You will need a privacy policy because you have a contact form submitting data