Yes, almost certainly. If you are not collecting personal data you might not need one but visitors expect to see a policy. You can just state this in your privacy policy. Sundial can provide a simple privacy policy but you may prefer to get legal advice as it’s a complex area on some websites.

This article explains it well although I think it’s a grey area that you don’t need one if you don’t process personal data. Are you sure you are not collecting analytics, storing cookies, capturing IP addresses?

GDPR law states you must have an active opt-in/out for cookies on your website also. That’s a very quick job and Sundial can add that in (check the one on this website) – just contact me.