privacy policy to be written