effect will be available.

3. Purpose of Data Processing
Technically necessary cookies are deployed in order to simplify using the website for the user. Some functions of our website may not be offered without placing cookies. To this end, it shall be necessary to recognize the browser also after changing from one site to another. We do require cookies for the following applications:

(1)    adopting language settings;

(2)    remembering search terms;

User data collected by means of technically necessary cookies are not used for generating user profiles. Applying analysis cookies occurs in order to improve our website’s quality and content. By using analysis cookies, we learn how our website is used and may continuously optimize our offer. Our legitimate interest in data processing shall be embedded in these purposes, i.e. in accordance with Article 6 paragraph 1 lit. f of the GDPR.

4. Duration of Storage, Possibility to Objection and to Disposal
Cookies are stored on the user’s computer and sent from there to our site. Thus, you as user shall have full control about the use of cookies. By changing the settings in your web browser, you may deactivate or reduce the transmission of cookies. Previously stored cookies may be erased at any time. This may also occur automatically. If cookies placed for our website should be deactivated, it might be that not all the website’s functions can be used to the full extent.

VI. Contact Form and E-mail Contact

1. Description and Scope of Data Processing
There is a contact form available on our website, which may be used for establishing electronic contact. If a user should opt for this possibility, thus data entered into the input mask shall be transmitted to us and stored. These data comprise:

(1)    form of address;
(2)    forename, surname;
(3)    e-mail address.

Furthermore, at the time of dispatching the message, the following data are stored:

(1)    the user’s IP address;
(2)    date and time of registration.

In the context of the dispatching process, your consent shall be gathered for processing the data and it shall be referred to the privacy policy. Alternatively, establishing contact is possible by using the e-mail address provided. In that case, the user’s personal data transmitted along with the e-mail is stored. In this context, your data are not disclosed to third parties. Those data are exclusively used for processing the conversation.

2. Legal Basis for Data Processing 
Article 6 paragraph 1 lit. a of the GDPR shall serve as legal basis for processing personal data, once the user’s consent to this effect will be available. Upon transmission of personal data via e-mail, Article 6 paragraph 1 lit. f of the GDPR shall serve as legal basis for processing personal data. If the e-mail contact should aim at concluding a contract, thus Article 6 paragraph 1 lit. b of the GDPR shall additionally serve as legal basis for processing personal data.

3. Purpose of Data Processing
Processing personal data gathered from the input mask shall solely serve us for processing the contact establishment. In case of establishing contact via e-mail, also the legitimate interest required for data processing is embedded herein. Further personal data processed during the dispatching process, shall serve to prevent any abuse of the contact form and ensure the safety of our IT systems.

4. Duration of Storage
Data are deleted as soon as they will be no longer required for fulfilling the intended purpose for which they had been collected. This shall be the case as regards to personal data gathered from the contact form‘s input mask and as regards to such data transmitted via e-mail, once the respective conversation with the user will be finished. The conversation shall be considered finished, once it may be inferred from the circumstances, that the issue in question will have conclusively been clarified.

5. Possibility to Objection and to Disposal
At any time, the user has the possibility to withdraw his or her consent to processing personal data. If the user should contact us via e-mail, thus he or she may at any time object to the storage of his or her personal data. In that case, the conversation may not be continued. The withdrawal of consent shall have to be addressed to: datenschutz@consus.ag

In that case, all personal data, which should have been stored in the course of establishing contact shall be deleted.

VII. Applying of Analysis Services

1. Google Analytics
Our website uses Google Analytics, a web analytics service offered by Google Inc. (in the following: Google). Google Analytics uses so-called “cookies“, meaning text files, which will be saved on your computer, which will facilitate analyzing your usage of this website. The information about your usage of the website generated by the cookie shall usually be transmitted to and stored on a Google server in the USA. However, within Member States of the European Union or within other states party to the Agreement on the European Economic Area, your IP address shall beforehand be shortened by Google by means of activating an IP anonymization on those websites (see Item IV. 3.). Only in exceptional cases, the full IP address shall be transmitted to a Google server in the USA and shortened there. By order of the operator of this website, Google shall use this information to evaluate your usage of the website, to compile reports about the web activities and to provide further services towards the website’s operator related to the website’s usage and web usage. In this framework, the IP address transmitted by Google Analytics from your browser, is not pooled with other data of Google. You may prevent such storing of cookies by adjusting your browser software accordingly. However, we would like to point out that in such cases, you might possibly not be able to use all of this website’s functions to the full extent. Furthermore, you may prevent the collection of data generated by that cookie, which relates to your usage of the website (including your IP address) and also the processing of such data on the part of Google, by downloading and installing the browser plug-in available under the following link: tools.goog­le.com/ dl­pa­ge/ ga­op­tout.

Additionally or alternatively to the browser add-on, you may prevent Google Analytics’ tracking on our websites, by clicking that Link. Thus, an opt-out cookie shall be installed on your device. Thereby, the tracking by Google Analytics as regards to that website and for that browser shall be prevented in future, as long as that cookie will be left installed in your browser.

2. LinkedIn
On our website we use the LinkedIn Insight Conversion Tool of LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA. This shall allow us to obtain information about the usage of our website and to present you with advertisement contents matched to your interests on LinkedIn. To this end, a cookie with a validity of 120 days is placed in your browser, which will allow LinkedIn to recognize you if you visit a website. LinkedIn shall use these data to compile anonymous reports for us about advertisement activities and information about your interaction with our website.

You may deactivate the LinkedIn Insight Conversion Tool as well as the interest- based advertisement by an opt-out under the following link:

https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

If you should be a LinkedIn member just click on the field “Opt out on LinkedIn”. Other visitors click “Opt out”.

Further information about privacy at LinkedIn shall be found here: 

https://www.linkedin.com/legal/privacy-policy#choices-oblig

We shall use the LinkedIn Insight Conversion Tool according to the opt-in principle. This means that no data is automatically transmitted to LinkedIn without your consent. Your consent to data transmission to LinkedIn is given by accepting our cookie policy.

VIII. Newsletter

By granting your consent you may subscribe to our newsletter, which shall provide you with current information about our company. The advertised topics are  mentioned in the declaration of consent. For registering to our newsletter, we use the so-called double opt-in procedure. This means, after your registration we will send an e-mail to the e-mail address submitted, in which we will ask you to confirm that you wish to receive the newsletter. If you should not confirm your registration, then your information will be blocked and after one month automatically be erased. Furthermore, we store your respectively submitted IP addresses and the time of registration and confirmation. Purpose of that procedure shall be to verify your registration and if applicable facilitate clarification of a possible misuse of your personal data. After 24 hours, the IP addresses will be anonymized.

Mandatory disclosure for receiving the newsletter solely is your e-mail address. Submitting further details of further, especially marked data shall be voluntary and will be used to contact you personally. After your confirmation, we store your e-mail address for the purpose of sending the newsletter. Article 6 paragraph 1 phrase 1 lit. a of the GDPR, Article 7 of the GDPR in connection with Article 7 paragraph 2 N° 3 of the Act against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, in short: UWG) and Article 7 paragraph 3 of the UWG shall serve as legal basis. You may withdraw your consent to receiving the newsletter at any time and thus unsubscribe from the newsletter. You may declare your withdrawal by clicking the link provided in every newsletter mail, per e-mail to ir@consus.ag or by message addressed to the contact data stated in the imprint.

We advise you that upon sending the newsletter, we will evaluate your user behavior. To undertake this evaluation the sent e-mails shall contain so-called web beacons respectively tracking pixel, which represent one-pixel image files, which will be stored on our website. For the evaluation, we link the data mentioned under Item 3 and the web beacons with your e-mail address and an individual ID. Based on the thus gathered data, we generate a user profile in order to customize the newsletter to your individual interests. Thereby, we record, when you will read the newsletter, which links you will click in the newsletter and hence infer your personal interests. We merge these data with your activities executed on our website.

You may at any time object to this tracking, by clicking the separate link, which is provided in every mail or by informing us via another contact path. The information will be stored as long as you subscribe to the newsletter. After signing off, we will store the data anonymized and for merely statistical reasons. Moreover, such a tracking will not be possible if you have deactivated by default the display of images in your e-mail program. In that case the newsletter will not be displayed in full length and you might possibly not be able to use all functions. If you should have the images displayed manually, the above-mentioned tracking will take place.

IX. Application Procedure

We collect and process your personal data in order to handle the application procedure. To this end, Article 6 paragraph 1 phrase 1 lit. b of the GDPR, Article 26 of the (new) German Federal Data Protection Act (Bundesdatenschutzgesetz, in short: BDSG), respectively in case of consent: Article 6 paragraph 1 phrase 1 lit. a of the GDPR and Article 7 of the GDPR shall serve as legal basis.

It is important to us to ensure a maximum possible protection for your personal data. All personal data that will be gathered and processed in the framework of an application, are protected by technical and organizational measures against unauthorized access and tampering.

Your data are gathered for filling positions within the whole group of companies. To this end, Article 6 paragraph 1 phrase 1 lit. f of the GDPR shall serve as legal basis. By entering your data, you shall grant your consent to using your data in all companies that are corporately affiliated to the Company, with all rights and obligations pursuant to group law.

Processing may also be implemented by electronic means. This will especially be the case, if you should transmit corresponding application documents by using electronic means, for instance via e-mail or via the form, which may be found on our website. If we will conclude a contract of employment with you, then the submitted data will be stored for the purpose of handling the employment relationship, while observing statutory provisions. If we will not conclude an employment contract with you, then the application documents will be automatically deleted after six months after announcing the company’s decision of refusal, unless there should be other legitimate interests opposing such deletion. Other legitimate interests in this sense would be for instance the burden of proof in a proceeding according to the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, in short: AGG).

X. Encryption

Our website uses SSL encryption for reasons of security and in order to protect the transmission of confidential content, as for instance in the course of application procedures handled via our website’s form, which you will send to us as a website operator. You may identify an encrypted connection in the browser’s address bar, which will switch from “http://” to “https://” and on the padlock icon in your browser bar. Once the SSL encryption will be activated, data that you will transmit to us may not be wiretapped by third parties.

XI.Using Google Maps

This website uses Google Maps API in order to visually display geographic information. Upon using Google Maps, Google shall likewise gather, process and use data about the visitor’s use of mapping functions. More detailed information about Google‘s data processing may be found in Google’s Privacy Notice: www.goog­le.com/ intl/ de_­de/ help/ term­s_­maps.html. There, you may also change your personal privacy settings in Google’s Privacy Centre.

XII.    Rights of the Data Subject

If your personal details should be processed, then you are a data subject in accordance with the GDPR and you shall be entitled to the following rights towards the data controller:

1. Right of Access
You shall have the right to obtain from the data controller confirmation as to whether personal data concerning you are processed by us.

If such a processing should be given, you shall have the right to access from the data controller information about the following:

(1)    the purposes for which personal data will be processed;
(2)    the categories of personal data, which will be processed;
(3)    the recipients respectively the categories of recipients to whom personal data, concerning you, have been or will yet be disclosed;
(4)    the envisaged period for storing personal data concerning you or if precise details may not be obtained, the criteria applied for defining the storage period;
(5)    the existence of the right to request from the data controller rectification or erasure of personal data concerning you, of a right to restriction of processing by the data controller or of a right to object against this processing;
(6)    the right to lodge a complaint with a supervisory authority;
(7)    any available information as to the data  source, where the personal data are not collected from the data subject;
(8)    the existence of automated decision-making including profiling, referred to in Article 22 paragraph 1 and 4 of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

You shall be entitled to the right to request information if personal data concerning you should be transferred to a third country or to an international organization. In this context, you may request to be informed about the appropriate safeguards in accordance with Article 46 of the GDPR relating to the transfer.

2. Right to Rectification 
You shall have the right to obtain from the data controller rectification and/or completion, if processed personal data, which concern you, should be inaccurate or incomplete. The data controller shall have to implement the rectification without delay.

3. Right to Restriction of Processing
Where one of the following preconditions should apply, you may request the restriction of processing of data concerning you:

(1)    the accuracy of the data concerning you is contested by you for a period enabling the data controller to verify the accuracy;
(2)    the processing is unlawful and you oppose the erasure of personal data and request the restriction of their use instead;
(3)    the data controller no longer needs the personal data for the purposes of the processing, but these are required by you for the establishment, exercise or defense of legal claims; or
(4)    you have objected to processing pursuant to Article 21 paragraph 1 of the GDPR pending the verification whether the legitimate grounds of the data controller override your grounds.

Where processing of personal data concerning you has been restricted such personal data shall – with the exception of storage – only be processed with your consent or for the establishment, exercise or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State. Where the processing has been restricted in accordance with the above-mentioned preconditions, you shall be informed by the data controller before the restriction of processing is lifted.

4. Right to Erasure

a) Obligation to Erasure
You may request that the personal data concerning you shall be erased without delay and the data controller shall be obliged to erase these data without delay, where one of the following grounds applies:

(1)     the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
(2)    you withdraw your consent on which the processing is based according to Article 6 paragraph 1 lit. a or Article 9 paragraph 2 lit. a of the GDPR, and where there is no other legal ground for the processing;
(3)    you object to the processing pursuant to Article 21 paragraph 1 of the GDPR and there are no overriding legitimate grounds for the processing or you object to the processing pursuant to Article 21 paragraph 2 of the GDPR;
(4)    the personal data concerning you have been unlawfully processed;
(5)    the personal data concerning you have to be erased for compliance with a legal obligation pursuant to Union or Member State law to which the data controller is subject.
(6)    the personal data concerning you have been collected in relation to the offer of information society services in accordance with Article 8 paragraph 1 of the GDPR;

b)    Information to Third Parties
Where the data controller has made personal data concerning you public and is obliged pursuant to Article 17 paragraph 1 of the GDPR to erase these personal data, the data controller, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform data controllers, which are processing personal data that you as data subject have requested the erasure by such data controllers of any links to, or copy or replication of, those personal data.

c)    Derogations
The right to erasure shall not apply to the extent that processing is necessary (1)    for exercising the right of freedom of expression and information;
(2)    for compliance with a legal obligation which requires the processing pursuant to Union or Member State law to which the data controller is subject or for performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
(3)    for reasons of public interest in the area of public health in accordance with Article 9 paragraph 2 lit. h and i as well as Article 9 paragraph 3 of the GDPR;
(4)    for archiving purposes in the public interest as regards to scientific or historical research purposes or statistical purposes in accordance with Article 89 paragraph 1 of the GDPR, to the extent that the right referred to in paragraph a) is likely to render impossible or seriously impair the achievement of the objectives of that processing; or
(5)    for the establishment, exercise or defense of legal claims.

5. Right of Information
If you should have exercised your right to rectification, erasure or to restriction of processing towards the data controller, he or she shall be obliged to communicate that rectification or erasure of personal data concerning you or restriction of processing carried out to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort. You shall be entitled towards the data controller to be informed about those recipients.

6. Right to Data Portability
You shall have the right to receive the personal data concerning you, which you have provided to the data controller, in a structured, commonly used and machine-readable format. Besides, you shall have the right to transmit those data to another data controller without hindrance from the data controller to which the personal data have been provided, where

(1)    the processing is based on consent pursuant to Article 6 paragraph 1 lit. a of the GDPR or Article 9 paragraph 2 lit. a of the GDPR or on a contract pursuant to Article 6 paragraph 1 lit. b of the GDPR and
(2)    the processing is carried out by automated means.

In exercising that right, you shall moreover be entitled to the right to have the personal data concerning you transmitted directly from one data controller to another, where technically feasible. Freedoms and rights of others shall not be affected by this.

The right to portability shall not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller.

7. Right to Object
You shall have the right to object on grounds relating to your particular situation, at any time to processing of personal data concerning you, which is based on Article 6 paragraph 1 lit. e or f of the GDPR; this shall also include profiling based on those provisions.

The data controller shall no longer process the personal data concerning you, unless the data controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. Where personal data concerning you are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning you for such marketing; which includes profiling to the extent that it is related to such direct marketing. Where you object to processing for direct marketing purposes, the personal data concerning you shall no longer be processed for such purposes. In the context of the use of information society services – irrespective of Directive 2002/58/EC – you shall have the right to object by automated means using technical specifications.

 8. Right to Withdraw the Declaration of Consent Regarding Data Protection Law
You shall have the right to withdraw your declaration of consent regarding data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent granted before its withdrawal.

9. Automated Individual Decision-making, including Profiling
You shall have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision:

(1)    is necessary for entering into, or performance of, a contract between you and the data controller;
(2)    is authorized by Union or Member State law to which the data controller is subject and which also lays down suitable measures to safeguard your rights and freedoms and legitimate interests or
(3)    is based on your explicit consent.

However, those decisions shall not be based on special categories of personal data referred to in Article 9 paragraph 1 of the GDPR, unless Article 9 paragraph 2 lit. a or g of the GDPR applies and suitable measures to safeguard the rights and freedoms and your legitimate interests are in place.

As regards to the cases referred to under (1) and (3), the data controller shall implement suitable measures to safeguard the rights and freedoms and your legitimate interests, at least the right to obtain human intervention on the part of the data controller to express one’s own point of view and to contest the decision.

10. Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you shall have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement, if you consider that the processing of the personal data concerning you infringes the GDPR. The supervisory authority with which the complaint has been lodged shall inform the complainant on the progress and the outcome of the complaint including the possibility of a judicial remedy pursuant to Article 78 of the GDPR.