I've seen a lot of odd choices in GDPR implementation, but "the privacy policy is a Vimeo-hosted video" is a new one to me