Since this website processes personal data and has a login function, it requires a privacy statement. Otherwise it is in violation of the GDPR.

It also needs to provide options to change/delete a users data.