Our bank hands out Credit Card applications that are processed through a third party. We have nothing to do with the cards after the application leaves our bank. Do we have to attach our Privacy policy to the application? I do not think we do since the bank's name is not on the application and we do not handle any aspect of the card.

No, but depending on your regulator, it might impact your policy disclosure.