Any organisation that processes personal data is required by law to establish a privacy policy. Even if your company doesn’t have a website, this is true. If you do not own a website, you must give users a copy of your privacy statement when you request their personal data.