Seems like a privacy policy that amounts to "lol, whatever" can't possibly be lagally binding in the EU at least. If it is (found to be) void they could be required to delete all customer data - as they have no legal grant to store it or use it for any purpose?