Privacy policy

Draft — GDPR policy pending legal review.