This is from their
privacy policy:
"VI. How We Disclose Your Personal Data
At times OnePlus may make certain personal data available to other companies that are wholly or jointly controlled by us ("Affiliates") and other third parties that work with OnePlus in order to provide Services to you. Your personal data will not be shared with third parties for their own independent marketing purposes.
• Affiliates: Your personal data may be shared with OnePlus's Affiliates for the purpose of rendering our Services to you. If Affiliates wish to process data for a different purpose, they must first seek your consent, unless another lawful basis exists.
• Service Providers and Partners: Some of our Services will be provided with the assistance of third parties. We may also share some personal data with our partners in particular so as to deliver you a better service and improve your user experience. For example, when you use the security centre app, third-party service providers are used to scan for viruses and free up storage space on your phone, and we engage third-party service providers to provide you with enhanced customer service. We may also rely on service providers to identify and serve targeted advertisements, provide email services, provide tax and accounting services, organise competitions and deliver web hosting or analytics services. Any such service providers will, through appropriate data processing agreements, be bound to only process personal data on OnePlus's behalf and under our instructions, unless such service providers act as independent controllers.
• Purchasers and third parties in connection with a business transaction: Where a merger, acquisition, bankruptcy liquidation or similar action takes place, we may transfer or disclose your personal data to a limited, but necessary extent to the applicable third party.
• Law enforcement, regulators and other parties for legal reasons: We may also disclose your personal data to third parties as required by law, or if we reasonably believe that such action is necessary (a) to comply with a subpoena or other legal proceedings, legal actions or government agency requests; (b) when we believe in good faith that a disclosure is necessary to comply with the law and the reasonable requests of law enforcement; (c) to protect and exercise our legal claims, rights and property; (d) to protect your rights, property or personal safety or that of others; (e) to investigate fraud and (f) to protect the security or integrity of our Services.
• The public, when posted in certain public spaces: Some of our Services allow you to connect and interact with others. Your profile information or information that you post in a forum or on a blog, including personal data, will be accessible to other users or the general public by default when you create it. Such content will be accessible by the general public or the members of the Service depending on the Service used.
• Otherwise with consent: We may disclose your personal data to certain other third parties with your consent."
It seems to me that the main possible loophole would be "Affiliates" and "Service Providers and Partners", since phone companies will often work with a number of software companies to include certain apps or services by default on their phones. The example OnePlus gives would be the built-in security center giving access to the antivirus software company -- this has been of concern in the past with Samsung, who used to partner with Cheetah Software (the sleaziest of the sleaze) to provide their "phone cleaning" services.