As a general rule, no one at your company can discover, see, or access your direct conversations, private activities or deal activities unless they are invited. These medians are as private as sending an email.
The only exception is that company or team admins can add themselves onto deal activities. THis cannot be done in secret so you would notice if they add themselves as a user to one of your deals. This is necessary to support users and reassign work, and maintain company control of the infformation held in important deals when people leave. If your activity is private, then no one can see it exists until they are invited to it.
Companies can assign permissions to see deals by tags like division, department, category, geography, etc. None of these permissions allow those users to gain access to the contents exchanged in the activity unless they are expressly invited into them.
Candex stores all files and messages and though they are controlled by you, these belong to your Organization. At any time, an authorized representative of your company can obtain full data exports of any activity (as with most email accounts). This data is in a raw format and is typically used for exceptional circumstances like legal, compliance or regulatory matters.