In fact I'd already turned off that web and app activity thing in addition to pausing location history. And from the G Suite administration I turned off saving of "Chrome history and activity from sites, apps, and devices that use Google services" for all users. I also individually turned off voice and audio activity and youtube history. It's basically about turning everything off that can be turned off. It seems to me to be also a bad idea to let Google manage one's passwords in Chrome, because if someone gets access to one's Google account they can actually read all those passwords in plain text - or that's how it used to be. I don't currently have Chrome in order to check.