Yes, you do even if you are not collecting personal data. You can just state this in your privacy policy. Sundial can provide a simple privacy policy but you may prefer to get legal advice as it’s a complex area on some websites.

This article explains it well although I think it may be wrong when it suggests you don’t need one if you don’t process personal data. All websites need a Privacy Policy and that is the law.

https://harperjames.co.uk/article/what-is-a-privacy-policy/

GDPR law states you must have an active opt-in/out for cookies on your website also. That’s usually a very quick job and Sundial can add that in (check the one on this website) – just contact me.