I run a pet project server with a private website (which is put down for now due to GDPR) that I use to show of artworks that I did. It does not have a user login or anything, only a small form for users to comment. Although my site doesn't process personal data (not by itself or by third party tools) I put it down by replacing it with a blank page, only leaving my basic auth protected private webmail-backend online. Someone contacted me recently and told me I still need a privacy policy since even with a blank page I process personal data like IP-Address or browser which is logged (for now I just completely shut down and disabled apache until I find the time to fix this). I run fail2ban on my server and in fact use the logs for automatically banning IPs that show malicious behavior. So I guess I'm actually processing personal identifiable information?
Does that mean the server still needs to have a privacy policy, even with a blank page?
And to think a step further: Wouldn't that also mean that the server needs a privacy policy as long as it is a public reachable server, even if it does not offer any services since a simple ping could place an IP in its logs or failed attempts against ssh would ban an IP (which would prove that it has been processed and stored).
To make it clear. I'm not asking how to avoid having a privacy policy. Im just curious if a server that provides no service to users at all (e.g a blank or no website that only serves as a private git-repo server or/and is only accessible via terminal) really still needs a privacy policy.