I'm based in the UK, and I am building a personal website (basically an online resume/portfolio) which I have ensured does not collect any personal information (there are no forms, cookies etc.). I do not currently run a company/business.
The only form of potential data collection is that the web host I use has logging of IP addresses which logs when a webpage or file is requested. These logs are temporary (a max of ~2000 log entries are recorded at any given time, and automatically expire after a week).
The web host which manages the service for me hosting my website is owned by a US company, but when choosing to set up the web app, I have specifically chosen servers in Europe. The host has mentioned that the logs for the servers may route through US servers, but they are using the EU - US Privacy Shield framework set forth by the US Department of Commerce and the EU.
On my contact page, there is a button which allows visitors to contact me using email (a mailto:// link). Only if the user wants to contact me, do they have to click the button, which will open up their email application and they can then send me an email.
I'm somewhat confused by what needs to be included in a privacy policy/notice. Do I simply need to state that IP addresses are logged but are deleted after a week? Not sure if there is anything else that needs to be included, specifically for GDPR. As the user is choosing to send me an email, do I need to state anything about the email communication between us both)?