The Android Device Manager application has access to many device permissions. Some of those allow it enable GPS capabilities in order to find out the device's current location. Once you enable it on your phone, you can log into ADM's web site, and provided your device currently has Internet connectivity, you can send a request to your phone to retrieve this information and send it to Google's servers. Google then displays see this information on a live map.
As described in the Help section of ADM's website, you can also choose to provide the phone number to dial once you lock the device remotely (it can be any number that you currently have access to.) This information is then sent to the phone, and is displayed on the lock screen with a dial button.
You can also choose to wipe your device, in which case Google will remotely instruct the ADM app that is installed on your device to perform a full factory reset (including wiping the contents of removable storage.)
In terms of privacy issues, it's definitely a trade-off. By using apps like Android Device Manager (there are plenty of alternatives as well,) you are trusting that application's developers with your location data. In return there is a small chance that you will be able to retrieve a lost or stolen phone, or at the very least erase your private data off of it. In this case you place your trust in Google, since they are developing ADM.