Yes you absolutely need a privacy policy!