Yes, your website is not exempt from needing a privacy policy just because your business is small. Any size business website that shares and uses information needs to have a privacy policy. If you use or share personal information without your customer being informed, you could be infringing on local laws.