This is a launch blocker, not a nicety. The contact form takes a name, an email address and a message. Under UK GDPR that is personal data, and a site collecting it owes visitors a clear account of what happens to it. The wording has to come from KiddoFizz and describe what they actually do — it cannot be drafted from a template here.
What the notice needs to cover
Each of these is a question a parent is entitled to ask before sending a message about what is in the bottle.
Cookies need the same treatment. If analytics is added, non-essential cookies require consent before they are set under PECR — a banner that only informs is not enough.