The site needs no server. The name fairfooddata.org has one anyway, because people insist on typing things: a proxy that fetches the pages from Swarm through the bzz.limo gateway, keeps them a few minutes and hands them to you. The gateway sees the proxy, not you. Your IP address stops at the proxy.
The servers in front of the proxy log your IP address, your browser and the page you asked for. Any web server does. The proxy's own log leaves the IP out. Those logs keep the service running and the scanners out, and are kept only as long as that takes. Nobody here calls them insights. Scanners keep asking the proxy for a WordPress login. There is no WordPress. We admire the optimism.
Fair Food Data is the controller and its hosting provider runs those servers on its behalf. The legal basis is our legitimate interest in a site that stays up: GDPR Article 6(1)(f). Yes, legitimate interest. For once it is one.