If you process any personal data, you do need to provide notice to the data subjects per Art 13 or Art 14 GDPR. Personal data is any information relating to a (directly or indirectly) identifiable natural person.
It seems you are processing personal data including as addresses, PayPal accounts, and IBANs. Thus you're in scope of the GDPR. The GDPR does have an exception when data is processed for “purely personal or household purposes”, but that very likely does not apply to you.
The German Datenschutzkonferenz (DSK), a cooperation of the German supervisory authorities, has published a handout on information obligations, listing which information has to be provided in a privacy notice: https://datenschutzkonferenz-online.de/media/kp/dsk_kpnr_10.pdf
Such a privacy notice can be fairly short if you're don't doing anything special, in particular if you only use the data as necessary to fulfil the sale contract and then as legally required (e.g. for keeping financial records). There are privacy notice generators that can help with the boilerplate, but be aware that some are significantly outdated, and that in any case you have to fill in the information about your concrete processing activities. You have guessed correctly that you will need to inform your customers about your data retention periods.
Your privacy notice will get more complicated if you also want to use this data in other ways, for example for marketing purposes. That would also require you to think about appropriate legal bases (e.g. legitimate interests, or consent).
