Technically data use policies are not specifically made to protect user privacy, however it also should not violate user privacy. Data use policies are required by law. They are compulsory disclosures that list the various ways in which data in the form of personal data of individuals is collected, shared or used by digital companies(companies that operate on the internet, make use of email lists, etc ) are used.
It should be the Central processing unit, as it is the part where information is calculated in the compute, but RAM is also an internal working, used for temporarily storing information. I would Go with CPU to be safe.
