Every data packet going through company network is fair game

Password encryption itself does not encrypt all the data after you log in, unless you use https:// link after you login to your private online account, instead of http:///

In the past, I can use a tool to sniff all the facebook cookies in a wifi hotspot, and assume a session of any facebook whose owner is nearby, because even though facebook is password protected, all the traffic after login is not encrypted and only identification / protection is a cookie string.  I think facebook fixed that long time ago.

Therefore, if you login to your private account, pay attention subsequent URL is https://my.acmebank.com/, not http://my.acmebank.com/ Because the former sends open, non-encrypted data through your company's network, and the company can look at anything they chose going through their network.

The lesson is, use your private account on your smart phone.