My thoughts about having a company-managed phone or a company-paid contract, and your company Exchange. I include relevant information for iPhone devices (since the amount control varies across mobile platforms).
If you are using Exchange ActiveSync to access your company email/contact/calendar, note that ith ActiveSync, your company can:
- Configure a Mobile Phone for Synchronization
- Disable a Mobile Phone for Exchange ActiveSync
- Enable a Device for Exchange ActiveSync
- View a List of Devices for a User
- Configure Device Password Locking
- Recover a Device Password
- Perform a Remote Wipe on a Mobile Phone
- Install SSL Certificates on a Windows Mobile Phone
- Configure Mobile Phones to Synchronize with Exchange Server
Apple and Google also have similar centralised management options. There may be other 3rd party services or software that perform similar tasks.
If your phone has been set up with Google G Suite, your company can:
- Automatically synchronize email, calendars, and contacts with users’ devices.
- Turn on or off features, such as lock screen widgets, Siri, My Photo Stream, Handoff, and iCloud Photo Sharing.
- Protect your organization’s managed data by controlling which apps can be used to open documents and attachments.
- Control Apple® iCloud® backup and sync, and turn on backup encryption.
Apply device-management controls, such as account wipe, encryption, and screen lock.
- Keep work data secure with G Suite apps, such as Gmail, Google Drive, and Calendar. For details, see Get mobile apps for iOS devices.
If your company was using Apple Device Enrolment, they can access, amongst other things:
- Global network proxy for HTTP
- Allow iMessage, Game Center, iBooks Store, AirDrop, Find My Friends
- Allow removal of apps
- Allow user-generated content in Siri
- Allow manual installation of configuration files
- Allow conﬁguring restrictions
- Allow pairing to computers for content sync
- Allow account modification
- Allow cellular data settings modification
- Allow Erase All Content and Settings
- Restrict AirPlay connections with whitelist and optional connection passcodes
- Enable Siri Profanity Filter
- Single App Mode
- Accessibility settings
Note that a remote backup includes a lot of your phone information (installed apps, etc). I'm almost certain your company could access this information if they wanted to.
This depends on whether your employer simply pays for your contract or they are the contract owners and therefore have access to the mobile operator online tools.
If they own the contract, they can definitely access the detailed list of phone calls (including numbers, time and duration). They may also be able to access your Internet data pattern usage (which may reveal some of your habits).
I know of no provider (Europe / Spain) that allows customers to access a detailed list of websites visited, or IPs accessed, but I might be wrong here. I doubt this since it would require your phone provider to do deep packet inspection and maintain quite expensive log and data mining facilities... it is definitely doable but I never heard of this.
Anyone using their phone to access their company resources (even simply checking mail via POP3/IMAP) is usually revealing their approximate geographic position to their company in a periodic fashion.
If you use your company proxy or VPN to access any of their resources, note that your Internet traffic or browser behavior may be being forwarded through your company servers, which would allow them to track which sites you visit (and the content if those sites don't use HTTPS).
If your company has installed custom certificates on your phone, they could potentially also view any HTTPS traffic if you are using their proxy.
In summary, I'd recommend you to:
- Find out if your phone has been enrolled to a remote management system.
- Check what kind of information your phone company provides to their (business) customers about their contracts.
- Check if your company has installed any extra software, proxy/vpn settings or certificates on your phone (in case you handed your phone to them at any time OR allowed them remote administration).