Great question, however the important point here is that the company makes the claim they will not sell user data. "Period." So the company implies that if they are sold they will be sold with no user data
I believe the problem is not doing this, but the text in the policy is misleading, since users would believe their data would never be shared with anyone outside of the company itself _unconditionally_, which is not true (if only by technicality), the data can be sold as part of the company.