In terms of a privacy policy, the UK ICO has a good starting point for UK based organisations: https://ico.org.uk/for-organisations/advice-for-small-organi...

It covers the basics of GDPR compliance.