This is not how we wanted to be featured on Hacker News but here it is. First of all let me start by saying: yes, we are legally required to ask all those questions in the Netherlands at a certain point, and to delete all of the data if we don't hire you. Do we have to ask all of this information in the first mail? No! In fact, our only goal was to have an efficient hiring process. Improving privacy is our company's mission, so we took the author of this post very serious, even before we came across this. Although we always made clear this information is optional and can be shared at later stages as well, we did not realize that it could be interpreted by our candidates as if he/she might get rejected if they refuse to share information. We do not want anyone to feel pressured. We therefore went back to the drawing board and changed our procedure.

Fortunately we only sent this mail to a handful of people before we realized that this is not the right approach. In the end, what we really wanted to know was: "Are you allowed to work in the EU?" But then we realized why stop there? We improved our process to ensure candidates are only asked to share a minimum amount of data! Feel free to check it out: https://summitto.com/hiringprocess

As other commenters have already stated, most information we ask is standard and in ~70% of the cases already answered in CVs we receive anyway because most of our applicants come from Germany, the Netherlands or Belgium. We learned now that as we target a global audience those "standard" questions are not a worldwide standard.

Some of you were suspicious that we base our hiring decisions on this information.

Let me state this very clearly: this requested information was never used to evaluate applicants. Summitto evaluates you only on your coding skills, and nothing else. We point to the fact in our first mail to the author of this post: "Please note that if there is some personal information which you prefer not to share yet, that is ok!" Moreover, we clearly stated this again in a second mail to the author of this post as well.

Regarding the IBAN account number: this information is essential to reimburse any flight expenses and of course to pay your salary. For the US citizens in this thread: no, sharing your bank account number in the EU is not comparable to how it works in the US banking system. IBAN numbers are not private or easily exploitable data. Still, we have now scrapped this question from our first email.

Although we truly appreciate the author's criticism in this post regarding the threat of theoretically losing his/her privacy, we would like to point out the irony that by complaining without properly anonymizing the data he/she actually violated ours.

We value the privacy of all of our candidates. We encourage them to protect the data they send using PGP, so it is encrypted in transit and at rest. Any data which belongs to applicants which were not hired is deleted within 30 days after the last contact.